Digital Platform and Infrastructure Accountability Review Procedure

DIGITAL PLATFORM AND INFRASTRUCTURE ACCOUNTABILITY REVIEW PROCEDURE

1. Purpose

This procedure establishes a structured method for examining accountability when complaints, safety concerns, privacy concerns, abuse reports, content disputes, or other digital harms pass through multiple layers of internet infrastructure and potentially multiple legal jurisdictions.

The procedure is designed to determine not merely what outcome an organization reached, but whether the organization acted in a manner that was:

• transparent;
• intelligible;
• procedurally fair;
• responsive to the actual issue raised;
• supported by identifiable reasons;
• proportionate to the authority it possesses;
• capable of meaningful review; and
• appropriately connected to the next responsible entity where its own authority ends.

The framework recognizes that digital services rarely operate through a single accountable entity. A platform may depend upon hosting providers, cloud infrastructure, content-delivery networks, domain registrars, registries, payment providers, identity systems and other intermediaries, while simultaneously operating across several national jurisdictions.

Accordingly, an accountability assessment should not improperly attribute responsibility to an intermediary for matters outside its function.

Instead, each entity should be evaluated against:

1. the role it actually performs;
2. the authority or control it possesses;
3. the obligations applicable to that role;
4. the information available to it;
5. the complaint or notice it actually received; and
6. the adequacy of its response within that scope.

2. Governing Principle

The central principle of this framework is:

An accountable decision should enable a reasonable person to understand what was under review, the relevant factual and procedural context, what information was considered, what standard or rule was applied, what findings were made, how those findings led to the outcome, and what further review or escalation was available.

Accountability does not require every organization to agree with a complainant.

It requires the organization to make its decision capable of being understood and scrutinized.

A mere statement of outcome is therefore distinguishable from a reasoned decision.

For example:

Outcome only:

"We reviewed your complaint and found no violation."

Reasoned decision:

"We reviewed the reported livestream from the identified time period and the associated account records. The complaint alleged disclosure of identifying information. We assessed the reported conduct under section X of our privacy policy. We confirmed X but did not find Y, which is required by the policy for enforcement action. For that reason no account restriction was imposed. You may request review through the following mechanism."

The framework does not require that every decision contain lengthy reasons. The level of detail should be proportionate to the seriousness and complexity of the matter.

3. Objectives

An accountability review should determine:

3.1 Substantive Accountability

What happened, insofar as the available evidence permits a factual determination?

3.2 Decision Accountability

Was the decision itself explained sufficiently to understand the reasoning?

3.3 Process Accountability

Was the complaint, notice or appeal handled through an identifiable and reasonable procedure?

3.4 Jurisdictional Accountability

Where an entity stated or implied that the matter fell outside its responsibility, did it clearly identify the limits of its authority and, where reasonably possible, the next responsible mechanism?

3.5 Infrastructure Accountability

Did relevant infrastructure providers perform the responsibilities applicable specifically to their role?

3.6 Escalation Accountability

Was there a meaningful avenue for reconsideration, appeal, external reporting or independent review?

4. Scope

This procedure may be used to assess conduct by:

• online platforms;
• livestreaming services;
• social-media services;
• hosting providers;
• cloud providers;
• content-delivery networks;
• reverse-proxy providers;
• DNS providers;
• domain registrars;
• domain registries;
• payment processors;
• advertising or monetisation services;
• identity-verification providers;
• safety vendors;
• app stores;
• regulatory bodies;
• dispute-resolution bodies; and
• other entities materially involved in the digital service chain.

The inclusion of an entity within a review does not imply wrongdoing.

Its role should first be established.

5. Core Accountability Parameters

Each decision should be examined against the following parameters.

5.1 Identification of the Matter Under Review

The decision-maker should make sufficiently clear:

• what complaint was considered;
• what incident was examined;
• what content or account was involved;
• what dates or time periods were considered;
• what allegations were within scope; and
• what allegations, if any, were outside scope.

