ExpressVPN blocks child abuse material in partnership with Internet Watch Foundation

ExpressVPN has announced a partnership with the Internet Watch Foundation (IWF) to restrict access to child sexual abuse material (CSAM).

Using the IWF's domain list, ExpressVPN has "developed server-level technology" to prevent access to CSAM content across its VPN network. This means identified content can't be viewed when connected to ExpressVPN.

The move forms part of ExpressVPN's "Not on My Network" initiative. The VPN, regarded as one of the best VPNs, aims to balance privacy and protections, and it is calling on other VPNs to implement similar safeguards.

Announcing OpenBoundary

ExpressVPN has named its new technology OpenBoundary, and it makes ExpressVPN "one of the first VPN providers to enforce network-level protections of this kind."

OpenBoundary has been described as "a modular, server-level toolkit" and it enables "network operators to restrict access to verified criminal domains safely and transparently."

ExpressVPN said OpenBoundary uses the IWF's domain list and operates the blocking "without deep-packet inspection or user activity logging." This means ExpressVPN's audited, and strict, no-logs policy isn't altered, and the code is open-source for anyone to check.

The underlying code will be published along with a technical white paper and "detailed deployment guide." ExpressVPN wants other VPNs, internet service providers, and cloud platforms "to adopt similar safeguards and raise the standard for privacy-preserving infrastructure."

Dr Peter Membrey, Chief Research Officer at ExpressVPN, believes safety protections and the need to protect encryption have often collided when debating privacy. He described the framing as "limiting" and OpenBoundary seeks to change that.

Membrey said "OpenBoundary isn't a breakthrough in cryptography. It's a simple, well-scoped DNS control used to block access to known child sexual abuse material sites."

"No broken encryption. No traffic inspection. No monitoring. It's deliberately straightforward, because privacy systems lose trust when they become opaque."

He continued by saying that "privacy and protection are not mutually exclusive," and they can "reinforce one another."

According to ExpressVPN, "the #NotOnMyNetwork campaign is just the beginning." The VPN wants to continue to innovate and strengthen privacy and protection, with the goal of creating "a safer digital environment for families and children."

Private Internet Access (PIA) and CyberGhost, both owned by ExpressVPN's parent company Kape Technologies, are also taking part in the campaign. A "united front" is being presented "to hold the technology industry accountable – publicly and transparently."

What is the IWF domain list?

The IWF says its URL list is "dynamic" and collates a list of webpages it has confirmed to feature images and videos of child sexual abuse. Exact locations can be determined and the IWF ensures it never over-blocks a legitimate website.

A team of IWF analysts updates the list twice a day and content is assessed under UK criminal law. The IWF states it will only block at a domain level "if an entire website is dedicated to confirmed child sexual abuse."

IWF data reported a total of 142,789 unique URLs were included on the list in 2024, with an average of 1,129 added each day.

Kerry Smith, Chief Executive Officer at the Internet Watch Foundation, said "the IWF is dedicated to tackling the pernicious and pervasive spread of child sexual abuse online."

It relies on "strong partnerships with the tech industry" and Smith applauded "ExpressVPN's innovative approach." Smith confirmed that ExpressVPN has become an IWF Member and will now have access to "world-leading datasets and technology," ensuring ExpressVPN can "better protect users across its entire VPN network."

What has prompted ExpressVPN's move?

2025 saw a wave of age verification laws hit the US, UK, and Europe. Almost all cited child protection as the reason for their introduction but the laws came with significant privacy and cybersecurity risks.

Personal information, such as IDs and credit cards, was required in order to verify your age on a number of sites and apps, with experts concerned about hacking and crackdowns on our right to privacy. A handful of laws targeted VPNs in the process. Lawmakers in the US attempted to ban VPNs and the UK is exploring the option of age restricting VPNs.

This makes ExpressVPN's move a welcome one. It is vital that children are protected from seeing harmful content online and criminal content, like CSAM, is blocked from being viewed.

However, VPN companies have almost always opposed URL and domain level blocking, as seen in the ongoing struggle to combat illegal sports streaming. So ExpressVPN actively promoting blocks is an interesting development.

There is absolutely no indication that ExpressVPN will block further URLs, and blocking CSAM is completely correct. But some could see this as a fundamental change to the traditional VPN approach to blocking, and may wonder if it could pave the way for other types of content being blocked – content that isn't illegal.