No single person or company controls the internet, but several organizations make the rules that shape how it works

The internet has no owner and no central authority. Instead, it runs on a loose network of agreements between governments, non-profit organizations, private companies, and technical standards bodies. Each one controls a different piece: who gets a domain name, what data travels where, how fast it moves, and what you can and cannot do online. Understanding who holds which power helps explain why your privacy depends partly on choices you make and partly on decisions made by people you have never heard of.

Think of the internet like a postal system. No one owns the roads, but the post office sets rules for how mail moves, the government sets rules about what can be mailed, and individual companies decide what happens to your letter once it arrives at their building. The internet works the same way — distributed, but governed.

Key Takeaways

  • The Internet Corporation for Assigned Names and Numbers (ICANN) controls domain names and the root servers that translate web addresses into computer locations.
  • Internet service providers (ISPs) own the physical cables and infrastructure that connect your home to the internet, and they can see what you do online unless you use a VPN.
  • The World Wide Web Consortium (W3C) sets technical standards that browsers and websites follow, but has no power to enforce them.
  • Individual countries set their own laws about what content is legal, what data companies must protect, and what they can demand from tech companies.
  • Large tech companies like Google, Meta, and Amazon control the platforms and services billions of people use daily, but do not control the internet itself.

ICANN: The organization that manages domain names and IP addresses

ICANN (the Internet Corporation for Assigned Names and Numbers) is a non-profit based in Los Angeles that handles the technical infrastructure of the internet's addressing system. When you type a web address like "housing-basics.org" into your browser, ICANN's system translates that name into a numerical IP address — something like 192.0.2.1 — that computers use to find each other. ICANN also manages the root servers, the master directories that make this translation possible.

ICANN does not decide what websites can say or what you can view. It does decide who gets to register a domain name, what happens when a domain expires, and how disputes over domain ownership are resolved. If someone registers a domain that looks like your business name, ICANN's dispute process is where you would go to challenge it. ICANN also manages the assignment of IP addresses to internet service providers, which means it indirectly controls how many devices can connect to the internet.

ICANN answers to a board of directors and a community of stakeholders that includes governments, companies, and technical experts. The U.S. government historically had oversight of ICANN, but that relationship has shifted over time. ICANN's decisions affect everyone online, but most people never interact with it directly.

Internet service providers: Who owns the pipes and sees your traffic

Your internet service provider (ISP) — whether that is Comcast, Verizon, AT&T, a local cable company, or a fiber provider — owns the physical infrastructure that connects your home to the internet. They own or lease the cables, the routers, the servers that route your data. Because your traffic flows through their equipment, they can see what websites you visit, what you read, and what you upload, unless you use encryption like a VPN.

ISPs in the United States are regulated by the Federal Communications Commission (FCC), but the rules change depending on which party controls the FCC. Currently, ISPs are classified as "information services" rather than "telecommunications services," which means they have fewer obligations to treat all traffic equally. This classification affects whether they can slow down certain websites, charge content providers extra for faster speeds, or block certain types of traffic. ISPs also decide what speeds you get, what data caps explore to your account, and whether they will throttle (slow down) your connection if you use too much data.

Your ISP can also be compelled by law enforcement to hand over records of what you visited, when you visited it, and for how long. They are not required to tell you this happened. Using a VPN encrypts your traffic so your ISP cannot see the content of what you are doing, though they can still see that you are using a VPN.

The World Wide Web Consortium and technical standards

The World Wide Web Consortium (W3C) is an international organization that sets the technical standards for how the web works. It decides how HTML should be written, how browsers should handle security, how websites should load images, and thousands of other technical details. W3C is led by Tim Berners-Lee, who invented the web, and includes representatives from major tech companies, universities, and governments.

W3C has no enforcement power. It cannot fine you, shut down your website, or punish a company for breaking its standards. Instead, it publishes recommendations, and browser makers and website developers choose to follow them because doing so makes the web work better for everyone. When W3C sets a standard for how browsers should handle cookies, browser makers like Chrome and Firefox implement it because users expect their browsers to work the same way across the web.

W3C also works on web accessibility standards — rules about how to make websites usable for people with disabilities — and security standards that protect you from certain types of attacks. These standards are recommendations, not laws, but they shape what the web looks like because the companies that build the web choose to follow them.

