Who’s behind the wheel? Assessing internet regulatory agencies’ autonomy from corporate interests

1. Introduction

Each time a web address is accessed, a complex global system determines whether that site exists, who can access it, and how safely data travels there. Rules such as those that determine which websites can be created and who may use them, as well as how securely data is transmitted online. These rules have far-reaching implications for market access, communication security, and the flow of information across borders. Yet much of this regulation is shaped not by governments directly, but by hybrid public-private internet regulatory agencies such as the Internet Corporation for Assigned Names and Numbers (ICANN), the World Wide Web Consortium (W3C), and the Internet Engineering Task Force (IETF). These regulatory agencies are expert bodies where state and non-state actors interact to prescribe the quality of a given practice, procedure, or product (Cogburn, 2008; Bygrave and Bing, 2009; Christou et al., 2020). Operating with limited authority and information, they rely on a diverse range of actors, from governments to firms and civil society organisations, which begs a critical question regarding their autonomy.¹

Two dimensions of autonomy are often distinguished in the literature on regulatory politics: formal-institutional autonomy, which is derived from formal rules and working procedures (e.g., Gilardi, 2005; Thatcher, 2005; Wonka and Rittberger, 2010; Wassum and De Francesco, 2020), and informal autonomy, which refers to agencies’ effective autonomy in day-to-day decision-making processes (Maggetti, 2007, p. 272).

While existing research has examined the formal governance structures of internet regulatory agencies (e.g., Bygrave and Bing, 2009; DeNardis, 2014; Christou et al., 2020), it has paid less attention to how these agencies operate in practice. Furthermore, much of the literature tends to draw broad conclusions, such as the tendency for large corporations to be favoured in decision-making (e.g., Carr, 2015; ten Oever and Milan, 2022), which can overlook important variation across agencies. As a result, we still lack a systematic understanding of how, and under what conditions, informal autonomy from corporate interests is favoured or constrained in these venues.

This paper aims to fill this gap, investigating the informal autonomy of 12 internet regulatory agencies from companies and business associations. My central argument is that such autonomy depends on both formal institutional rules, as well as on three additional key interacting factors: policy complexity, media attention, and agency age.

To examine this, I use a mixed-methods research design that combines fuzzy-set Qualitative Comparative Analysis (fsQCA). Rather than estimating the independent effect of each factor, fsQCA acknowledges that multiple pathways may lead to informal autonomy, and that the effect of any one factor often depends on its combination with others (Ragin, 2000, 2008; Schneider and Wagemann, 2010). The use of fuzzy sets further allows me to conceptualise informal autonomy as a matter of degree rather than a binary outcome. The fsQCA is based on data drawn from agency websites, working documents, and the Searle Center Database on Technology Standards and Standard Setting Organisations. This is complemented by eleven in-depth interviews with officials from internet regulatory agencies.

The results indicate that autonomy from corporate interests is not driven by any single factor but by specific configurations of conditions. These configurations highlight, first, that formal autonomy does not automatically translate into informal autonomy. Second, they suggest a logic of substitutability between what can be seen as internal institutionalisation (through formal rules and organisational age) and external visibility (through media attention). These findings provide valuable insights into these agencies which, to an important extent, work beyond the purview of democratic accountability (Christou et al., 2020). Yet, the rules issued by these internet regulatory agencies are far from being only technical decisions. They have, in fact, an intrinsic public policy dimension, shaping individual rights and business strategies globally (Bradshaw and DeNardis, 2019).

2. Theoretical framework

2.1. Regulatory governance and autonomy

Internet regulatory agencies form part of the broader internet governance framework, comprising the institutions, processes, and actors that shape how the internet is controlled, managed and used (Bygrave and Michaelsen, 2009). This framework includes both legislative venues, where formal governmental decisions are made, and non-legislative ones, such as the agencies examined here. While these agencies lack the formal legislative authority of governmental bodies, the logic of interoperability that underpins the internet (i.e., enabling different computer networks and systems to work together) means that compliance with and adoption of their rules is essential for actors to participate in the network (DeNardis, 2011; Berg, 2024). As a result, the rules they develop are effectively mandatory in practice. During a period in which the internet was only lightly regulated from the early 1990s to the early 2010s, these agencies therefore played a particularly important role in sustaining the operation and coordination of the internet in the absence of extensive formal regulation.

Historically, these internet regulatory agencies were established by a technical community of experts and engineers aiming to shield internet governance from political pressures that could compromise efficiency (Hofmann, 2007). While recent work by Christou et al. (2020) challenges the idea that these agencies operate on the basis of technical expertise only, they do not systematically examine the conditions under which they exercise informal autonomy from corporate interests. Given the historical reliance on non-legislative governance bodies, understanding the conditions under which such agencies are able to operate autonomously therefore remains an important and underexplored question.

Informal autonomy can be defined as an agency’s capacity to make decisions and take actions without direct control from corporate interests (Maggetti, 2007; Ossege, 2015; Verhoest, 2004). This form of autonomy is about the agency’s ability to act without external interference in its day-to-day operations. It differs from regulatory capture, which relates to outcomes and occurs when regulated industries influence regulatory outputs to favour their interests at the expense of the public (Makkai and Braithwaite, 1992; Croley, 2011; Stigler, 1971). Within the internet regulatory agencies, the relationship among different corporate interests is generally marked by cooperation rather than competition (Genschel, 1997). Even when there is competition (e.g., between a platform company like Facebook and a technology company like Microsoft), the regulatory agencies provide various opportunities to resolve conflicts (Baron and Pohlmann, 2013). Yet, facing undivided corporate interests may increase the agencies’ risks of being captured (Pagliari and Young, 2016), making the question of how autonomous these agencies are all the more pressing.

