PART I: EXECUTIVE SUMMARY

This forensic analysis presents a comprehensive, quarter‑by‑quarter examination of the seven corporate entities identified as comprising the infrastructure supporting the domain xhcdn.com. The investigation spans from January 1995 through June 2026, drawing from public archives, regulatory filings, court records, and investigative journalism. Each entity is analyzed across four dimensions: corporate chronology, regulatory exposure, litigation history, and jurisdictional legal framework.

PART II: DATAWEB GLOBAL GROUP B.V. — NETHERLANDS

2.1 Corporate Chronology (1994–2026)

• Q1 1994: DataWeb B.V. is established in the Netherlands. The company positions itself as a Business Internet Service Provider, becoming one of the oldest such entities in the country.
• Q2 2002: DataWeb Global Group is formally founded as an IT infrastructure company specializing in data storage, security, and content delivery acceleration. The company begins offering dedicated servers, CDN services, colocation, and cloud server solutions.
• Q1 2005: DataWeb orders its inaugural Peering and Transit port from NL‑ix, laying the foundation for a long‑term partnership with the Dutch Internet exchange.
• Q4 2015 (November 11): The company’s Autonomous System Number (AS39572) is officially allocated, and the domain datawebglobalgroup.com is registered. The company formalizes its presence as DataWeb Global Group B.V..
• Q1 2016–Q4 2022: DataWeb expands its infrastructure across Europe, Asia, and the United States. The company becomes a market leader in dedicated servers, CDN, and cloud solutions, serving international high‑traffic projects including online cinemas, Ad/CPA networks, FinTech, SaaS, and file‑sharing networks.
• Q1 2024 (February 17): The EU Digital Services Act (DSA) enters into effect for all intermediary services. DataWeb is classified as an Infrastructure‑as‑a‑Service (IaaS) provider and becomes subject to DSA obligations.
• Q4 2024: DataWeb publishes its inaugural DSA Transparency Report, detailing its abuse management and content moderation practices. The report explicitly states that as an IaaS provider, DataWeb operates with “no direct access to customer content” and relies entirely on third‑party reports and abuse notifications.
• Q1 2025: DataWeb publishes an updated DSA Transparency Report for 2025, reaffirming its compliance with GDPR and DSA obligations. The company states it operates “under applicable local laws, including GDPR” and maintains experienced Compliance managers to provide expertise on abuse management.
• Q2 2025–Q2 2026: DataWeb continues to operate as a hosting provider for xhcdn.com, with its IP ranges (88.208.31.0/24 and 88.208.0.0/18) serving as the origin servers for the domain’s content.

2.2 Regulatory Exposure

DSA Compliance Gap

DataWeb’s structural inability to access customer content creates a fundamental compliance vulnerability. Under Article 6 of the DSA, hosting service providers are exempt from liability for unlawful content only if they “do not have actual knowledge of illegal activity or information” and, upon obtaining such knowledge, “act expeditiously to remove or to disable access to the information”. DataWeb’s reliance on third‑party notifications means it cannot proactively detect illegal content, yet it remains obligated to act upon receiving notices.

GDPR Compliance Obligations

Under the General Data Protection Regulation (Regulation (EU) 2016/679), DataWeb is classified as a data controller and/or data processor depending on the specific processing activities. The company must comply with:

• Article 5: Principles relating to processing of personal data (lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and accountability)
• Article 6: Lawfulness of processing (must identify a legal basis)
• Article 32: Security of processing (must implement appropriate technical and organizational measures)
• Articles 33–34: Notification of personal data breaches to supervisory authorities and data subjects

The maximum fine for a GDPR breach is €20 million or 4% of global annual turnover, whichever is higher. The EDPB Guidelines 3/2025 clarify that compliance with the DSA does not exempt organizations from fulfilling their GDPR obligations.

AML/KYC Obligations

Under the Dutch Anti‑Money Laundering Act (Wet ter voorkoming van witwassen en financieren van terrorisme – Wwft), DataWeb is required to:

• Conduct client identification and verification (KYC)
• Maintain transaction records
• Report unusual transactions to the Financial Intelligence Unit (FIU)
• Implement internal risk assessment and compliance procedures

Abuse Reporting History

DataWeb maintains an abuse contact email address (abuse@datawebglobalgroup.com) and has published a Claim Consideration Policy. IP addresses within DataWeb’s ASN (AS39572) have been reported for abuse, including spam and malicious activity. The company’s physical address is registered as Lagendijk 1, A 207, 1541KA, Koog aan de Zaan, Netherlands.

