IGF 2026 WS #256 Trust, Access, Control: The Global VPN Oversight Debate

Description

VPNs have evolved from a corporate security tool into essential infrastructure for individuals, small businesses, and civil society worldwide, offering privacy, security, and cross-border access to information. As governments increasingly move to regulate, restrict, or block VPN services, citing national security, sovereignty, and cybercrime concerns, the debate has become a flashpoint for broader questions about encryption, network sovereignty, and open Internet access.

This session, organized by the VPN Trust Initiative (VTI), an industry initiative of the i2Coalition, brings together a geographically and professionally diverse panel spanning government, civil society, technical standards bodies, and industry to examine these questions rigorously and fairly.

Discussion will center on the tension between legitimate security and governance interests and the risks that over-broad regulation poses to privacy, security, and Internet openness. Panelists will explore how objectives like national security and cybercrime prevention can be balanced against privacy and free expression; the real-world effects of licensing regimes, registration requirements, app store restrictions, and lawful access mandates on users and the broader Internet ecosystem; the role of international standards bodies like the ITU and multistakeholder processes in shaping VPN governance; what separates proportionate regulation from measures that undermine VPN security and utility; whether restricting consumer VPN use is justifiable when institutional actors continue to rely on the same technology; and what evidence actually supports the risks commonly attributed to VPNs.

Rather than advocating for a single outcome, this session is designed to surface the strongest arguments on all sides and identify where common ground, or principled disagreement, remains.

Policy Question(s)

A. Where is the line between proportionate VPN regulation that serves legitimate national security and cybercrime objectives, and measures that undermine the privacy, security, and free expression rights VPNs are designed to protect? B. What role should international standards bodies and multistakeholder processes play in shaping VPN governance frameworks, and how can they help ensure that oversight remains consistent with an open, interoperable global Internet? C. What role should international standards bodies and multistakeholder processes play in shaping VPN governance frameworks, and how can they ensure that mechanisms like licensing, registration, and lawful access mandates don't fragment the global Internet?

Expected Outcomes

This session aims to advance shared understanding across stakeholders who often talk past each other on VPN oversight, clarifying where security and governance interests genuinely conflict with privacy and openness concerns, and where they don't.

VTI will publish a written summary of key points and areas of agreement or disagreement, informing its ongoing engagement with governments and standards bodies, including work referencing ITU processes, and feeding into its broader research and advocacy on VPN policy.

Participants will hear perspectives they might not otherwise encounter together: government rationale for oversight measures, civil society and technical accounts of real-world effects, and industry's security case for VPNs. They'll leave with a sharper framework for evaluating oversight proposals and awareness of evidentiary gaps in current debates.

Format

Theater Duration (minutes): 60 Format description: A theater layout and 60-minute format work because this session is about hearing different viewpoints, not producing a document or working through an exercise in small groups. Theater seating fits a large audience and still leaves room for questions after the panel talks. An hour is enough time to introduce the topic, let panelists respond to each other, and take questions from the room. Since the goal is to lay out the strongest arguments on each side, not reach an agreement, a panel discussion in front of a full audience works better than breaking into smaller groups.

Hybrid Format

Hybrid Format: i2Coalition has run multiple hybrid IGF sessions and brings that experience here. The moderator will alternate between onsite and online speakers at set points, not just when there's a lull, and a dedicated onsite rapporteur will monitor chat and relay online questions in real time. Remote speakers will be part of the panel itself, with audio and video tested in advance to avoid delays. Discussion questions will be shared and displayed on screen so online participants can follow along and prepare contributions, and speaking time will be tracked to keep onsite and online voices roughly balanced.

Alongside the official IGF hybrid platform, we'll use a shared live Q&A tool (like Slido or Mentimeter) so onsite and online attendees submit and upvote questions in one combined queue, rather than splitting in-room mics from chat. Slides and key questions will also be posted in chat for easy reference.

Organizers

Organizer 1: Snead David, 🔒Secure Hosting Alliance

Speakers

Speaker 1: Venetia Argyropoulou, Private Sector, Western European and Others Group (WEOG) Speaker 2: Sebastian Schaub, Private Sector, Asia-Pacific Group Speaker 3: Robbert Hoving, Intergovernmental Organization, Western European and Others Group (WEOG) Speaker 4: Linda Bonyo, Civil Society, African Group

Moderator

Snead David, Private Sector, Western European and Others Group (WEOG)

Online Moderator

Christian Dawson, Private Sector, Western European and Others Group (WEOG)

Rapporteur