2.2. Explaining informal autonomy

Maintaining autonomy in practice is rarely the result of any single factor. Agencies’ ability to act autonomously in day-to-day decision-making depends on how agencies’ internal arrangements interact with external factors. Building on research in regulatory politics, I focus on four factors expected to affect informal autonomy from corporate interests: formal autonomy; which sets the boundaries of participation; policy complexity, which determines how reliant agencies are on external expertise; media attention, which creates reputational pressures; and organisational age, which may reinforce or limit existing practices over time. Importantly, these factors are not treated as constitutive elements of informal autonomy itself, but as conditions that may combine in different ways to increase or limit it. The sections below develop expectations for how each factor affects informal autonomy, not in isolation but in combination.

The first factor is the degree of agencies’ formal autonomy. There is a natural presumption that higher degrees of formal autonomy imply higher degrees of informal autonomy. Formal autonomy defines which actors are permitted and required to participate in decision-making processes (Pérez-Durán, 2018), and when participation is open to a broad range of stakeholders, the agency is less dependent on any single voice, including that of corporate interests. But previous research has shown that the relation between formal and informal autonomy is not that straightforward (Maggetti, 2007, 2012a; Hanretty, 2009; Hanretty and Koop, 2013). Hence, other factors need to be brought into the picture.

Specific features of the policy issue addressed by the agency, such as its complexity, might in particular affect the agency’s autonomy (Yackee and Yackee, 2006; Pagliari and Young, 2016; Beyers and Arras, 2020). Complexity refers to the degree to which an issue is relatively difficult to understand (Karsh et al., 2016). A policy issue or area can be characterised as complex because of its technicality. For example, understanding encryption (a security practice of encoding data so that it is no longer in its original form and cannot be read) requires technical knowledge. Empirical evidence indicates that in complex policy areas regulators rely considerably on private actors to understand the market and thereby design effective public policies that meet industry innovations and trends (Majone, 2001; Mattli and Woods, 2009). The provision of expertise is costly and corporate interests tend to have greater resources (in terms of staff and budget) than, for instance, civil society organisations (Coen, 1997; Baumgartner et al., 2009). But, as resource exchange theory suggests, corporate interests are also particularly predisposed to having the technical and market-based expertise needed to address complex regulatory issues (Chalmers, 2014; Coen and Salter, 2020; Coen et al., 2021).

Culpepper’s (2010) work on “quiet politics” helps explain how the impact of complexity is conditioned by media attention, which is thus the third factor taken into account in this study. When policy issues are highly complex and receive little media coverage, they tend to remain low-profile, making it easier for well-resourced corporate interests to dominate decision-making processes. By contrast, when issues become visible and politically salient, decision-makers face greater pressure to demonstrate accountability to a wider range of stakeholders, including civil society organisations and other non-corporate voices. This has been observed in the case of internet privacy. As Antoine (2023) shows, rising media salience goes hand-in-hand with a diversification of actors involved in public debates. Media attention can therefore constrain agency behaviour by creating pressure to maintain a level of informal autonomy aligned with societal expectations. An agency operating in the public spotlight may thus need to demonstrate that it is acting according to its formal obligations and the predefined notion of public interest, like consumer protection (Hopenhayn and Lohmann, 1996; Maggetti, 2012b; Koop, 2014).

The fourth and last factor is the institutional age of the agency (Makkai and Braithwaite, 1992; Martimort, 1999). On one hand, the literature suggests that the gains derived from cooperating with private interests may be preferred to the gains derived from non-cooperating (Martimort, 1999; Maggetti, 2007), reinforcing the cozy relationships between decision-makers and private interests. This determinant can also be associated with the concept of path dependence (Haftel and Thompson, 2006), which has initially been developed by historical institutionalism (Thelen, 1999; Pierson, 2000). Institutions are conceived by this strand of research as routines and norms embedded in political and economic structures. Particularly central to the historical institutionalist perspective is the argument that institutions have self-reinforcing mechanisms or "increasing returns" (Pierson, 2000, p. 251) that sustain positive feedback and promote continuity over time. The implication is that 'old' regulatory agencies are expected to be less autonomous than 'young' ones. On the other hand, it can also be argued that agencies build up their own expertise over time, particularly as they strive to protect their distinct reputation (Carpenter, 2001, 2010; Maor and Sulitzeanu-Kenan, 2013). According to such an argument, 'old' regulatory agencies are expected to be more autonomous than 'young' ones. This alternative explanation will also be examined in this study. Table 1 gives a summary of the theoretical framework presented here as well as a set of theoretical expectations that I will test in the analysis section, below.

3. Research design

In this section, I provide details on the agencies selected for this study and the variables considered in the analysis.

3.1. Data selection and collection

Table 2 presents the twelve regulatory agencies examined in this paper, selected on the basis of three criteria to allow for comparison.