An accountability concern may arise where the response appears to address a materially different issue from the one submitted.

5.2 Relevant Context

The assessment should identify whether the decision-maker considered material context, including where relevant:

• previous related incidents;
• repeated behaviour;
• prior complaints;
• chronology;
• the nature of the alleged harm;
• urgency;
• risk of continued harm;
• vulnerability of affected persons;
• legal notices;
• platform-policy provisions;
• prior representations by the organization; and
• other relevant circumstances.

Context should not be treated as automatically determinative.

However, material context should not be disregarded without explanation where it is capable of materially affecting the assessment.

5.3 Evidence Considered

Where reasonably possible, the decision should disclose the categories of information considered.

Examples include:

• livestream recordings;
• video clips;
• screenshots;
• chat logs;
• account records;
• moderation records;
• correspondence;
• previous complaints;
• metadata;
• payment records;
• technical logs;
• internal investigation material; or
• submissions from affected parties.

The organization need not necessarily disclose confidential investigative material or protected personal information.

However, confidentiality should not become a substitute for meaningful reasons.

6. Evidence Not Considered

A review should identify whether significant submitted evidence appears not to have been considered.

Where material evidence is rejected, unavailable or outside scope, good accountability practice ordinarily requires sufficient explanation to permit the reader to understand why.

An unexplained failure to address evidence does not automatically establish that the evidence was ignored.

It does, however, reduce the reviewability of the decision.

7. Identification of Applicable Standard

A reasoned decision should ordinarily identify the source of the standard being applied.

This may include:

• Terms of Service;
• Community Guidelines;
• Privacy Policy;
• Safety Policy;
• Abuse Policy;
• contractual requirements;
• statutory requirements;
• regulatory rules;
• court orders; or
• technical abuse standards.

Where an organization relies upon a policy provision, the review should determine whether the provision was sufficiently identified to permit meaningful understanding of the decision.

8. Findings

A properly structured decision should distinguish between:

• allegation;
• evidence;
• factual finding;
• interpretation of policy;
• enforcement discretion; and
• final outcome.

For example:

"An allegation was made that personal information was disclosed."

is different from:

"We determined that personal information was disclosed."

And both are different from:

"We determined that disclosure occurred but concluded that it did not satisfy the enforcement threshold under section X."

These distinctions are important for accountability.

9. Reasoning Path

The decision should establish an intelligible connection between:

Evidence → Findings → Applicable Standard → Conclusion → Action

A reviewer should ask:

Can a reasonable reader follow the path by which the evidence and applicable rule produced the final decision?

Where the reader must guess at the missing reasoning, the decision has reduced transparency and reviewability.

10. Treatment of Contrary Evidence

Material evidence or submissions inconsistent with the conclusion should not necessarily require an extensive rebuttal.

However, where contrary evidence goes directly to a central issue, meaningful reasons should ordinarily demonstrate that it was considered.

The decision-maker does not have to address every sentence, submission or piece of evidence.

The relevant question is whether the reasons meaningfully engage with the central issues.

11. Proportionality

The sophistication required of a decision should reflect:

• seriousness of the alleged harm;
• impact of the decision;
• permanence of consequences;
• complexity;
• urgency;
• availability of evidence; and
• degree of discretion exercised.

For example, permanently terminating an account generally warrants greater procedural clarity than declining to remove a minor isolated comment.

12. Timeliness

An accountability review should consider:

• time taken to acknowledge the complaint;
• time taken to preserve evidence;
• time taken to investigate;
• time taken to communicate the decision;
• time taken to process an appeal; and
• whether delay created a foreseeable risk of further harm.

Timeliness should be evaluated contextually rather than by applying an arbitrary universal deadline.

13. Independence of Review

Where an appeal or reconsideration process exists, the framework should examine whether the review was meaningful.

Relevant questions include:

• Was the appeal actually reconsidered?
• Did the reviewer have access to the underlying record?
• Did the appeal address arguments challenging the original reasoning?
• Was the appeal simply a restatement of the original conclusion?
• Was automated decision-making involved?
• Was human review available where appropriate?