2.3 Legal Framework — Netherlands

2.4 Risk Assessment

PART III: CLOUDFLARE, INC. — UNITED STATES

3.1 Corporate Chronology (2004–2026)

• Q1 2004: Matthew Prince and Lee Holloway begin collaborating on Project Honey Pot, a computer industry project that would later serve as the foundation for Cloudflare.
• Q2 2009 (April): Cloudflare wins the prestigious Harvard Business School Business Plan Competition. The founding team—Matthew Prince, Lee Holloway, and Michelle Zatlyn—spends the summer perfecting the Cloudflare prototype.
• Q3 2009 (July): Cloudflare, Inc. is incorporated in Delaware. The company is founded on July 26, 2009.
• Q3 2010 (September 27): Cloudflare launches publicly at TechCrunch Disrupt, as originally planned.
• Q1 2016–Q4 2018: Cloudflare expands its global network to over 330 cities worldwide. The company’s 1.1.1.1 DNS service begins handling approximately 200 billion daily requests.
• Q2 2018 (April): Cloudflare terminates service to Switter, a decentralized social media platform, citing FOSTA (Fight Online Sex Trafficking Act) concerns. CEO Matthew Prince publicly states FOSTA is “a very bad law” that has left the Internet’s infrastructure hanging.
• Q3 2019 (September 13): Cloudflare goes public on the New York Stock Exchange under the ticker symbol “NET”. The company raises $525 million in its initial public offering, pricing shares at $15 each and opening at $18. The initial market capitalization is $4.4 billion.
• Q4 2019–Q4 2024: Cloudflare continues to grow, serving millions of clients including global banks, governments, large online retailers, and the Eurovision Song Contest.
• Q1 2025 (February 18): Italy’s communications authority AGCOM issues Order No. 49/25/CONS, directing Cloudflare to disable DNS resolution and routing for domain names and IP addresses reported by rights holders through the Piracy Shield system.
• Q1 2025–Q4 2025: Cloudflare refuses to comply with the Italian blocking order, arguing that the Piracy Shield law “breaks the internet” and that implementing filtering mechanisms would introduce unacceptable latency into its global DNS service.
• Q1 2026 (January 8): AGCOM formally notifies Cloudflare of a €14.2 million fine (approximately $16.4 million) for non‑compliance with the February 2025 order. The fine represents approximately 1% of Cloudflare’s global annual revenue.
• Q1 2026 (January–March): Cloudflare appeals the fine, pushing for full access to AGCOM’s Piracy Shield records and challenging the underlying legality of the blocking regime. The company argues that the fine should have been limited to €140,000 or 2% of revenues in Italy.
• Q2 2026 (June): Cloudflare faces a Delaware Chancery Court shareholder lawsuit seeking to block a proposed recapitalization plan.

3.2 Regulatory Exposure

Italy AGCOM Fine (2026)

The €14.2 million fine represents the most significant regulatory action against Cloudflare to date. The legal basis for the fine is Italy’s Piracy Shield law, which requires Internet service providers to block access to websites identified as hosting infringing content within 30 minutes of notification.

Cloudflare’s defense rests on three technical arguments:

1. Performance Impact: Implementing filtering mechanisms in a system handling 200 billion daily DNS requests would introduce latency affecting non‑infringing sites.
2. Overblocking Risk: In October 2024, Google Drive was mistakenly blocked by Piracy Shield for 3 hours, affecting all Italian users. Investigation revealed that 13.5% of users remained blocked at the IP level and 3% at the DNS level for over 12 hours.
3. Global vs. Local Conflict: Italian regulators demanded global blocking, conflicting with Cloudflare’s unified global architecture.

Cloudflare CEO Matthew Prince responded aggressively: “We will fight this unjust fine” and threatened to withdraw all servers from Italy and terminate cybersecurity services for the Milan‑Cortina Winter Olympics.