First, each agency plays a critical regulatory role in internet governance by producing rules and guidelines that shape both the functioning of the internet (for example, rules governing how different devices communicate) and the ways in which it can be used (for example, by setting conditions for data exchange) (Hofmann, 2007; DeNardis, 2009; Bygrave and Bing, 2009; Radu, 2019; Christou et al., 2020; Haggart et al., 2021).

Second, while some of these agencies can be categorised as standards-setting organisations, and others as professional associations, they all promote a multi-stakeholder governance approach, where any interest wishing to participate in decision-making processes can formally do so.²Participation is not restricted by, for instance, national-level approval. Instead, decision-making generally occurs through open working groups, with final approval by a board or review committee. In practice, however, the openness of these processes can be contested, making it particularly relevant to examine the extent of informal autonomy.

Third, these agencies are institutionally autonomous from governments: they are not embedded within intergovernmental structures and operate outside the formal control of states. Governments may participate as stakeholders, but they do not exert privileged authority. This includes agencies like ICANN which stopped being a contractor of the US government in 2016 (ICANN, 2016).

This study does not aim to examine all organisations involved in internet governance. It focuses on a subset of agencies that can reasonably be defined as regulatory and that share structural similarities in how they operate. Other regulatory agencies such as the International Organisation for Standardisation (ISO) or the International Electrotechnical Commission (IEC), are therefore not included as they have different governance characteristics (e.g., interest participation in decision-making processes is organised at the national level). Similarly, the IGF is considered due to its informal decision-making nature, acting primarily as a forum for discussion, despite its relevance to internet governance (Grover, 2023; Tjahja et al., 2023).

I examine agencies’ informal autonomy using a mixed-methods research design that combines fsQCA with semi-structured interviews. Autonomy is a multidimensional concept, shaped by the interaction of institutional and contextual factors rather than by any single influence (Gilardi and Maggetti, 2011). fsQCA is particularly appropriate because it detects conjunctural causation, where the effect of one factor depends on the presence or absence of others, and equifinality, where different combinations of factors can produce the same level of autonomy. It can furthermore be used on different sample sizes, including small samples (Longest and Hill, 2008; Pappas and Woodside, 2021).

Data for the fsQCA is retrieved from each internet agency’s website. As some agencies’ websites do not provide much information on the agencies’ formal rules and procedures, data is complemented with another source of information, i.e., the Searle Center Database on Technology Standards and Standard Setting Organisations which gathers information on membership and decision-making procedures of standards organisations.

To supplement the findings with qualitative insights that might not be captured otherwise, I conduct in-depth semi-structured interviews with official members with senior and strategic positions within six of the selected internet agencies. As the effect of the agencies’ life cycle is examined in this study, I contacted and conducted interviews with agencies' officials who could offer a long-term perspective by currently holding senior positions (e.g., working group coordinator, member of the governing board) in at least one the agencies that are of interest to my study. The sample used was based on snowballing (Davies, 2001) in order to prioritise key actors, i.e., senior officials. In total, I was able to arrange eleven in-depth interviews. Questions included in the interview guide are found in the Appendix (Table A1).

3.2. The operationalisation of the explanatory variables

Formal-institutional autonomy

Existing studies on regulatory agencies typically measure agencies’ formal autonomy from political interests through an index composed of various dimensions such as the status of the agency head (Gilardi, 2005a; Edwards and Waverman, 2006; Wonka and Rittberger, 2010; Wassum and De Francesco, 2020). While my focus in this analysis is not on autonomy from politics, these dimensions can also capture agencies’ formal autonomy from corporate interests.

Drawing on these studies, I develop an index based on several variables, listed and explained in the Appendix (Table A2). These variables relate to three different components, specifically: (1) status of the governing board (e.g., are there formal qualification and autonomy requirements?), (2) formal relationship with stakeholders (e.g., are public consultations organised? Is a balance of interests formally required in the working groups?), and (3) regulation on decision-making (are there quorum requirements for approving a policy?). The agencies’ competences (i.e., consultative tasks or purely regulatory) are not considered in the index as the internet agencies develop guidelines and rules which are not binding by law, unless they are adopted by governmental entities. Each of the variables ranges from 0 to 1, with 1 indicating the highest level of autonomy.

The formal autonomy index is a sum of the variables. I divide it by the total number of variables so that the values taken range from 0 to 1, with higher values indicating greater formal autonomy from corporate interests. I compute a Cronbach’s Alpha for all variables to measure internal consistency. Cronbach’s alpha is a common test used to assess how well a group of variables measures a single construct. The alpha coefficient was 0.81, suggesting a relatively high consistency among the variables selected. The results also align with insights from existing literature, which often identify agencies such as ICANN and, to a lesser extent, the IETF as exhibiting relatively higher levels of formal autonomy, at least in comparison to others like the W3C (Jongen and Schole, 2024; Christou et al., 2020).

Policy complexity

In their analysis of EU agencies’ institutional independence, Wonka and Rittberger (2010, p. 742) take the agency staff size as a proxy for policy complexity. The rationale is that the more complex the agency’s tasks, the more staff is required. However, staff can also be associated with an agency’s informal autonomy, as I explain in the next section. Other studies use document-based measures, such as document length (Junk, 2016) or variation in word use (Type-Token Ratio, or TTR) (Aizenberg and Müller, 2021), but these primarily capture complexity in terms of lexical diversity or readability (Hurka et al., 2022), rather than the level of technical expertise required.

