A person may use a platform operated by a company incorporated in one country, interact with another person located in a second country, while the platform uses servers in a third country, a domain registrar in a fourth, a payment provider in a fifth and contractual terms selecting the law of a sixth.
When something goes wrong, this architecture produces a difficult question: Who is actually responsible for dealing with it?
The answer is often fragmented.
- The platform may say the conduct did not violate its rules.
- The hosting provider may say it does not moderate its customer's content.
- The domain registrar may say the complaint concerns website content rather than DNS abuse.
- A regulator may say the company is established outside its jurisdiction.
- Another regulator may say the affected individual is located elsewhere.
- ICANN may determine that the underlying website-content dispute is outside the scope of its contractual compliance function.
Each individual response may have a legitimate institutional explanation.
Yet the combined result can still be disturbing: A serious complaint moves through the digital ecosystem while nobody accepts responsibility for resolving the underlying problem.
That is the internet's accountability gap.
Accountability Is More Than Receiving a Complaint
Many organizations equate complaint handling with accountability.
They are not the same thing.
A complainant may receive: “We reviewed your report.” “We found no violation.” “This matter is closed.”
That establishes that an answer was sent. It does not necessarily explain the decision.
Meaningful accountability requires enough information to understand the points below.
The distinction is fundamental. A decision does not become transparent merely because it has been communicated.
- what was actually under review;
- what evidence was considered;
- what rule or standard applied;
- what material findings were made;
- how those findings led to the conclusion; and
- whether the conclusion could be challenged.
- ContextExplain what was reviewed.
- EvidenceSet out the key evidence.
- ReasonsExplain the rule and reasoning.
- ReviewProvide a route to challenge.
The European Union Is Moving Toward Reason-Giving
Digital power should be accompanied by explainable decision-making.
The European Union's Digital Services Act provides an important example of this developing approach.
Article 16 requires qualifying hosting-service notices to be processed in a timely, diligent, non-arbitrary and objective manner. In applicable circumstances, the reporting party must receive confirmation and be informed of the provider's decision and possible avenues of redress.
Article 17 separately requires clear and specific reasons for specified restrictions imposed upon recipients of hosting services.
These rules do not solve every jurisdictional problem and do not apply universally throughout the world.
But they reflect an increasingly important principle.
But Platforms Are Only One Layer
It would be too easy to treat every internet intermediary as though it were the platform itself.
That would be technically inaccurate and legally unsound.
Consider a typical online service. A user sees only the website. Behind that website may be several different organisations.
Each entity controls something different. That means accountability has to follow control.
- the platform operator;
- an origin hosting provider;
- a cloud provider;
- a content-delivery network;
- a reverse proxy;
- a DNS provider;
- a domain registrar;
- a domain registry;
- a payment processor;
- an identity-verification provider; and
- multiple regulatory regimes.
- The platformState the scope of the decision and the available review route.
- The hosting providerState the scope of the decision and the available review route.
- The domain registrarState the scope of the decision and the available review route.
The Platform
A platform usually possesses the greatest visibility into what happened within its own service.
It is therefore reasonable to ask the platform detailed questions about how it investigated an event. What was reviewed? What evidence existed? Which rule was applied? What factual conclusion was made? Why did that conclusion result in enforcement or non-enforcement?
- livestream recordings;
- chat logs;
- account information;
- moderation history;
- complaint records;
- internal reports; and
- enforcement mechanisms.
The Hosting Provider
A hosting provider may be in a very different position.
It may provide infrastructure to thousands of customers and may not be institutionally equipped to determine the truth of every dispute occurring inside one customer's application.
Its accountability therefore has to be assessed differently.
Those are legitimate accountability questions. Demanding that the host become the court for every dispute is not.
- Did it maintain an appropriate abuse-reporting channel?
- Did it receive the complaint?
- Did it classify the issue correctly?
- Did it determine whether the matter fell within its acceptable-use rules or legal obligations?
- Did it identify the customer responsible for the content?
- Did it act where its own contractual or legal threshold was actually met?
The Registrar Problem
Who is responsible for the problem that remains?
Domain registrars illustrate the issue particularly well.
Under ICANN's Registrar Accreditation Agreement, accredited registrars must maintain abuse-reporting mechanisms, acknowledge reports and take reasonable and prompt steps to investigate and respond appropriately to abuse reports involving the domains they sponsor.
However, that does not mean every complaint about a website requires a registrar to suspend the domain.
ICANN's current definition of DNS Abuse focuses on specific categories including malware, botnets, phishing, pharming and certain spam.
Importantly, the 2024 contractual amendments strengthening DNS-abuse obligations were deliberately not designed to turn ICANN's contracted parties into general adjudicators of website-content disputes. ICANN explicitly distinguishes DNS Abuse from ordinary website-content abuse.
