Not on My Network: ExpressVPN restricts IWF-identified child sexual abuse domains

• In partnership with the Internet Watch Foundation, ExpressVPN prevents access to known dedicated Child Sexual Abuse Material domains using the nonprofit’s CSAM Domain List. 
• ExpressVPN is inviting the wider technology industry to adopt its open-source safeguards, aiming to raise the global standard for privacy-preserving child protection.

ExpressVPN has developed server-level technology that prevents access to all known dedicated child sexual abuse domains identified by the Internet Watch Foundation (IWF) across its entire VPN network. Designed to strengthen online child protection without compromising user privacy, the system uses the IWF’s dedicated domain list to introduce network-wide safeguards while preserving ExpressVPN’s industry-leading no-logs policy, making ExpressVPN one of the first VPN providers to enforce network-level protections of this kind.

The technology, named OpenBoundary, is a modular, server-level toolkit designed to enable network operators to restrict access to verified criminal domains safely and transparently. Developed with privacy-first infrastructure principles at its core, OpenBoundary introduces network-wide safeguards without altering ExpressVPN’s strict no-logs policy.

OpenBoundary uses the IWF’s verified domain list and operates without deep-packet inspection or user activity logging. The code is verifiable, auditable, and open to scrutiny.

As part of its “Not on My Network” initiative, ExpressVPN is open-sourcing OpenBoundary and will be publishing the underlying code, along with a technical whitepaper and detailed deployment guidance. By doing so, the company is inviting other VPN providers, ISPs, and cloud platforms to adopt similar safeguards and raise the standard for privacy-preserving infrastructure.

CyberGhost VPN and Private Internet Access will join ExpressVPN on this mission, presenting a united front to hold the technology industry accountable—publicly and transparently.

Dr Peter Membrey, Chief Research Officer at ExpressVPN, states: “For too long, the privacy debate has been framed as an either-or choice: protect encryption at all costs, or weaken it in the name of safety. That framing is too limiting.

OpenBoundary isn't a breakthrough in cryptography. It's a simple, well-scoped DNS control used to block access to known child sexual abuse material sites. No broken encryption. No traffic inspection. No monitoring. It's deliberately straightforward, because privacy systems lose trust when they become opaque.

We're not claiming to solve online exploitation. That's far bigger than any single technical measure. What we are saying is that privacy infrastructure does not have to carry everything indiscriminately. With clear boundaries and careful engineering, it's possible to act without weakening the protections millions of people rely on. That's what I mean by a Not On My Network approach.

We're open-sourcing OpenBoundary because this shouldn't sit with a single provider. Privacy and protection are not mutually exclusive. If we implement them properly, they reinforce one another.”

Kerry Smith, Chief Executive Officer at the Internet Watch Foundation, said: “The IWF is dedicated to tackling the pernicious and pervasive spread of child sexual abuse online and we rely on strong partnerships with the tech industry to help us do so.

By coming onboard as an IWF Member, ExpressVPN now has access to our world-leading datasets and technology, allowing the organisation to better protect users across its entire VPN network.

We applaud ExpressVPN’s innovative approach that balances its commitment to online child safety and online privacy and look forward to seeing what further steps we can take together.”

The “Not on My Network” campaign

The #NotOnMyNetwork campaign is just the beginning. ExpressVPN will continue to innovate in ways that strengthen both privacy and protection, leading the industry toward a safer digital environment for families and children. 

ExpressVPN’s broader “Not on My Network” effort also includes developer and community engagement. Through its Digital Guardians Award at the Hack the East Hackathon and its collaboration with FOSSASIA to launch the FOSSASIA Hackathon 2026, the company is supporting open-source solutions that improve online safety while preserving privacy.