A second message repeating the first conclusion does not necessarily constitute meaningful reconsideration.

14. EU Digital Services Act Benchmark

The European Union Digital Services Act provides an important statutory benchmark for certain online intermediary procedures.

Under Article 16, qualifying hosting-service notice mechanisms must permit notices concerning alleged illegal content. Where electronic contact information is provided, the hosting provider must confirm receipt without undue delay. It must also notify the reporting party of its decision concerning the reported information and available redress. Notices are to be processed in a timely, diligent, non-arbitrary and objective manner.

Article 17 requires providers of hosting services, in specified circumstances, to provide affected recipients with a clear and specific statement of reasons for restrictions based on illegality or incompatibility with terms and conditions.

These provisions do not create one universal worldwide decision-making standard.

They nevertheless demonstrate an important modern regulatory principle:

Digital accountability requires more than an unexplained outcome.

15. Jurisdictional Accountability

Digital complaints commonly cross several jurisdictions.

Examples include:

• the user being in one country;
• the complainant being in another;
• the company being incorporated elsewhere;
• servers being located elsewhere;
• a domain registrar operating from another country;
• payment processing occurring elsewhere; and
• contractual governing law selecting yet another jurisdiction.

The existence of multiple jurisdictions should not itself be treated as misconduct.

However, jurisdictional complexity should not become an accountability vacuum.

16. Jurisdictional Handoff Test

Where an entity states or implies that a matter is outside its scope, the following questions should be considered:

A. Scope Identification

Did the organization identify what part of the complaint it could consider?

B. Boundary Identification

Did it identify what part fell outside its authority?

C. Explanation

Did it explain why that limitation applied?

D. Internal Responsibility

Did it nevertheless perform any responsibilities that remained within its authority?

E. Handoff

Where reasonably known, did it identify another mechanism, authority or entity capable of addressing the remaining issue?

F. Preservation

Did it preserve relevant information that another competent authority could require?

G. Non-Abandonment

Did it avoid treating "outside our jurisdiction" as justification for ignoring responsibilities that remained within its own scope?

A positive jurisdictional handoff does not require an entity to provide legal advice or guarantee that another authority will act.

It requires clarity about the boundary.

17. Infrastructure Accountability Model

A digital incident should be mapped across the technical and institutional chain.

A typical structure may include:

Content creator / user

->

Platform operator

->

Origin hosting provider

->

Cloud infrastructure

->

CDN / reverse proxy / DNS services

->

Domain registrar

->

Registry operator

->

ICANN contractual framework where applicable

->

Payment / monetisation providers

->

National or supranational regulators

->

Courts / law enforcement where applicable

Each layer must be assessed against its own role.

18. Platform Accountability

The platform normally has the greatest ability to review:

• content;
• accounts;
• livestreams;
• user conduct;
• platform logs;
• moderation history;
• enforcement records; and
• internal policy compliance.

Relevant questions include:

• Did the platform preserve relevant evidence?
• Did it identify the allegation?
• Did it review the correct event?
• Did it apply the correct policy?
• Did it provide meaningful reasons?
• Did it explain enforcement or non-enforcement?
• Did it provide appeal rights?
• Did it respond to escalation?

19. Hosting Provider Accountability

A hosting provider may have much narrower responsibilities.

The review should first determine what service it actually provides.

A hosting provider should not automatically be expected to adjudicate every factual dispute arising on its customer's platform.

Instead, review:

• whether an abuse channel existed;
• whether the report was received;
• whether it was correctly classified;
• whether the provider acted under applicable law or contractual policy;
• whether urgent risks were escalated where appropriate;
• whether the provider explained its disposition; and
• whether it identified the proper responsible customer or process where appropriate.

20. CDN, Reverse Proxy and Infrastructure Providers

An intermediary appearing in DNS or network information may not actually host the content.

Accordingly, the review must not infer control solely from technical visibility.