FOSTA‑SESTA Exposure

Cloudflare has been a vocal critic of FOSTA (Fight Online Sex Trafficking Act), which amends Section 230 of the Communications Decency Act to allow civil and criminal liability for platforms that “knowingly assist, support, or facilitate” sex trafficking.

Under 18 U.S.C. § 1591 and § 1595, Cloudflare could face liability if it provides services (DNS, CDN, DDoS protection) to sites that facilitate sex trafficking and has actual knowledge of such activity. The company’s termination of service to Switter in 2018 demonstrates awareness of FOSTA’s implications.

GDPR Compliance

Cloudflare processes personal data (IP addresses, request logs, DNS queries) of EU users. The company must comply with:

• GDPR Articles 5, 6: Lawful processing and data protection principles
• GDPR Articles 44–49: Data transfers to third countries (including the US)
• GDPR Articles 33–34: Breach notification

Cloudflare has been fined in the past by French authorities (CNIL) for inadequate user information. The company maintains a legal representative for EU DSA purposes.

California Consumer Privacy Act (CCPA)

As a company processing data of California residents, Cloudflare must comply with the CCPA (Cal. Civ. Code § 1798.100 et seq.), which provides consumers with the right to:

• Know what personal information is collected
• Delete personal information
• Opt out of the sale or sharing of personal information
• Non‑discrimination for exercising CCPA rights

EU Digital Services Act (DSA)

Under the DSA, Cloudflare is classified as an intermediary service provider and must comply with:

• Article 14: Transparency reporting obligations
• Article 15: Risk assessments
• Article 16: Notice‑and‑action mechanisms
• Article 17: Statement of reasons for content moderation decisions

Fines for DSA non‑compliance can reach 6% of global annual turnover.

3.3 Legal Framework — United States & European Union

3.4 Risk Assessment

PART IV: NTT AMERICA, INC. — UNITED STATES

4.1 Corporate Chronology (1987–2026)

• Q4 1987 (November): NTT America, Inc. is founded in New York, NY, as a subsidiary of Nippon Telegraph and Telephone Corporation (NTT). Tachikawa Keiji helps found the subsidiary and serves as its first CEO.
• Q1 1992–Q4 1995: Tachikawa Keiji serves as a senior vice president and general manager of one of NTT’s regional communications sectors.
• Q4 1996 (December): NTT America is federally registered.
• Q4 1998 (December 7): NTT America’s Autonomous System Number (AS2914) is officially allocated under ARIN.
• Q2 2000 (May): NTT Communications agrees to acquire Verio Inc. for $5.5 billion.
• Q3 2000 (July): The FBI launches an investigation into NTT’s acquisition of Verio on national security grounds under the Exon‑Florio Amendment to the Defense Production Act of 1950. The investigation is the first involving the foreign acquisition of a U.S. Internet service provider under Exon‑Florio. The probe can take up to 45 days.
• Q3 2000 (August 24): The Committee on Foreign Investment in the United States (CFIUS) clears the NTT‑Verio acquisition, finding no national security threat. President Clinton takes no action to suspend or prohibit the proposed acquisition.
• Q4 2000 (December): The NTT‑Verio acquisition is finalized after multiple delays caused by the Exon‑Florio investigation.
• Q1 2002 (February): NTT America is federally registered for the second time.
• Q3 2006 (July 11–13): The FCC issues a Memorandum Opinion and Order (FCC‑06‑101) denying NTT America’s Application for Review. The specific nature of the application is not publicly detailed in the FCC’s summary.
• Q2 2015 (April 1): NTT America merges with Verio Inc., with NTT America as the surviving company. NTT America takes over Verio’s entire Cloud and Web hosting business.
• Q3 2015 (August 4): NTT America divests Verio’s SME web hosting operations (Verio brand) to Endurance International Group.
• Q1 2026–Q2 2026: NTT America continues to operate as a Tier 1 transit provider, carrying traffic for DataWeb Global Group B.V. (AS39572) and other customers.

