By ByteBot
Cloudflare is threatening to pull millions of dollars in free cybersecurity services from the Milano-Cortina 2026 Winter Olympics after Italy fined the company €14.2 million for refusing to block pirate streaming sites. The Olympics start February 6—just weeks away. Italy’s aggressive move and Cloudflare’s nuclear response have ignited a high-stakes debate over internet infrastructure sovereignty versus freedom.
The €14M Fine for DNS Non-Compliance
On January 8, Italy’s telecom regulator AGCOM announced it fined Cloudflare €14.2 million ($17M USD)—exactly 1% of the company’s 2024 global revenue. The penalty stems from Cloudflare’s refusal to comply with Italy’s “Piracy Shield” law, which requires DNS providers to block reported pirate domains and IP addresses within 30 minutes of notification.
Italy ordered Cloudflare to block access to over 15,000 domains and IP addresses on its popular 1.1.1.1 public DNS resolver back in February 2025. Cloudflare didn’t budge. AGCOM noted that Cloudflare is linked to roughly 70% of the pirate sites targeted by the system, which was originally designed to combat illegal Serie A football streaming and later expanded to movies and TV.
Since February 2024, Piracy Shield has blocked 65,000 domain names and 14,000 IP addresses. The 30-minute deadline is unprecedented in Europe—France’s similar anti-piracy system allows up to three days for blocking.
Why Cloudflare Says DNS Filtering Is Technically Impossible
Cloudflare’s refusal isn’t just defiance. The company argues that filtering 1.1.1.1 for a single country is technically impossible without degrading performance for millions of users worldwide. The 1.1.1.1 DNS resolver uses anycast routing, automatically directing users to the nearest Cloudflare server globally. Geographic filtering would break this model, requiring separate infrastructure for each country—defeating the entire purpose of a fast, reliable global DNS service.
Italy’s Piracy Shield has a track record of collateral damage. In October 2024, the system mistakenly blocked Google Drive and YouTube for several hours after rights holder DAZN accidentally submitted a Google CDN subdomain for blocking. By June 2025, over 500 confirmed legitimate websites were blocked, a number that grew into the thousands over time.
The 30-minute requirement leaves no time for verification or appeals. Experts warn that DNS filtering is inherently imprecise. As the Internet Infrastructure Coalition noted, “infrastructure-level controls are consistently imprecise, opaque, and ultimately ineffective—introducing network instability, disrupting lawful services, and fragmenting the global Internet.”
Cloudflare’s Nuclear Threat: Olympics at Risk
CEO Matthew Prince didn’t hold back. On January 8, he posted on X calling Italy’s system “DISGUSTING” and a censorship scheme by “a shadowy cabal of European media elites” with no judicial oversight, due process, appeal, or transparency. He announced four retaliatory measures under consideration:
- Discontinue millions in pro bono cybersecurity services for Milano-Cortina 2026 Olympics
- Halt free cybersecurity services for all Italy-based users
- Remove all servers from Italian cities
- Cancel plans to build a Cloudflare office in Italy
The Olympics threat is no bluff. Cloudflare successfully managed cybersecurity for the Paris 2024 Summer Olympics, blocking spam, phishing, malware, and other threats. Prince plans to meet with the International Olympic Committee in Lausanne to explain the risks if Cloudflare withdraws protection. Major international events are prime targets for cyberattacks, and Italy may struggle to find a replacement on such short notice.
Infrastructure Sovereignty vs. Internet Freedom
This clash transcends piracy. It’s about whether national governments can force global internet infrastructure providers to implement country-specific censorship. More than 60 countries already use DNS manipulation for censorship, and experts worry Italy’s aggressive approach could set a dangerous precedent.
The European Commission has already called Piracy Shield “concerning,” noting that Italy cannot vaguely invoke the Digital Services Act to justify the system’s extended powers. France operates a similar anti-piracy system but with more transparency and flexibility—ISPs typically have three days to act, not 30 minutes.
Internet freedom advocates warn that “DNS resolvers are neutral infrastructure—not censorship tools.” When governments pressure a handful of global providers, they can cut off vital escape routes for users in countries with limited press freedom who rely on public DNS to bypass local censorship.
There’s also the question of effectiveness. Despite blocking 65,000 domains, legal streaming subscriptions in Italy haven’t increased. DAZN’s viewership remained stagnant in 2024. Pirates have adapted by using IPv6, VPNs, alternate DNS resolvers, and social media distribution. The system is losing to evolving evasion techniques while accidentally blocking legitimate services.
What Happens Next
The clock is ticking. With just weeks until the Olympics, Italy faces a choice: back down on the fine or risk international embarrassment if Cloudflare follows through. Legal challenges are likely, and the IOC’s response will be telling. If Italy’s aggressive model spreads, we could see the global internet fragment along national lines, with DNS providers forced to operate country-specific infrastructure or withdraw entirely from difficult markets.
For now, developers and internet freedom advocates are watching closely. The outcome will shape how internet infrastructure is governed for years to come.