Questions include:

• Does the company store the disputed content?
• Does it merely proxy traffic?
• Can it identify the origin host?
• Does it maintain an abuse procedure?
• Does it have contractual mechanisms applicable to the alleged conduct?
• What action, if any, is technically and contractually available?

21. Domain Registrar Accountability

Registrars perform a distinct role.

ICANN's Registrar Accreditation Agreement requires accredited registrars to maintain an abuse contact, confirm receipt of abuse reports and take reasonable and prompt steps to investigate and respond appropriately to reports of abuse involving sponsored registered names.

This requirement does not mean that the registrar must suspend a domain whenever a complaint is received.

The accountability inquiry is instead:

• Was the complaint received?
• Was receipt confirmed?
• Was it reasonably investigated?
• Was an appropriate response made?
• Was the complaint classified correctly?
• Was the reporter able to understand the disposition?

22. DNS Abuse Versus Website-Content Abuse

This distinction must be expressly maintained.

ICANN's current defined DNS Abuse categories include:

• malware;
• botnets;
• phishing;
• pharming; and
• spam where used as a delivery mechanism for those forms of DNS abuse.

The 2024 contractual amendments strengthened mitigation obligations concerning actionable evidence of DNS Abuse.

However, ICANN expressly states that those amendments were not intended to encompass ordinary website-content abuse.

Therefore:

A registrar declining domain suspension because a report concerns website content rather than DNS Abuse does not automatically establish accountability failure.

The correct review asks:

Did the registrar properly perform the obligations that remained applicable to it?

23. ICANN Accountability

ICANN should likewise be assessed within its actual institutional function.

ICANN Contractual Compliance enforces obligations contained in applicable registry and registrar agreements.

Its DNS Abuse Mitigation Program explains that Contractual Compliance can act in relation to failures by registries or registrars to meet applicable contractual requirements.

Accordingly, a complaint to ICANN should generally be framed differently from the original complaint to the website.

The question may become:

"Did the registrar comply with its contractual obligation to receive, investigate and appropriately respond to the abuse report?"

rather than:

"Did the website violate my rights?"

This distinction is fundamental.

24. Registry Accountability

Registry operators should also be assessed according to applicable registry obligations rather than platform-level responsibilities.

The 2024 amendments recognize the different roles of registries and registrars and impose obligations concerning well-evidenced DNS Abuse while permitting proportionate mitigation according to the circumstances.

25. Payment and Monetisation Accountability

Payment processors, banks and monetisation intermediaries should not automatically be treated as adjudicators of content disputes.

Where relevant, the assessment should determine:

• what acceptable-use rules apply;
• whether prohibited activity falls within those rules;
• whether a reporting process exists;
• whether credible reports are escalated;
• whether legal orders are acted upon; and
• whether financial services continue despite established violations within the provider's actual remit.

26. Regulatory Accountability

Where a regulatory authority receives a complaint, review:

• whether jurisdiction was assessed;
• whether the complainant was told the outcome;
• whether reasons were given where legally required;
• whether evidence was preserved or referred;
• whether statutory powers were considered; and
• whether another competent authority was identified where appropriate.

27. The Accountability-Lacuna Analysis

A central purpose of this framework is to identify situations where every individual entity may identify a reason for limited action but the combined structure leaves a serious issue without meaningful resolution.

This is called an Accountability Lacuna.

An accountability lacuna may exist where:

1. a material concern is raised;
2. no entity accepts responsibility for determining it;
3. each entity relies upon a jurisdictional, contractual or technical boundary;
4. no effective handoff occurs;
5. evidence or responsibility becomes fragmented;
6. no meaningful review mechanism remains; and
7. the matter effectively disappears between institutional boundaries.

The existence of a lacuna does not itself prove that any individual entity violated the law.

It identifies a systemic accountability weakness.