Building on the logic that more complex documents contain more specialised or technical information (Osnabruegge and Vannoni, 2022), I assess Policy complexity by analysing the technicality of agencies' mission statements. This involves calculating the share of technical words, defined as words with two or fewer synonyms. Examples of technical words include “gTLD registrars”. This technicality is not only a feature of how the mission is expressed but also reflects the nature of the agency’s policy domain (Hurka et al., 2024) and whether it addresses general regulatory principles or more narrowly defined issues.

This method is not without limits as Policy complexity is only calculated for the documents stating the missions and principles of the agency. The policies actually developed by the agency may be more or less complex than these statements suggest. An alternative approach would thus consist of calculating the share of technical words for all policy documents, but such documents are not always publicly accessible. In many cases, access to the full policy texts requires agency membership. As a robustness check, I also use an alternative complexity measure based on lexical diversity (TTR), reported in the Appendix (Table A8).

Media attention

I measure the level of media attention using a media coverage analysis of the internet regulatory agencies. Media attention is expressed as the aggregate number of news articles covering each internet agency between 2006 (i.e., year of the creation of the youngest internet regulatory agency) and 2020. Data is retrieved from Factiva, a database that collects contents from a variety of globally produced sources of information, including national newspapers like The Wall Street Journal (United States), or Global Times (China), and more specialised newspapers such as Communications Daily. Using Factiva thus ensures a global coverage of media sources, whereas relying on a single outlet or a narrower set of sources risks introducing bias toward specific regions or languages. To collect relevant articles, I use the agency’s name as a search term and restrict the search to the article’s title and first paragraph. Further information on the articles collected and the keywords used is provided in the Appendix (Tables A3-A4).

Age

I measure Age by looking at the agency’s date of establishment. Specifically, I subtract the year of the establishment of the agency from the year of the data collection (i.e., 2020). This allows a basic consideration of temporal dynamics and, therefore, of an institution’s self-reinforcing mechanisms (Haftel and Thompson 2006, p. 267).

3.3. The operationalisation of the dependent variable

Rather than relying on surveys or self-reported perceptions (e.g., Ingold et al., 2013; Gonzales and Verhoest, 2020), I focus on two dimensions of agencies’ capacity to operate autonomously: decision-making insulation and operational resources. Each is captured through a corresponding empirical indicator that provides an observable expression of informal autonomy.

The first dimension is operationalised through corporate ties. It is measured as the share of current members of an agency’s governing board who are simultaneously employed by a company or business association. Although it is common for board members to hold such current professional roles in the private sector, the extent of these present ties varies across agencies, making this a useful indicator of the proximity of corporate interests to an agency’s decision-making processes. Scholars argue that public officials with private sector experience are likely to align their thinking with industry objectives and priorities (e.g., Kwak, 2013; Rex, 2020).

The second indicator captures the internal resources available to the agency (Eckert, 2010; Maggetti 2007, 2012a). Research suggests that the more resources an agency has, the less it relies on the expertise and informational knowledge provided by private interests (Edwards and Waverman, 2006; Eckert, 2010). Furthermore, holding resources potentially furthers the development of counter-expertise. I use the agency’s staff size (i.e., number of staff members), as reported on the agency’s website, as a proxy for material resources.

Staff size reflects the organisational capacity through which autonomy is enacted, by enabling agencies to rely on internal expertise and resources in their day-to-day operations. Corporate ties in boards, on the other hand, captures the degree to which autonomy is exposed to or insulated from corporate interests at the level of decision-making authority. Finally, I combine the two indicators into an additive Informal autonomy index. Informal autonomy runs from 0 to 1, with higher values indicating greater informal autonomy. Alternative measures (such as the agency’s budget and the share of the agency’s budget derived from corporate sources) are used as robustness checks. Full details are provided in the Appendix (see Tables A10 to A15).

4. Empirical analysis and discussion

I begin with a descriptive overview of agencies’ autonomy. Figure 1 displays the levels of agencies’ Formal and Informal autonomy, using the quantitative data previously outlined. A first observation to make is that Informal autonomy significantly varies across agencies. OMA displays the lowest level of Informal autonomy, whereas ICANN displays the highest level. This ordering is consistent with existing evidence in the literature and therefore supports the operationalisation employed in this study. For example, Baron and Kanevskaia (2013) show that within the IETF, organisational affiliation plays a central role in structuring decision-making. Kanevskaia (2023) further highlights how specific governance features, such as the W3C’s staff and director roles, create institutional conditions that enable greater resistance to corporate pressures, thereby increasing informal autonomy in operational processes. By contrast, decision-making in the IETF (and, to a lesser extent, the IEEE) is characterised by the strong influence of corporate participants. Similarly, Baron et al. (2019) distinguish agencies such as the W3C, which exhibit relatively higher informal autonomy, from agencies such as ECMA and the IETF. Finally, survey evidence from Jongen and Scholte (2024) indicates that participants perceive ICANN’s day-to-day operations as being governed by the organisation itself. Although perception-based, this is consistent with a higher degree of informal autonomy.