That distinction is reasonable. But it also exposes the gap.
A person may report serious conduct occurring through a website. The registrar may legitimately say: “This is not DNS Abuse.”
That answer may correctly describe the registrar's limited role. But then the next question becomes the one that the rest of the system still has to answer.
ICANN Shows Us Another Way to Think About Accountability
ICANN also demonstrates an important principle.
An oversight body does not always need authority over the underlying dispute in order to examine accountability.
ICANN Contractual Compliance can examine whether registries or registrars complied with the obligations contained in their agreements.
That creates two separate questions. Did the website engage in the alleged misconduct? Did the registrar comply with the obligations applicable to the registrar when it received the report?
The second question can be examined without deciding the first.
That distinction could become enormously important in broader digital accountability.
Oversight does not always require deciding who is ultimately right. Sometimes the proper question is: Did the institution entrusted with making the decision actually follow an accountable process?
The Jurisdictional Handoff
A recurring phrase in international digital disputes is: “Outside our jurisdiction.”
Sometimes that is entirely correct. No organization should be criticized merely because the law has not given it authority over a particular matter.
The accountability issue arises when jurisdiction becomes the end of the explanation.
A responsible jurisdictional response should make the boundary clear.
This can be called the Jurisdictional Handoff Test.
A good handoff does not require an organization to guarantee that the next regulator, provider or court will act. It simply prevents responsibility from becoming invisible.
- What part of the issue can this organization address?
- What part can it not address?
- Why not?
- Did it still perform the functions that remained within its authority?
- Is another entity or process better positioned to address what remains?
When the System Produces an Accountability Lacuna
Imagine the following sequence. A user reports a serious incident to a platform. The platform says: “No policy violation.” The user asks for reasons. The platform gives no meaningful explanation.
Eventually, everyone has given an answer. But nobody has actually answered the problem.
This is an accountability lacuna.
It does not necessarily mean that any single organization broke the law. It means that the architecture, taken as a whole, allowed responsibility to disappear between institutional boundaries.
- The user contacts the host. The host replies: “We do not control customer content.”
- The user contacts the registrar. The registrar says: “This is not DNS Abuse.”
- The user contacts ICANN. ICANN says: “We enforce contractual obligations of registrars and registries; we do not regulate website content.”
- The user contacts one national regulator. The regulator says: “The company is established outside this jurisdiction.”
- Another regulator says: “The affected individual is not located here.”
Transparency Cannot Mean Revealing Everything
Accountability does not require platforms or infrastructure providers to publish internal security methods, expose private information, compromise investigations or reveal confidential commercial information.
There will always be legitimate limits. But those limits do not justify decision-making that is impossible to understand.
An organization can protect confidential information while still explaining the decision.
- what issue it considered;
- what policy applied;
- what general category of evidence was reviewed;
- what conclusion it reached;
- and why.
A Better Standard
Digital accountability should be assessed through four separate lenses.
The last category deserves much more attention.
The global internet was designed to allow information to cross borders with extraordinary efficiency. Our accountability systems still operate largely within institutional and national boundaries.
That mismatch creates predictable gaps.
- Substantive accountability: What happened?
- Decision accountability: Can the conclusion be understood and justified?
- Process accountability: Was the matter handled through a fair and identifiable process?
- Jurisdictional accountability: When one organization's authority ended, was the boundary clearly explained and was responsibility meaningfully handed onward?
- Identify the issue and decision-makerBe clear about what was reviewed and who decided.
- State the evidence and applicable ruleSummarise the key evidence and rule applied.
- Explain the reasoning and outcomeSet out the reasons for the decision.
- Provide a route to correction or reviewMake it clear how the decision can be challenged.
The Goal Is Not to Make Every Intermediary Responsible for Everything
Every entity exercising material control should be able to explain what it controls, what it reviewed, what it decided, why it decided it, what it could not decide, and where responsibility proceeds from there.
That would be neither realistic nor fair.
A registrar should not become a general social-media regulator. A CDN should not become a criminal court. A hosting provider should not automatically determine the merits of every dispute between a platform and its users. A platform should not be expected to exercise powers that only law enforcement or a court possesses.
The goal should instead be much simpler. That is infrastructure accountability.
Why This Matters
Without this approach, internet accountability becomes a maze.
Each organization can point to the next. Each jurisdiction can point elsewhere. Each technical layer can correctly explain why another layer has greater control.
And the person affected can spend months moving through systems without anyone addressing the central issue.
The question should therefore no longer be merely Who owns the website? or Who hosts it? or Which country regulates it?
The better question is: Who controlled each relevant part of the problem, what responsibility followed from that control, and was there an accountable path from one responsible entity to the next?
The internet may be distributed. Accountability should not disappear simply because responsibility is distributed with it.