4.2 Regulatory Exposure

Exon‑Florio National Security Review (2000)

The Exon‑Florio Amendment (Section 721 of the Defense Production Act of 1950, 50 U.S.C. § 4565) authorizes the President to suspend or prohibit foreign acquisitions of U.S. companies that threaten national security. The NTT‑Verio investigation was significant for several reasons:

1. It was the first Exon‑Florio investigation involving the foreign acquisition of a U.S. Internet service provider.
2. The investigation lasted nearly four months, with NTT delaying the acquisition four times.
3. The investigation demonstrated that Internet infrastructure companies were now considered critical national security assets.

FCC Order (2006)

The FCC’s denial of NTT America’s Application for Review (FCC‑06‑101) indicates regulatory scrutiny of NTT America’s operations. The specific nature of the application is not publicly detailed, but the denial suggests that NTT America’s regulatory compliance was not fully satisfactory.

OFAC Sanctions Compliance

As a U.S.‑based telecommunications provider, NTT America is subject to OFAC sanctions regulations (31 C.F.R. Part 501). Civil penalties for sanctions violations can reach $1 million per violation, with criminal prosecution possible for willful violations.

DMCA “Mere Conduit” Protection

Under 17 U.S.C. § 512(a), NTT America qualifies as a “mere conduit” and is exempt from liability for content carried over its network, provided it:

• Does not initiate the transmission
• Does not select the content
• Does not modify the content
• Does not store or cache the content

4.3 Legal Framework — United States

4.4 Risk Assessment

PART V: COGENT COMMUNICATIONS, LLC — UNITED STATES

5.1 Corporate Chronology (1999–2026)

• Q3 1999 (August): Dave Schaeffer founds Cogent Communications. The company is established at the peak of the Internet industry’s growth and is funded by angel investors including members of the Keiretsu Forum.
• Q1 2000–Q4 2002: Cogent acquires 13 other failing carriers, purchasing $14 billion in capital for $60 million, including $4 billion worth of Property, Plant and Equipment.
• Q4 1998–Q4 1999: Cogent’s Autonomous System Number (AS174) is allocated. The company builds its own IP data network independent of traditional voice‑based infrastructure.
• Q1 2000–Q4 2024: Cogent operates as a Tier 1 Internet service provider, offering high‑speed Internet access to businesses. The company is headquartered in Washington, D.C., and trades on NASDAQ under the ticker symbol CCOI.
• Q1 2022 (March): Following Russia’s invasion of Ukraine, Cogent faces pressure to cut links to Russia. The company states: “The economic sanctions put in place as a result of the invasion and the increasingly uncertain security situation make it impossible for Cogent to…”
• Q3 2025 (August): JPMorgan and RBC Capital seize $82 million in Cogent shares that had been pledged by CEO Dave Schaeffer as collateral for loans.
• Q4 2025 (November 6): Cogent reports third quarter 2025 financial results, revealing a service revenue year‑over‑year decrease of nearly 6%.
• Q4 2025 (December 27–29): Robbins Geller Rudman & Dowd LLP launches an investigation into potential violations of U.S. federal securities laws involving Cogent Communications Holdings, Inc.. The investigation concerns “whether the Company’s board of directors breached its fiduciary duties to shareholders”.
• Q1 2026 (January 20): The Law Offices of Howard G. Smith announces an additional investigation of Cogent Communications Holdings, Inc. on behalf of investors.
• Q1 2026–Q2 2026: Multiple law firms, including Glancy Prongay & Murray LLP, continue to investigate Cogent for potential securities law violations and fiduciary breaches.

5.2 Regulatory Exposure

Securities Law Investigations (2025–2026)

The investigations into Cogent focus on potential violations of:

• Securities Act of 1933 (15 U.S.C. § 77a et seq.): Liability for false or misleading statements in securities offerings
• Securities Exchange Act of 1934 (15 U.S.C. § 78a et seq.): Anti‑fraud provisions, particularly Section 10(b) and Rule 10b‑5

OFAC Sanctions Compliance

Cogent, as a U.S.‑based carrier, is subject to OFAC sanctions regulations (31 C.F.R. Part 501). Following Russia’s invasion of Ukraine, the company stated that the sanctions “make it impossible for Cogent to” continue certain operations.