Importantly, these differences do not simply mirror levels of Formal autonomy, suggesting that formal safeguards alone are not sufficient to explain variation. Understanding what drives these patterns requires examining how formal and informal dimensions interact with other factors. I therefore turn to the fsQCA.

The fsQCA analysis proceeds in three steps. First, the data is calibrated so that the variables form fuzzy sets that reflect degrees of membership. This requires assigning each variable a score between ‘0’ (indicating full non-membership, or low degree of autonomy) and ‘1’ (indicating full membership, or high degree) (Greckhamer et al., 2018). To do so, I use the characteristics of the sample (Greckhamer, 2016), including quantiles and median values, to establish thresholds for membership. Further details on the calibration procedure are provided in the Appendix (see Tables A5-A6).

Second, I conduct an analysis of necessity to determine whether any single factor is consistently present whenever the outcome (i.e., high Informal autonomy) is observed. A condition is considered necessary if it is always present when the outcome occurs, typically with a consistency threshold of 0.90 or higher (Schneider and Wagemann, 2010). The results of the necessity analysis indicate that none of the individual factors meet the threshold for necessity. This suggests that informal autonomy cannot be explained by the presence of any one factor alone but instead emerges from combinations of factors.

The third step involves performing an analysis of sufficiency. This requires constructing a truth table (Ragin, 2000, 2008), which lists all logically possible combinations of the causal factors and assigns empirical cases to the relevant configurations. I apply a frequency threshold of 1, meaning that a configuration must be observed in at least one case to be included in the sufficiency analysis. This is a standard threshold for small to medium-sized samples (Ragin, 2008). The resulting truth table is provided in the Appendix (Table A7). A consistency threshold must also be set, as consistency reflects the proportion of cases with a given configuration that exhibit the outcome. Following Ragin’s (2008) recommendation to use a threshold above 0.75, I adopt a cut-off of 0.8. Configurations meeting this threshold are then subject to the logical minimisation process, which identifies the simplest combinations of factors that are sufficient for the outcome. The results, presented in Table 3, suggest that four configurations of factors contribute to Informal autonomy.

Table 3. Configurations contributing to increased autonomy.

Notes: Black circles represent high levels, and white circles represent low levels.

The first configuration combines high Formal autonomy, high Media attention, low Policy complexity, and low Age (i.e., agencies younger than 20 years). This combination aligns with theoretical expectations: formal rules provide structural safeguards, and media attention functions as an external source of pressure and accountability, helping ensure that the agency operates in line with its formal obligations. This configuration appears robust across alternative measures of Informal autonomy and applies most clearly to ICANN. ICANN transformed significantly after its 2016 separation from US government oversight, introducing more transparent and consultative procedures. As one interviewee explained: “Because it was no longer accountable to an outside party, no longer accountable to a government. It was then accountable to structures within itself. New structures have to be created to provide that oversight” (Interview 2). The agency also receives higher media coverage than other agencies, which stems largely from its role in managing the domain name system (i.e., the database that translates website names into internet addresses). With the internet expanding, domain names represent critical global economic resources since they provide a presence on the internet for those possessing them (DeNardis, 2014).

Interview data highlight that media attention around certain issues, privacy and data protection in particular, has grown in recent years, contributing to greater visibility for what the agencies do. As one interviewee noted, “The sensitivity to those topics has increased in society; the attention for that has grown” (Interview 9). However, it is not general public salience that seems to matter most. Rather, what supports autonomy is visibility within the technical community and among peers. As one official explained, “We care about the way we are seen. We have to show how our model works in practice.” (Interview 1). Others mentioned efforts to “set the record straight” when challenged (Interview 9) and the importance of “paying attention to our reputation” (Interview 11). A robustness check using only technical media sources (provided in the Appendix, see Table A9) confirms that the relationship holds when attention is limited to specialist media sources.

The second configuration combines high Formal autonomy and high Age, while Policy Complexity and Media attention are lower. This configuration applies to agencies such as IEEE and RIPE. The absence of Media attention here suggests that older agencies (over 35 years) with established procedures can maintain autonomy through internal processes rather than external oversight. This institutional maturity thus appears to compensate for the lack of external monitoring, with agencies drawing on accumulated experience and expertise. As one IEEE official described, trust in their rules and guidelines stems from this established expertise and recognition: “Word of mouth is still one of the best ways to influence” (Interview 10).

The third configuration presents a particularly interesting case, combining high levels of Media attention and Age with lower levels of Policy complexity and Formal autonomy. This configuration demonstrates that agencies can achieve autonomy even without strong institutional protections, provided they benefit from accumulated experience and external visibility. The agency most aligned with this configuration is ITU-T, which has a long-standing role in internet governance and receives comparatively high media coverage, owing in part to its UN affiliation, despite limited Formal autonomy.

In contrast with the others, the fourth and final configuration shows that Informal autonomy can be sustained even under high Policy complexity, as long as the agency benefits from all other enabling conditions: high Formal autonomy, high Media attention, and high Age. This configuration also appears consistently when alternative measures of Informal autonomy are used and is most closely associated with the IETF, although its degree of Informal autonomy is comparatively limited (i.e., close to the point where it would not be classified as “in” the high-autonomy set, as illustrated in Figure 1).

Discussion

Taken together, the results show that agencies’ informal autonomy is supported through multiple configurations, depending on how institutional procedures and attention interact with the complexity and age of the agency. Three key patterns stand out.

