Four winters at the festival

There were no speakers yet — just five detective-style missions, hand-built by one person, escalating from retrieving SSH keys from "secured comms" to rebooting a fictional defense network. Istanbul Legal Hackers, The Shifting Privacy Left Podcast, and the Istanbul Bilgi University Privacy Innovation Lab lent their support and audiences to get the word out.

More than 40 players picked up the pre-game bonus puzzle and completed their training missions before launch day. By the final round, roughly 50 players from around the globe had joined the hunt, and five finalists made it to the fifth and last puzzle to compete for the title of Privacy Champion of the Galaxy.

There was no team — just a privacy lawyer running a startup and a lab, designing puzzles and composing the theme music in whatever hours were left over. It was, by the founder's own account, entirely a passion project stitched together around a day job.

The solo, single-puzzle-chain treasure hunt became a month-long festival with a formal academic partner, a defined theme, and weekly live events instead of one asynchronous game. The tradition that the winner "designs next year's challenge" was born here — DPD'23 was the seed for everything that followed.

Opening week belonged to Aldo Lamberti, who framed synthetic data as a marketplace of "weapons" both factions needed to survive the battle. Villagers still bring up Kim Wuyts' full LINDDUN threat-modeling walkthrough — access control, attack trees, residual risk, the whole "what can go wrong" framework taught puzzle by puzzle — as the most technically dense session of the year. Jay Averitt spoke on AI going mainstream; Leyla Keser closed the festival on Data Privacy Day itself with a talk on AI policymaking.

A fully remote, global audience again, coordinated across Zoom, Discord, and YouTube — with organizers publicly thanking communities as far afield as Cyber in Africa for spreading the word.

Tess Lynch's Privacy RPG night sold out almost immediately. The announcement read, plainly: "unfortunately at full capacity and won't be offering any seats at the game table." Everyone else got a livestream instead. It was the first sign that the small, high-touch tabletop sessions would always be the festival's tightest bottleneck — a problem that never fully went away.

The one-off "fireside chat" became a named, recurring weekly slot. The faction-points competition proved sticky enough that 2025 built an entire village map of subcommunities around it, instead of running one flat schedule of talks.

Sina Ateş opened the year as keynote artist, talking generative AI's role in his creative pipeline. Rebecca Balebako ran a three-week Privacy Engineering Mini Bootcamp as "Guardian of the House of Responsible AI" — real privacy-failure stories, a user-driven approach to Responsible AI, then a session on choosing the right PETs. Swati Popuri returned as Guardian of the new Tower of Privacy Engineering. The closing keynote went to Wes Kussmaul, founder of Delphi, one of the internet's earliest companies — easily the highest-profile name the festival had hosted.

Beyond the usual global remote crowd, the festival went in-person for a night: a game jam hosted inside Istanbul Bilgi University's courtroom classroom, with law and privacy students joining from France, Germany, and beyond alongside the local crowd.

The capacity problem from 2024 came right back. Michael Novack's Fuzzy Logic game night filled up again, and organizers found themselves apologizing for "limited spots" a second year running — the intimate, in-character sessions kept being the thing everyone wanted and the thing there was never enough of.

A Forbes feature by Abigail Dubiniecki ran on the festival's gamified approach to privacy training — the first time "the Disneyland of Privacy" made it into national press, and the origin of the claim the site still carries today.

The loose collection of "houses" and individual guardianships got formalized into a proper tiered structure the next year — and the ad hoc community layer became a real partnership with an outside organization built for exactly that job.

For the first time, a fully separate hardcore track: 14 immersive challenges across Privacy Engineering, AI Governance, and Cybersecurity, hosted on the Compliance Detective platform and dressed as a Middle-earth-inspired saga — from The Castle Gate (access control) and The Dark Tower Relay (network forensics) to The Oracle's Budget (differential privacy) and The Neural Intercept (AI/LLM forensics), plus seven more advanced challenges covering prompt injection, PII scanning, third-party risk, and incident response.

The closing recap put it plainly: 300+ registrations, 13 speakers, 2 brand-new games launched, 20+ hours of content now living on YouTube, and 3,000+ XP earned across every challenge and game. This year's Battle for AI went to the AI Fundamentalists.

Same story, third year running: Tess Lynch's TTRPG night filled its player seats again. The organizers' message was almost identical to 2024's — "ping me... if you want to claim a seat" — with everyone else offered a livestream. Three festivals in, the tightest live sessions are still the tightest live sessions. Some things the village hasn't solved, and probably never fully will.

The festival closed by calling itself "a checkpoint, not a goodbye." The AI Apocalypse faction was promised its shot at the title next year, and the Observer / Adventurer / Hero structure, along with the Compliance Detective quest platform, is now treated as the permanent shape of the festival going forward.