Governments: Laws that shape what happens online

Individual countries set their own laws about what is legal online, what data companies must protect, and what they can demand from tech companies. The European Union's General Data Protection Regulation (GDPR) requires companies to tell you what data they collect, let you see it, and delete it if you ask. The United States has no single privacy law; instead, different states have different rules, and different industries have different regulations. California's Consumer Privacy Act (CCPA) gives California residents rights similar to GDPR, but only in California. Other states have passed their own privacy laws with different rules.

Governments also decide what content is illegal in their country. What is legal to publish in the United States might be illegal in China, Russia, or the European Union. Tech companies often have to choose between following the laws of different countries, which sometimes means blocking content in one country but not another. For example, Google blocks certain content in China that it allows in the United States.

Governments can also demand that tech companies hand over user data, remove content, or block access to websites. The process and the legal standard for doing this varies by country. In the United States, law enforcement needs a warrant to demand data from a company; in other countries, the process is different or easier.

Large tech companies: Control over platforms, not the internet

Google, Meta (Facebook, Instagram, WhatsApp), Amazon, Apple, and Microsoft control the platforms and services that billions of people use every day. Google controls the search engine most people use to find things on the web. Meta controls the social networks where billions of people share information. Amazon controls the cloud servers that host a large portion of the internet's websites. Apple controls the App Store, which is the main way people read software on iPhones.

These companies do not control the internet itself, but they control the platforms that sit on top of it. They decide what content is allowed on their platforms, what data they collect from you, how they use that data, and what they charge for their services. They also decide what happens to your data if you stop using their service. Because these platforms are so large, their decisions affect how most people experience the internet.

These companies are regulated by governments, but the regulations vary by country and by what the company does. A social media platform is regulated differently than a search engine, which is regulated differently than a cloud hosting service. In the European Union, large tech companies face stricter rules about data collection and content moderation than they do in the United States.

How these layers interact to shape your privacy and security

Your privacy online depends on decisions made at every layer. Your ISP can see what websites you visit unless you use a VPN. The websites you visit can collect data about you, and that data is protected by the laws of the country where the company is based. The browser you use follows W3C standards that shape how it handles cookies and other tracking tools. The government where you live can demand that companies hand over your data, and the legal standard for that demand depends on which country you are in.

You have some control — you can use a VPN to hide your traffic from your ISP, you can use privacy-focused browsers and search engines, you can read privacy policies and choose not to use services that collect data you are uncomfortable sharing. But you also depend on choices made by ICANN, your ISP, the companies whose platforms you use, and your government. Understanding who controls what helps you understand which risks you can reduce and which ones you have to accept.

Frequently Asked Questions

Can the government shut down the internet?

A single government cannot shut down the entire internet because it is distributed across many countries and organizations. However, a government can shut down internet access within its own borders, block certain websites, or slow down connections. China, Russia, and Iran have all done this. The internet would continue to work everywhere else.

Who decides what websites are allowed to exist?

ICANN decides who can register a domain name, but they do not decide what content is allowed. Individual countries decide what content is legal within their borders. Website hosts (the companies that store your website's files) decide whether to host your content based on their own policies and the laws of their country. So multiple organizations have a say, but no single entity controls what websites can exist globally.

Can tech companies see everything I do online?

Tech companies can only see what happens on their own platforms and services. Google can see your searches and what you do on Google services, but not what you do on Facebook or your bank's website. Your ISP can see all the websites you visit unless you use a VPN. Websites you visit can see what you do on their site. No single company sees everything.

What happens if I disagree with a decision ICANN makes?

ICANN has a dispute resolution process for domain name conflicts, but it is not designed for general complaints about ICANN's policies. If you have a dispute over a domain name, you can file a complaint through ICANN's Uniform Domain-Name Dispute-Resolution Policy. For policy disagreements, you can participate in ICANN's public comment periods when they propose new rules.

Does my VPN hide everything from my ISP?

A VPN encrypts the content of your traffic so your ISP cannot see what websites you visit or what data you send. However, your ISP can still see that you are using a VPN, how much data you are using, and when you are online. Your VPN provider can see your traffic instead, so you are trusting them with the data your ISP would have seen. Choose a VPN provider with a clear privacy policy.