The latest analysis finds 89.6% of European companies using a CDN rely on Cloudflare—a single American company that sits in front of the continent's web traffic. In the Netherlands it's 95.6%. In the UK 93.2%. In Germany, still 81.4%. This is not a plurality. This is supplier hostage-taking dressed as market choice.
The performance of that hostage-holding is well-documented. Cloudflare had a major outage on 18 November 2025 that lasted nearly six hours. Another on 5 December. A third on 20 February 2026 that pulled 25% of its BGP prefixes from the internet. None were attacks. All were internal failures that took thousands of European sites down at the same time because they all sat behind the same front door.
The hypocrisy runs thicker than the concentration. Brussels has spent the last four years lecturing about digital sovereignty. The EU wrapped itself in GDPR. Handed out fines. Demanded that Europeans keep data local. Proposed an EU cloud strategy. Announced plans for a European AI infrastructure. Then turned around and let nine in ten companies that touch the internet do it through a single American company's reverse proxy.
This is not about Cloudflare being negligent. They publish postmortems. The bugs they ship—a doubled config file, a cleanup job that deleted too much—are the kind any infrastructure company ships. The problem is scale. When four in five companies share one front door, that door's maintenance becomes everyone's outage.
The record shows Brussels knows this. The NIS2 directive sits on the books. The European Chips Act happened. The IPCEI hydrogen projects got funding. All of it wrapped in language about strategic autonomy. Yet when the CDN question came up, nobody wrote a directive. Nobody funded an alternative. Nobody even called it a problem until an analysis team dug into DNS headers.
The gap between what the EU says about digital independence and what the continent actually does is so wide that you stop calling it hypocrisy and start calling it deliberate. A regulatory apparatus that can issue a fine to Google for €5 billion over search results finds nine in ten companies routing through Cloudflare and says nothing. Not because they didn't know. Because enforcement of sovereignty against American infrastructure requires doing something difficult, and the EU's reflex is always to write a compliance memo instead.
What matters is this: Cloudflare will fail again. When it does, 40,000 European companies will go dark together. The CEO of OVH can have his data centers burn down, his company nearly collapses, and the market still won't shift. A single American company can have three major outages in five months and Europe will keep using it because the alternative is building something yourself, which requires money, focus, and the willingness to fail. None of those are the EU's strong suit.
The CDN was supposed to be solved ten years ago. Gaia-X was supposed to happen. European cloud was supposed to matter. It didn't. And so nine in ten of the companies Brussels claims to be protecting still funnel their traffic through San Francisco.