First, the analysis reveals the insufficiency of formal rules alone. While Formal autonomy plays an important role in three configurations, it never appears as a sufficient factor for Informal autonomy. This finding aligns with existing literature showing that formal autonomy does not automatically translate into informal autonomy (Maggetti 2007; Hanretty and Koop, 2013). As one interviewee illustrated: “our formal processes are built to prevent us from being too dependent on certain interests. But our impact depends on some large companies, vendors or network operators, that play a critical role in their fields. At the end of the day, if Google, Mozilla or Microsoft eventually decide not to be part of our organisation, not to implement our standards, our work would be worthless” (Interview 4). Another interviewee emphasised the resource constraints that limit the enforcement of formal rules: “We want to make sure that members respect the rules and that the rules conform to the organisation – to what we want them to be. But we don’t have the resources in terms of staff to oversee all working groups” (Interview 10).

Second, Policy complexity constitutes an important barrier to Informal autonomy. Low Policy complexity indeed appears in three of the four configurations. One interviewee described the difficulty of participating once issues become too specialised: “Very little gets done without user requirements. But once it gets translated into technical solutions, you're getting pretty deep into internet technology. And if you're not an expert, it's pretty hard to engage” (Interview 9). This exclusionary effect is further intensified by consensus procedures, which, while typically praised for their fairness, require that objections be framed in highly technical terms. As several interviewees noted, objections must be framed in technical terms (Interviews 2, 9). One explained, “You can object, but the objection has to be technical,” (Interview 3) underscoring how complexity can privilege those with greater technical knowledge. Under these conditions, consensus reinforces resource asymmetries.

Third, the findings reveal a logic of substitutability between what appears to be internal institutionalisation (via formal rules and organisational age) and external visibility (via media attention). Attention from the media plays an important role when formal autonomy is weaker or when agencies are younger. Conversely, when agencies benefit from well-established procedures and accumulated experience, external visibility, and the oversight it brings, becomes less central for informal autonomy. This helps clarify why existing literature mixed findings on the role of agency age. The findings here suggest that whether an agency’s age constrains or supports informal autonomy ultimately depends on how it interacts with other factors.

Conclusion

This study has examined the extent to which internet regulatory agencies are autonomous from corporate interests. The analysis shows that such autonomy is not determined by any single institutional feature but rather emerges from specific combinations of factors. The findings reveal multiple pathways to autonomy, depending on how formal rules, agency’s age, media attention, and policy complexity interact. These findings carry important normative implications for the legitimacy of global forms of governance. In agencies that operate outside traditional state-based accountability structures, legitimacy rests not only on effectiveness but also on transparency, fairness, and inclusiveness (Brassett and Tsingou, 2011; Jonge and Scholte, 2024). When autonomy is constrained by high policy complexity and weak institutional safeguards, there is a risk that decisions will be perceived as serving narrow interests. Reliance on media attention and reputational mechanisms can strengthen legitimacy, particularly as internet governance attracts growing public and political attention. However, if visibility remains largely confined to specialised technical audiences, the capacity to contest decisions will be limited to a relatively narrow group.

Although this study provided some important findings, the measure of informal autonomy used here does not directly assess the content of decisions made. A more direct assessment of policy outcomes would make it possible to determine the extent to which corporate interests shape the policies adopted. Relatedly, a fruitful and important direction for future research would be to examine how the degree of informal autonomy affects the policies produced as analysing its outcome is beyond the scope of the present paper. Expertise is not value-neutral and so-called experts can serve self-interested objectives (Esterling, 2004; Chalmers, 2014). But the limited autonomy from corporate interests does not imply that the policies developed systematically and consistently undermine public interests in favour of vested interests. Although cleavages between corporate interests and organisations representing more public interests exist, much more fine-grained lines of conflict can cut across these conventionally assumed cleavages. Moreover, this study does not examine the role of state actors in the creation and decision-making processes of these agencies, leaving open the question of whether there is a “shadow of hierarchy” (Héritier and Eckert, 2008).

Appendix

Table A1: Interviews

No	Time and date	Role
1	10 August 2021, 10 am	Former senior leadership position (industry)
2	17 August 2021, 8 am	Former senior leadership position (academia)
3	1 September 2021, 1:30 pm	Governance role (organisational staff)
4	2 September 2021, 2:30 pm	Former senior leadership position (industry)
5	2 September 2021, 6 pm	Senior leadership position (academia)
6	3 September 2021, 9 am	Governance role (industry)
7	8 September 2021, 1 pm	Senior leadership position (organisational staff)
8	9 September 2021, 10 am	Former senior leadership position (organisational staff)
9	10 September 2021, 4 pm	Governance role (organisational staff)
10	10 September 2021, 7 pm	Governance role (organisational staff)
11	8 October 2021, 3:30 pm	Senior leadership position (organisational staff)

The interviews lasted between 45 minutes and 80 minutes. The interview guide included the following questions:

• Can you tell me about your role in the organisation?
• Can you describe a typical working group meeting? What kinds of knowledge are required to participate?
• Which categories of stakeholders are (particularly) important for the organisation?
• Could you tell me about the role that corporate interests play in the organisation? To what extent are they considered as (particularly) important for the organisation? Has this changed over time?
• Overall, would you say that the organisation is more insulated from certain interests than others?
• Has anything changed in terms of how the organisation operates day-to-day?
• Overall, do you think the attention accorded by the media has an impact on the organisation - in terms of day-to-day decision-making processes? How?