28. Evidence Preservation Procedure

For significant cases, the reviewer should preserve:

• original complaint;
• platform response;
• appeal;
• appeal response;
• screenshots;
• video or audio where lawfully obtained;
• URLs;
• timestamps;
• applicable policies;
• historical versions of relevant policies where available;
• domain registration information;
• host or infrastructure information;
• correspondence with intermediaries;
• regulator correspondence;
• reference numbers;
• automated responses;
• delivery confirmations; and
• publication dates.

Documents should be assigned exhibit numbers.

Example:

Exhibit 1 - Initial Complaint Exhibit 2 - Platform Response Exhibit 3 - Appeal Exhibit 4 - Appeal Decision Exhibit 5 - Applicable Policy Extract Exhibit 6 - Registrar Abuse Correspondence

29. Chronology

Every formal accountability review should contain a chronology.

Recommended columns:

Chronology is particularly important where the issue involves alleged retaliation, repeated conduct, policy changes, escalating complaints or delay.

Temporal proximity may justify further examination.

It should not, by itself, be presented as proof of causation.

30. Opportunity to Respond

Before publishing an adverse accountability finding, the organization under review should ordinarily be given a reasonable opportunity to:

• correct factual inaccuracies;
• explain its procedure;
• identify missing evidence;
• clarify jurisdiction;
• provide applicable policies;
• explain its reasoning; and
• identify confidential information that should not be publicly disclosed.

A response should not automatically control the final report.

It should become part of the evidentiary record.

31. Rebuttal Procedure

Where a report is published, a materially affected entity may be permitted to submit a rebuttal or correction.

The framework should distinguish:

Correction

Demonstrable factual error.

Clarification

Additional context that does not establish an error.

Rebuttal

Disagreement with interpretation or conclusion.

New Evidence

Information not previously available.

Material corrections should be incorporated transparently.

The original publication date and later update date should be preserved.

32. Accountability Findings

Findings should be descriptive rather than inflammatory.

Recommended classifications include:

Demonstrated Accountability

The process materially satisfies the applicable accountability parameters.

Partial Accountability

Some meaningful process exists but important elements are missing.

Accountability Concern

Material deficiencies prevent the reasoning or procedure from being adequately understood.

Insufficient Evidence to Assess

The available record does not permit a responsible conclusion.

Outside Entity's Functional Scope

The issue does not materially fall within that entity's role, although any remaining procedural obligations should still be examined.

Systemic Accountability Lacuna

Responsibility appears fragmented across entities such that no effective mechanism accepts or resolves the substantive issue.

These classifications should describe the process rather than imply criminal, civil or regulatory liability.

33. Public Caution Statements

A public-interest organization may issue a caution where supported by documented procedural concerns.

The caution should identify its basis.

Example:

Public Accountability Caution: Users who consider confidentiality, identity protection or rapid safety intervention particularly important should review the platform's complaint, privacy and escalation mechanisms before relying upon them. This caution is based on documented deficiencies in the complaint-handling record described below and is not a finding that every complaint will be handled in the same manner.

34. Separation of Fact, Analysis and Opinion

Every report should distinguish:

Documented Fact

Supported directly by evidence.

Party Assertion

Claim made by a complainant or organization but not independently established.

Analytical Observation

Inference drawn from the documented record.

Legal Position

Interpretation supported by applicable legislation, regulation or authority.

Unresolved Question

Matter that available evidence cannot determine.

This separation increases credibility and reduces the risk that speculation is presented as fact.

35. Reasonable-Person Reviewability Test

The final accountability question should be:

Could a reasonable person examining the record understand what issue the organization considered, the evidence and standards materially relied upon, the significant findings made, why the organization reached its conclusion, and what mechanism existed for further challenge?

If yes, the decision may be reviewable even where the reader disagrees with it.

If no, there is a decision-accountability deficiency.

36. Core Principle of the Framework

Accountability does not mean that every organization must have jurisdiction over every harm.

Accountability means that every organization exercising material control should be capable of explaining:

what it controls;

what it reviewed;

what it decided;

why it decided it;

what it could not decide;

and, where reasonably possible,

where responsibility proceeds next.

The internet's technical complexity should not become a mechanism through which responsibility simply disappears.