France's Conseil d'État has settled a question that regulators across Europe have been circling for two years: when a government orders content blocked, does that duty stop at internet service providers, or does it reach further down the stack, to the DNS resolvers and CDNs that make the modern web function? On 15 July 2026, in decision no. 509579, the court answered decisively — it reaches further.
The Ruling
The case began on 9 July 2025, when ARCOM, France's audiovisual and digital regulator, notified Cloudflare that it had 72 hours to block French access to 19 internet addresses distributing content from Russian media outlets sanctioned under EU Regulations 833/2014 and 269/2014, adopted under Article 215 TFEU following the invasion of Ukraine. Cloudflare — arguing the order was insufficiently reasoned, denied it a chance to respond, and conflicted with its obligations under the EU's Digital Services Act — asked the Conseil d'État to annul it, or failing that, to refer the DSA compatibility question to the Court of Justice of the EU (Légifrance, CETATEXT000054434291).
The court rejected all of it. It found ARCOM's order adequately motivated, ruled that no advance hearing was owed to Cloudflare when the underlying entities were already EU-sanctioned and identified, and — most consequentially — declined to send the case to Luxembourg, finding "no serious difficulty of interpretation" of DSA Article 9 that would create reasonable doubt requiring CJEU guidance. On proportionality, the court noted that Cloudflare retained discretion over how to implement the block and that comparable providers had already complied without disrupting their architecture (Légifrance; Telecompaper). This was not an isolated skirmish: ARCOM followed up in February 2026 with a further round of measures blocking and delisting 35 additional Russian-media-linked sites and streaming pages, citing the same 1986 broadcasting law and EU sanctions framework (ARCOM press release).
The Case for ARCOM's Approach
The strongest version of ARCOM's position deserves a fair hearing. EU sanctions against Russian state media are not abstract policy preferences — they are binding obligations under Article 215 TFEU, adopted in direct response to a war of aggression on European soil. If sanctioned outlets can route around ISP-level blocks simply by sitting behind a CDN or using a foreign DNS resolver, then the sanctions regime becomes a formality that only the technically unsophisticated respect. Infrastructure providers are not passive pipes; they are chokepoints that determine whether a block is actually effective. The DSA itself, under Article 9, explicitly contemplates that "providers of intermediary services" — a category that plainly includes DNS and CDN operators — can receive binding orders to act against illegal content from national authorities (EUR-Lex DSA summary). Judged against that backdrop, ARCOM's order to Cloudflare is less a novel expansion of state power than a straightforward application of a framework the EU itself built.
Why the Precedent Should Still Worry Us
But the ruling's logic travels well beyond 19 Russian media addresses, and that is precisely the problem. Once a national regulator can compel a CDN or DNS resolver — infrastructure serving millions of unrelated websites — to enforce content-specific blocking, the same tool is available for any future government objective a court finds "proportionate." France's target this time was uncontroversial: EU-sanctioned propaganda outlets tied to an active war. But the Conseil d'État's reasoning did not turn on the content being especially odious; it turned on the general proposition that intermediary status under the DSA does not exempt infrastructure providers from national blocking injunctions, and that courts owe regulators considerable deference on proportionality once some technical flexibility exists. That is a low bar, and it is now precedent for the next order — on gambling, on copyright, on speech far more contestable than sanctioned state media.
The DSA was supposed to function as a check here, not just a hook for jurisdiction. Article 9 requires orders to state their legal basis, identify content precisely, and preserve redress rights specifically so that infrastructure-layer blocking doesn't become an unaccountable shortcut around the harder, more transparent process of going after the content's actual publisher or host. By declining even to send Cloudflare's DSA question to the CJEU — the one venue that could set a uniform EU-wide standard for how far Article 9 reaches into the infrastructure layer — the Conseil d'État chose national deference over legal clarity. Every other member state now has a data point suggesting national courts can resolve DSA-intermediary questions unilaterally, inviting a patchwork of blocking obligations that vary by jurisdiction even though the underlying regulation is supposed to be a single EU-wide rulebook.
What Should Happen Next
A CJEU referral was the more defensible outcome, not because Cloudflare should have won outright, but because a question this structurally important — does DSA intermediary status protect infrastructure providers from open-ended national blocking injunctions, or not — should not be settled 27 different ways by 27 national courts. Absent that clarity, expect more regulators to test how far down the stack their blocking powers now reach, and expect infrastructure providers to face rising compliance costs and legal uncertainty for hosting traffic they have no editorial control over. Proportionate sanctions enforcement is a legitimate goal. A vague, judge-made rule that lets any national authority draft any infrastructure provider into content enforcement is not the way to get there.