Table A2: Formal-institutional autonomy index

Variable	Value
C1 – Agency Board
V1 – Members of the board (formal) autonomy	1 = yes, formal requirement
	0 = no formal requirement
V2– Members of the board formal requirement qualification	1 = yes, formal requirement
	0 = no formal requirement
C2 –Relationship with stakeholders
V3 – Membership	1 = no membership required
	0.5 = membership but open meetings
	0 = membership required
V4 – Membership fees	1 = no fee
	0.5 = adjusted fees (to the type of interest)
	0 = fees
V5 – Agency external consultation	1 = yes, before and after proposal drafted
	0.5 = yes, but only before or after proposal drafted
	0 = no
V6 – Balance of interests' formal requirement	1 = Yes, for Board and Working Groups
	0.5 = Yes, but only for Board or Working Groups
C3 – Regulation on decision-making
V7 – Number of Representatives	1 = only one member representative
	0.5 = several member representatives allowed but only one is allowed to vote
	1 = only one member representative
	0 = no quorum
V8 – Quorum for meeting	1 = all participants
	0.75 = more than 70% of the participants
	0.5 = between 50% and 70% of the participants
	0.25 = between 20% and 50% of the participants
	0.15 = flexible (i.e., the chair decides if a quorum is needed)
	0 = no quorum
V9– Quorum for approval	1 = all participants
	0.75 = more than 70% of the participants
	0.5 = between 50% and 70% of the participants
	0.25 = between 20% and 50% of the participants
	0.15 = flexible (the chair decides if a quorum is needed
	0 = no quorum
V10 – Voting rule	1 = consensus
	0.5 = vote
	0 = weighted vote
V11 – Resource dependency	1 = Agency levies fees for its services and finances itself with these
	0.5 = mixed resources 0 = membership fees only

Table A4 lists the variables comprised in the Formal autonomy index.

The first component (i.e., C1) indicates whether there are formal qualification and autonomy requirements.

The second component (i.e., C2) captures the relationship with the different stakeholders involved. It includes the following variables: membership requirement, membership fees, setting up of public consultations. Membership fees indicate whether actors with less financial resources can get involved in the decision-making process. The rationale regarding consultation procedures is that the more opportunities are set up to receive policy inputs from various stakeholders, the more autonomous from concentrated interests the regulatory agencies formally are. This component also comprises variables indicating whether a balance of interests is required for the board and/or working groups.

The third and final component (i.e., C3) captures the agency's internal organisation by focusing on the rules for debating and approving policies. This component comprises a variable indicating whether several member representatives are allowed to participate and vote. It also specifies the voting rules (e.g., consensus, weighted vote), quorum requirements for meeting and approving a policy. As quorum requirements constraint the number of participants necessary to discuss and approve a policy, they guarantee that the policy is debated by a large number of participants - and not just among a narrow, vested group of actors, as well as its financial resource dependency.

The opportunity to make an appeal (i.e., if all participants are allowed to make an appeal, or if this opportunity is only reserved to specific members) could have been included as well, but the included of this variable resulted in a significant decrease of the Cronbach's Alpha coefficient. Variables on the degree of transparency are not included either. Indeed, I argue that agencies can be transparent without being autonomous insofar as the notion of transparency rather relates to accountability (Maggetti et al., 2015) and good governance (Edwards and Waverman, 2006).

Table A3: Examples of media sources

Media source	Country and region
Agence France Presse	France
Berlingske	Denmark
Canberra Times	Australia
China Times	Taiwan
Communications Daily	United States
Computerwelt Online	Germany
Computer Technology Review	United States
CybersecAsia	Singapore
Deutsche Welle	Germany
El Pais	Spain
Europolitics	Belgium
Financial Times	United Kingdom
Folha de São Paul	Brazil
Global Times	China
Hong Kong Economic Times	Hong Kong
Il Sole	Italy
India Today	India
Journal of Engineering	United States
Khaleej Times	United Arab Emirates
La Repubblica	Italy
Rossiyskaya Gazeta	Russia
Spiegel Online	Germany
South China Morning Post	Hong Kong
Telecommunications Weekly	United States
The Canadian Press	Canada
The Economist	United Kingdom
The Irish Times	Ireland
The New-York Times	United States
The Times	United Kingdom
Wall Street & Technology	United States
ZDNet Korea	Korea

Note: Table A4 provides examples of media sources recorded by Factiva. The complete list of media sources recorded by Factiva can be found here: https://proquest.libguides.com/factiva/content

Table A4: Summary: Factiva database search keywords

To collect relevant news articles, I use the full name of the agency, the connector 'or'[i], and the agency's acronym as search terms.	"Internet Corporation for Assigned Names and Numbers" or ICANN
The search is limited to the article's title and first paragraph.	Title and first paragraph
Similar articles but published in different media sources are kept as they are an indicator of public attention	Duplicates included

