What is WHOIS privacy pro­tec­tion?

Anyone who registers their domain with a domain registrar is required to submit contact in­form­a­tion. This contact in­form­a­tion may then be publicly ac­cess­ible. If you want more autonomy, security and privacy when it comes to your data, you’ll need to take some steps to ensure domain privacy pro­tec­tion. Domain privacy allows you or your domain registrar to delete publicly available data about you or your business from the WHOIS entry on your domain.

What is domain pro­tec­tion?

Domain privacy pro­tec­tion refers to the pos­sib­il­ity for anonymity and privacy when re­gis­ter­ing a domain. Anyone who registers a domain is required to submit various kinds of in­form­a­tion in order to of­fi­cially purchase the domain. That in­form­a­tion includes personal data, business data and contact in­form­a­tion. More spe­cific­ally, some examples are:

• Name
• Email address(es)
• Business address(es)
• Phone number

So what’s the problem with that? The personal in­form­a­tion that’s connected to a domain isn’t private. It’s openly available via the WHOIS database, unless the domain registrar or re­gis­trant took specific steps to ensure WHOIS privacy. With domain privacy pro­tec­tion, the in­form­a­tion connected to your domain is an­onymised or replaced with in­form­a­tion from your domain or hosting provider. That way you can protect your personal or company data.

What is WHOIS?

Domains, along with their IPs and the personal/company data connected with them, are managed by the ICANN (Internet Cor­por­a­tion for Assigned Names and Numbers) in namespaces. In order to co­ordin­ate IP addresses and domain name servers (DNS), the ICANN has de­term­ined how domains can be re­gistered. It also manages the as­sign­ment of DNS, IP and as­so­ci­ated data under the umbrella of IANA.

When re­gis­ter­ing a domain, customers hand over personal data to re­gis­trars and re­gis­tries, which are then publicly ac­cess­ible via the WHOIS database. WHOIS is an internet registry that contains all the available in­form­a­tion about a domain. The main reason this data is collected is to verify the le­git­im­acy of each domain re­gis­tra­tion. WHOIS entries are meant to ensure that it’s possible to contact domain owners in the event of legal or technical problems or other issues.

The following in­form­a­tion is part of a WHOIS entry in the WHOIS database:

• Domain name
• Domain registrar
• DNS entries/DNS servers
• Date of re­gis­tra­tion
• Ex­pir­a­tion date for domain re­gis­tra­tion
• In­form­a­tion about the re­gis­tra­tion’s renewal date
• Status of the domain
• Admin-C and Tech-C
• Contact in­form­a­tion (email, phone number, address, name) for the domain owner

The scope and content of WHOIS in­form­a­tion will vary depending on domain type/domain ending, as different re­gis­tries might be re­spons­ible for different domain types. Due to the European GDPR, many WHOIS entries in the EU are auto­mat­ic­ally an­onymised or are only revealed in response to le­git­im­ate inquiries. This is also the case in the UK.

What is a WHOIS lookup?

Anyone who visits a website or wants to get in­form­a­tion about a domain can do a WHOIS lookup. A WHOIS lookup shows when a domain was re­gistered and which person or company it was re­gistered to. Depending on the scope of the WHOIS entry, there might also be contact in­form­a­tion or personal data about the domain owner. Lookups are free and can be done using various domain ad­min­is­trat­ors, including:

• ICANN via the ICANN WHOIS LOOKUP service
• The service WHO.IS at WHO.IS

The ad­vant­ages of WHOIS lookups include:

• Checking and proving the le­git­im­acy and unique­ness of a domain
• Col­lect­ing in­form­a­tion about a domain before re­gis­ter­ing a new one
• Making it possible to contact domain owners in the case of technical or legal problems

How does the GDPR affect domain privacy?

The GDPR was in­tro­duced in Europe in 2018 and strictly regulates the pro­cessing, pub­lish­ing and storage of personal data. But while it is an EU-based reg­u­la­tion, the GDPR has far reaching con­sequences for users and companies around the world. In the case of domain privacy, many re­gis­trars have made their processes GDPR compliant for everyone.

So what does GDPR com­pli­ance look like in the context of domain privacy? For one, it means that re­gis­trars are required to delete or anonymise personal data in WHOIS entries for top level domains (gTLDs and EU ccTLDs. It also applies to privacy in the context of domain man­age­ment.

According to the GDPR, domain providers are required to delete personal data from publicly ac­cess­ible WHOIS entries, unless a domain owner indicates otherwise. These days, many domain re­gis­tries offer their own services for domain privacy pro­tec­tion. Those services include:

• An­onymised for­ward­ing addresses for WHOIS lookups
• WHOIS entries about domain owners are replaced with in­form­a­tion from domain provider or a third-party provider
• Selected WHOIS privacy for selected domains
• Two-factor au­then­tic­a­tion and private WHOIS man­age­ment

What are the ad­vant­ages of having whois privacy?

When con­sid­er­ing this question, it’s important to strike a balance between the benefits of WHOIS entries and better domain privacy. Having your in­form­a­tion publicly ac­cess­ible means that visitors to your site can approach you with questions or concerns. In general, it means that anyone is able to find out who owns a domain.

On the other hand, the ad­vant­ages of whois privacy include:

• An­onymising sensitive personal or company in­form­a­tion
• Pre­vent­ing the misuse of publicly available contact data, e.g. in the form of spam or phishing
• Pre­vent­ing domain and identity theft
• Enabling contact to domain owners using an an­onymised for­ward­ing address

Can WHOIS privacy be used for any top-level domain?

Whether domain privacy pro­tec­tion is possible will mostly depend on the domain provider. The terms and con­di­tions should state whether domain privacy is an option or not. Domain privacy is not allowed when re­gis­trant is trading from the domain name, for example.

Note that for some domains, domain privacy is not allowed. This includes domains such as .us, .au, .it and .br. This means that you are required to enter your contact in­form­a­tion when re­gis­ter­ing one of these domains and that that in­form­a­tion cannot be an­onymised or falsified.

For country-specific domains in the EU, the GDPR will apply to domain re­gis­tra­tion via re­gis­tries like ICANN.