DMCA “Mere Conduit” Protection

Under 17 U.S.C. § 512(a), Cogent qualifies as a “mere conduit” and is exempt from content‑related liability, provided it does not initiate, select, or modify content.

Acquisition of Sprint Communications (Cogent Fiber)

Cogent acquired Sprint Communications (now Cogent Fiber, LLC), and the integration of this business has presented operational difficulties. The acquisition may also present regulatory compliance challenges related to FCC authorizations and antitrust considerations.

5.3 Legal Framework — United States

5.4 Risk Assessment

PART VI: ARELION (F/K/A TELIA CARRIER) — SWEDEN

6.1 Corporate Chronology (1993–2026)

• Q1 1993: Arelion’s Autonomous System Number (AS1299) is allocated. The company begins building its global IP backbone network.
• Q4 1998–Q4 1999: Telia International Carrier is established, combining the traditional voice business with an early IP network. The company builds networks in both Europe and the United States.
• Q1 2000–Q4 2006: Telia Carrier operates as the international wholesale arm of Telia, the Swedish state‑owned telecommunications incumbent.
• Q1 2007: The Telia corruption scandal in Uzbekistan begins. Telia enters the Uzbek market through transactions with Takilant, a company with connections to the Uzbek government.
• Q1 2012: The Telia corruption scandal becomes a public scandal when investigative journalists at Swedish public broadcasting corporation expose the affair.
• Q1 2014 (March): Telia receives an email from U.S. authorities (DOJ/SEC) indicating an investigation into potential FCPA violations. Dutch authorities conduct a “dawn raid” at Telia’s Rotterdam office. The investigation is formally named “Vimpelcom et al”.
• Q2 2014: Telia’s board initiates an expanded review that results in a “candid reckoning” with what had transpired in Uzbekistan.
• Q1 2016 (April 19): Telia Carrier is rebranded, with the parent company dropping the “Sonera” portion of its name.
• Q3 2017 (September 21): Telia reaches a global settlement of USD 965 million with U.S. and Dutch authorities. The settlement “brings an end to all known corruption related investigations or inquiries into Telia Company”.
• Q3 2017 (September 22): Three former Telia Company executives are charged with corruption by Swedish prosecutors.
• Q4 2020 (October 6): Telia Company agrees to sell its Telia Carrier unit to Polhem Infra, a Swedish investment company backed by some of the largest Swedish public pension funds, for roughly US$1 billion.
• Q2 2021 (June 1): The sale of Telia Carrier to Polhem Infra is completed. Telia Carrier begins moving from telia.net to a new domain name, twelve99.net, for technical uses.
• Q1 2022 (January 19): Telia Carrier is rebranded as Arelion.
• Q1 2022–Q2 2026: Arelion continues to operate as a Tier 1 Internet backbone provider, with its AS1299 network ranked number one in the world.

6.2 Regulatory Exposure

FCPA/SEC/DOJ Settlement (2017)

The USD 965 million settlement is the third‑largest FCPA enforcement action ever. Prosecutors called it “one of the largest criminal corporate bribery and corruption resolutions ever”.

Key findings:

• Telia violated the Foreign Corrupt Practices Act (FCPA) and Dutch legislation
• Corrupt payments of approximately USD 330 million were made
• Telia offered and paid bribes to a shell company under the guise of lobbying and consulting services that never actually occurred
• The bribes were paid to Uzbekistan’s President’s daughter

Settlement terms:

• Fines and disgorgements to the SEC, DOJ, and OM in an aggregate amount of USD 965 million
• Acceptance of “the company’s responsibility for the wrongdoings of its representatives historically”
• The settlement “brings an end to all known corruption related investigations or inquiries into Telia Company”

US Sanctions Compliance (2022–Present)

Arelion has faced scrutiny for operations in Russia and other high‑risk jurisdictions. The company reported “stopped deliveries from the US due to its operations in Russia”.

GDPR Compliance

As a Swedish‑based company processing EU user data, Arelion is subject to GDPR.