Table A5: Summary statistics

Variable	Obs	Mean	Standard deviation	Min	Max
Formal autonomy	12	0.3973485	0.1763374	0.2045455	0.6818182
Policy complexity	12	.0854875	.073494	.0140515	.2906977
Media attention	12	3251.917	5595.812	39	17460
Agency age	12	28	10.77877	15	58
Informal autonomy	12	.2826852	.2709314	0	0.9

Table A6: Data calibration (FsQCA)

Variable (fuzzy)	Obs	Mean	Standad deviation	Min	Max
Formal autonomy	12	.4419192	.4622322	0	1
Policy complexity	12	.3994247	.3187931	0	1
Media attention	12	.5031955	.2989357	0	1
Agency age	12	.4846427	.2991227	0	1
Informal autonomy	12	.5398106	.325979	0	1

Notes: All variables were calibrated into fuzzy set membership scores for the fsQCA analysis. Unlike crisp sets, which assign cases as either fully in or fully out, fuzzy sets allow for degrees of membership ranging from 0 to 1 (Ragin, 2008). For example, the variable Informal autonomy was calibrated using three anchor points: full non-membership at 0.02, a crossover point at 0.21, and full membership at 0.45. This approach applies a logistic transformation to create the characteristic S-shaped membership curve central to the direct calibration method. The resulting distribution showed that 25% of cases achieved full membership, a proportion within recommended thresholds, indicating meaningful cross-case variation (Schneider and Wagemann, 2010). For skewed variables such as Media attention and Age, log transformations were applied prior to calibration to ensure more even distribution (Ragin, 2008; Schneider and Wagemann, 2012). For instance, Age was calibrated using the following thresholds: full non-membership at 18 years, the crossover point at 27 years, and full membership at 35 years.

Table A7: Truth Table

Formal autonomy	Policy complexity	Media attention	Age	Outcome	n	Consistency	PRI
0	0	0	0	0	3	0.559	0.025
0	0	1	0	0	2	0.759	0.486
0	0	1	1	1	1	0.877	0.731
0	1	1	0	0	1	0.669	0.302
1	0	0	1	1	3	0.898	0.78
1	0	1	0	1	1	0.968	0.94
1	1	1	1	1	1	0.891	0.708

Table A8. FsQCA with an alternative measure of Policy complexity

Notes: Black circles represent high levels, and white circles represent low level; blank cells represent irrelevant conditions. Policy complexity is measured using the Type-Token Ratio (TTR), calculated as the proportion of unique words relative to the total number of words.

While fewer configurations are identified here compared to the main analysis, the results are broadly similar in terms of the main configurations, suggesting that low levels of Policy complexity are associated with high Informal autonomy. Differences in the configurations can be explained by the fact that lexical diversity captures a different dimension of complexity than technical complexity.

Table A9. FsQCA with an alternative measure of Media attention

Notes: Black circles represent high levels, and white circles represent low levels; blank cells represent irrelevant conditions. Media attention is measured using the number of specialised media sources focused on internet and information technology. A source is categorised as specialised if it explicitly references technology, computing, or telecommunications in its title or abstract (e.g., Communications Daily, Journal of Engineering, Darren’s Communications, Computerwelt Online, ZDNet Korea). Sources that do not meet this criterion are treated as general (e.g., Financial Times, El País, Neue Zürcher Zeitung).

Table A10. FsQCA with an alternative measure of Informal autonomy (budget and corporate revenue share)

Notes: Black circles represent high levels, and white circles represent low levels. Informal autonomy is measured using an index that combines agency’s budget (in million SUSD) and the share of revenue derived from corporate membership fees. This alternative measure shows a moderate correlation (r = 0.43) with the main Informal autonomy index.

Table A11. FsQCA with an alternative measure of Informal autonomy (corporate ties and budget)

Notes: Black circles represent high levels, and white circles represent low levels. Informal autonomy is measured here using an index that combines the share of board members with corporate affiliations (corporate ties) and the agency’s budget (in million USD). This alternative measure shows a very strong correlation (r = 0.98) with the main Informal autonomy index.

Table A12. FsQCA with an alternative measure of Informal autonomy (corporate ties and corporate revenue share)

Notes: Black circles represent high levels, and white circles represent low levels. Informal autonomy is measured here using an index that combines the share of board members with corporate affiliations (corporate ties) and the share of revenue derived from corporate membership fees. This alternative measure shows a moderate correlation (r = 0.61) with the main Informal autonomy index.

Table A13. FsQCA with an alternative measure of Informal autonomy (staff size and corporate revenue share)

Notes: Black circles represent high levels, and white circles represent low levels. Informal autonomy is measured here using an index that combines the share of revenue derived from corporate membership fees and staff size. This alternative measure shows a moderate correlation (r = 0.49) with the main Informal autonomy index.

Table A14. FsQCA with an alternative measure of Informal autonomy (staff size and budget)

Notes: Black circles represent high levels, and white circles represent low levels. Informal autonomy is measured here using an index that combines agency’s budget (in million USD) and staff size. This alternative measure shows a strong correlation (r = 0.76) with the main Informal autonomy index.

Table A15. FsQCA with an alternative measure of Informal autonomy (all indicators)

Notes: Black circles represent high levels, and white circles represent low levels. Informal autonomy is measured using an index that includes all indicators: corporate ties, total budget (in million USD), share of revenue from corporate membership fees, and staff size. This alternative measure shows a strong correlation (r = 0.88) with the main Informal autonomy index.