Report Calls Out Cloudflare for Facilitating Piracy, Counterfeits

According to new research released by Corsearch, a significant number of websites engaging in piracy and counterfeiting use Cloudflare’s Content Delivery Network (CDN) services.

Cloudflare was detected as providing services to websites that infringed trademarks and copyright six times more than the next service provider. 49% of the websites Corsearch flagged for content piracy used Cloudflare in addition to 23.5% of websites flagged for offering counterfeit goods.

Additionally, Corsearch notifies Google when it believes a website should be demoted in its search engine due to infringing trademarks or copyright. When Corsearch analyzed this data, it found 71% of these websites used Cloudflare’s services.

“The proliferation of unlawful products, services and content online undermines consumer trust and can lead to substantial consumer harm. The unwitting online purchase of a counterfeit pharmaceutical, for example, can have lethal consequences,” said Corsearch in a statement.

Corsearch, a firm specializing in IP protection, compiled the data from its work with brands and content creators to remove instances of counterfeiting and piracy from the internet. The company analyzed approximately 14,000 website enforcements over the last year.

Corsearch’s goal behind the report is to call on Cloudflare to do more to protect IP rights and work to take down instances of copyright and trademark infringement.

“Cloudflare is a key intermediary that can do a lot more. Its services are fundamental to the operation of many websites that infringe intellectual property. There is no doubt that if Cloudflare followed the example of others and did more to assist rights owners, the online environment for consumers would be substantially improved,” said Simon Baggs, President of Brand and Content Protection at Corsearch.

What is Cloudflare?

Cloudflare is a popular choice because it offers DDoS protection and SSL certification services for free while competitors typically offer these in a premium paid package. According to Corsearch’s report, “Cloudflare does not require its customers to provide verified identification and business or personal registration details, essentially granting them a cloak of anonymity under which to operate.”

Cloudflare pitches itself as a DDoS mitigation service and content delivery network rather than a traditional hosting provider. A blog post on Cloudflare’s website estimates that about 20% of websites on the internet use its services. The company has rapidly grown since it went public on the New York Stock Exchange with some investment analysts referring to the company as a hypergrowth stock.

According to Cloudflare, it does not host web content and is not able to remove content from a website, but it does often receive complaints from IP holders because its name appears in the same place that web hosting services do.

On Cloudfare’s website, the company says, “we forward copyright complaints to website operators and hosting providers, and give rightsholders the hosting providers’ contact information. While we are not legally obligated to provide that sort of assistance, we think it is the right thing to do and the best way for us to help”.

Additionally, when a formal complaint is submitted through its website, Cloudflare will notify its customer of the report and forward the report to the website’s hosting provider.

Cloudflare has also come under fire from prominent organizations in the entertainment world. The Recording Industry Association of America, the Motion Picture Association (MPA), and the Association of American Publishers all filed a complaint in 2019 to the United States Trade Representative that Cloudflare was helping pirating websites hide their hosting location.

Additionally, the MPA filed a submission to the United States Trade Representative in 2022 on behalf of big production companies including Netflix, Walt Disney Studios, Paramount Pictures, and more. In the submission, the MPA said, “Cloudflare’s customers include some of the most notorious, longstanding pirate websites in the world.”

Corsearch’s Requests

As part of the report, Corsearch made eight requests to Cloudflare. Corsearch wrote “we are asking Cloudflare to do more to support rights owners by voluntarily implementing certain measures. These measures are reasonable, proportionate and if adopted by Cloudflare will have a significant impact.”

These requests include pulling its services from websites that have been recognized by the Counterfeit and Piracy Watchlist, publishing a transparency document that includes which websites IP holders have reported to Cloudflare, and verifying basic information about its customers and their identity.

Some of the recommendations would see Cloudflare follow in the steps of Google, which removes websites from its services when it is notified of trademark infringement and provided proper documentation.

Corsearch currently has a protocol in place that notifies Google when they detect IP infringement on a website. The company is hoping to do the same with Cloudflare.

Another similarity to Google would be the transparency report, which Google makes available through its Lumen database.

Cooperation with Law Enforcement

Corsearch also analyzed data collected by the City of London Police’s Police Intellectual Property Crime Unit (PIPCU). PIPCU was established in 2013 as the national lead force to investigate intellectual property crime in the United Kingdom.

As part of PIPCU’s work, the law enforcement unit created the Infringing Website List to stop the funding of illegal streaming services. Law enforcement shares this list of websites that infringe copyright with advertisers to stem the flow of advertising money to illegally operating websites.

From this list, Corsearch found that Cloudflare 67% of the websites on the list actively use Cloudflare’s services.

“We ask the service providers we work with to support the removal of domains that are harmful to the creative industry and its consumers. There is still work to be done for all providers to have policies in place that ensure they aren’t benefiting harmful domains and preventing law enforcement from taking action against them,” said Detective Constable Abdun Noor from PIPCU.

Corsearch cited other lists and data which Cloudflare could utilize to fight back against IP infringement including the Notorious Markets List published by the United States government and the Counterfeit and Piracy Watchlist published yearly by the European Commission.

According to a study from the U.S. Chamber of Commerce, online piracy results in the U.S. economy losing at least $29.2 billion of revenue each year.