6.3 Legal Framework — Sweden, United States, Netherlands

6.4 Risk Assessment

PART VII: PCCW GLOBAL (HK) LTD. — HONG KONG

7.1 Corporate Chronology (1925–2026)

• Q1 1925: The Hong Kong Telephone Company is formed.
• Q3 2000 (August): PCCW Global is established when PCCW acquires Cable & Wireless HKT. Richard Li, son of Hong Kong billionaire Li Ka‑shing, founds the company.
• Q1 2002: PCCW Global takes its current form.
• Q1 2016–Q3 2017: A former manager at PCCW Solutions procures PCCW Solutions to issue 29 purchase orders totaling over HK$30 million to GGWL, a supplier owned by the manager’s mother.
• Q3 2022 (September 28): Hong Kong’s Independent Commission Against Corruption (ICAC) charges a former PCCW Solutions manager and his mother with fraud and money laundering totaling over HK$16 million.
• Q2 2024 (June 19–20): The former PCCW Solutions manager admits to the HK$16 million fraud at the High Court and is sentenced to 40 months’ imprisonment.
• Q4 2025 (October 15): The U.S. Federal Communications Commission issues an Order to Show Cause to HKT (International) Limited and its wholly‑owned subsidiaries, including PCCW Global, Inc., PCCW Global Limited, Gateway Global Communications Inc., and PCCW Global (UK) Limited.
• Q4 2025 (November 5): HKT and its subsidiaries request an additional 30 calendar days (to December 15, 2025) to respond to the FCC’s show‑cause order.
• Q4 2025 (December 1): The FCC grants an extension for the HKT entities to respond to the Order to Show Cause.
• Q1 2026–Q2 2026: The FCC proceeding remains active. If finalized, the order would prevent HKT from providing international and domestic telecommunications services to and within the United States.

7.2 Regulatory Exposure

FCC Show‑Cause Order (2025)

The FCC’s action against HKT and PCCW Global is based on national security concerns. The order is part of the broader U.S. “Clean Networks” initiative, which has systematically targeted Chinese‑linked telecommunications providers.

The FCC has previously banned China Mobile, China Telecom, and China Unicom. The action against HKT/PCCW Global represents an expansion of this ban to include Hong Kong‑based carriers perceived as affiliated with Chinese state‑controlled entities.

Hong Kong PDPO Compliance

Under the Hong Kong Personal Data (Privacy) Ordinance (PDPO) (Cap. 486), PCCW Global must comply with six Data Protection Principles (DPPs):

1. DPP 1: Data collection must be lawful, fair, and for a lawful purpose directly related to the data user’s function
2. DPP 2: Data accuracy and retention
3. DPP 3: Use of personal data must be limited to the purpose for which it was collected
4. DPP 4: Security of personal data
5. DPP 5: Information to be generally available on personal data policies and practices
6. DPP 6: Access to and correction of personal data

7.3 Legal Framework — United States & Hong Kong

7.4 Risk Assessment

PART VIII: WITHHELD FOR PRIVACY EHF. — ICELAND

8.1 Corporate Chronology (2021–2026)

• Q4 2021: Namecheap announces that it is shifting its privacy domain service to Withheld for Privacy ehf. Namecheap had previously used a proxy based in Panama.
• Q4 2021–Q4 2024: Withheld for Privacy becomes the privacy service provider for thousands of domain registrations.
• Q4 2022: Withheld for Privacy is identified as the privacy service provider for the domain slobodanjovanovic.org.
• Q3 2023: Withheld for Privacy is identified as the privacy service provider for the domain proxy.business.
• Q3 2024 (August 14): Withheld for Privacy is identified as the privacy service provider for the domain deleitese.co.
• Q4 2024 (October): The Seattle Times publishes an investigation identifying Withheld for Privacy and other proxy services as having “turned Iceland into a global hub for illicit activity far out of proportion to the country’s size”.
• Q4 2024 (October 9): Icelandic news outlet Vísir reports that Withheld for Privacy is said to be owned by a company named Namecheap, registered in Arizona, United States.
• Q4 2024 (October 10): The Gazette Nigeria reports that Iceland’s Data Protection Authority, along with the country’s prosecutor and telecommunications ministry, has pushed for legislation that would effectively ban services like Withheld for Privacy from operating in Iceland.
• Q1 2025 (March 11): Withheld for Privacy is identified as the privacy service provider for the domain privorot.info.
• Q4 2025–Q2 2026: The Icelandic legislative process to ban privacy proxy services continues. Withheld for Privacy remains registered at Kalkofnsvegur 2 in Reykjavik, the address of the Icelandic Phallological Museum (the “Penis Museum”), though the company has “no presence” in the building.

8.2 Regulatory Exposure

Iceland’s Privacy Paradox

Mordur Ingolfsson, a former member of Iceland’s parliament who helped enact the country’s first internet privacy laws, stated: “We had the aim to create what we called the Switzerland of bytes” — referring to Iceland’s robust privacy laws designed to protect ordinary users from authoritarian governments. He added: “What happened instead ‘is abuse of the work that we did'”.

Legislative Ban Proposal

Iceland’s Data Protection Authority, along with the country’s prosecutor and telecommunications ministry, has pushed for legislation that would effectively ban services like Withheld for Privacy from operating in Iceland.

GDPR Compliance

As an Icelandic company operating within the EEA, Withheld for Privacy is subject to the General Data Protection Regulation (Regulation (EU) 2016/679).

AML/KYC Obligations

Under the Icelandic Act on Measures Against Money Laundering, Withheld for Privacy must verify the identity of its customers and maintain records.

8.3 Legal Framework — Iceland (EEA)

8.4 Risk Assessment

PART IX: COMPREHENSIVE LEGAL EXPOSURE MATRIX (1995–2026)

PART X: FORENSIC CONCLUSIONS

10.1 Infrastructure Summary

10.2 Legal Exposure by Entity

Highest Risk

• Cloudflare, Inc.: Active €14.2 million fine from Italy (pending appeal); FOSTA‑SESTA exposure; GDPR and DSA compliance obligations; shareholder litigation.
• Withheld for Privacy ehf.: Existential threat from Icelandic legislative ban; documented role in enabling illicit activities; GDPR and AML compliance obligations.

Moderate Risk

• DataWeb Global Group B.V.: DSA compliance gap due to inability to access customer content; GDPR and AML obligations; documented abuse reports.
• PCCW Global (HK) Ltd.: Active FCC proceeding seeking revocation of U.S. telecommunications license; internal governance vulnerabilities exposed by ICAC fraud case.

Lower Risk (Content‑Related)

• NTT America, Inc.: Protected as “mere conduit” under DMCA § 512(a); OFAC sanctions compliance remains primary risk.
• Cogent Communications, LLC: Protected as “mere conduit” under DMCA § 512(a); primary risk is securities law exposure.
• Arelion (fka Telia Carrier): Protected as “mere conduit” under EU e‑Commerce Directive; historical corruption risk resolved by USD 965 million settlement.

10.3 Enforcement Trends

1. National Security Scrutiny: The FCC’s action against PCCW Global demonstrates increasing national security scrutiny of foreign‑owned telecommunications providers.
2. Content Moderation Obligations: The DSA and similar regulations are imposing increasing content moderation obligations on hosting and edge providers.
3. Data Protection Enforcement: GDPR enforcement is intensifying, with fines reaching 4% of global turnover.
4. Anti‑Corruption Enforcement: FCPA and similar anti‑corruption laws continue to be enforced aggressively, as demonstrated by the Telia USD 965 million settlement.
5. Privacy Proxy Regulation: Iceland’s proposed ban on privacy proxy services reflects growing concern about the use of such services to facilitate illicit activities.

10.4 Recommendations for Further Investigation

1. Subpoena to Withheld for Privacy ehf.: A legal subpoena to the Icelandic privacy service could reveal the true owner of xhcdn.com.
2. Examination of DataWeb’s Abuse Reports: Analysis of abuse reports received by DataWeb could identify the nature and volume of illegal content hosted on xhcdn.com.
3. Review of Cloudflare’s DSA Transparency Reports: Cloudflare’s DSA transparency reports could reveal the volume and nature of content moderation actions taken for xhcdn.com.
4. Analysis of FCC Proceeding: Continued monitoring of the FCC proceeding against PCCW Global could reveal additional information about the company’s operations and affiliations.
5. Icelandic Legislative Tracking: Monitoring of Icelandic legislation to ban privacy proxy services could reveal the timeline and scope of the proposed ban.