Understanding WHOIS Privacy Protection Rules

For most of the internet’s history, looking up a domain meant seeing the owner’s name, postal address, phone number and email address in plain text. That changed dramatically after 2018. Today a typical lookup for a .com domain shows the registrar, dates and status codes, while the registrant fields read “REDACTED FOR PRIVACY” or point to a web form. Understanding why this happens, and which rules decide what stays visible, helps both domain owners who want privacy and people who need to contact an owner for a legitimate reason.

From open WHOIS to redacted records

WHOIS was designed in an era when the network was small and publishing contact details was a practical way to solve technical problems. As domains became commercial assets, the same open data fed spam, scams and identity theft. Registrars responded by selling privacy services, but the public record itself stayed open until European data protection law forced a change.

When the General Data Protection Regulation (GDPR) became applicable on 25 May 2018, ICANN adopted a Temporary Specification that allowed, and in many cases required, registrars and registries to stop publishing personal data of registrants. That interim regime was later replaced by a consensus policy developed through ICANN’s Expedited Policy Development Process (EPDP).

What GDPR-driven redaction hides and what it leaves

Redaction applies to personal data, so in public gTLD lookups you will usually see:

• Still visible: domain name, registrar and its IANA ID, registrar abuse contact, creation, update and expiry dates, nameservers, DNSSEC status and EPP status codes.
• Often visible: registrant country and state or province, and sometimes the organization name if the registrant agreed to publish it.
• Usually hidden: registrant name, street address, phone number and email address, as well as the same fields for administrative and technical contacts.

Instead of an email address, the record normally shows a web form or an anonymized relay address run by the registrar, so people can still reach the owner without learning their identity. Many registrars apply redaction to every registrant worldwide rather than only to people in the EU, because separating the two groups reliably is difficult.

Privacy and proxy services compared with redaction

Redaction and privacy services are often mixed up, but they work differently.

With a proxy service the provider is legally the registrant and you are its customer. That is why proxy terms matter: they decide when the provider reveals your identity or suspends the service, for example in response to abuse reports or legal claims.

RDAP: the protocol behind modern lookups

The Registration Data Access Protocol (RDAP) is the structured, JSON-based successor to classic WHOIS. It supports standardized responses, internationalized data, secure HTTPS transport and, importantly, differentiated access, meaning that authenticated users could in principle receive more fields than anonymous users. ICANN-accredited registrars and gTLD registries were required to run RDAP, and the contractual obligation to operate port 43 WHOIS for gTLDs ended on 28 January 2025. Many services still answer WHOIS queries, but RDAP is now the authoritative source. Our article on WHOIS vs RDAP protocols explains the technical differences in detail.

ICANN’s Registration Data Policy

The Registration Data Policy is the consensus policy that resulted from the EPDP work. It was published in 2024 and became enforceable on 21 August 2025, replacing the Temporary Specification and the interim policy. Its main points include:

1. Data minimization: registrars collect what is needed; some fields, such as a separate administrative contact, are no longer required to be collected.
2. Publication rules: personal data is redacted from public responses unless the registrant consents to publication.
3. Contactability: a form or anonymized email must allow people to reach the registrant without revealing their address.
4. Disclosure requests: registrars must have a process to receive and respond to requests for non-public data within defined timeframes.
5. Legal versus natural persons: registrars may differentiate between companies and individuals, but they are not obliged to.

Requesting non-public data with a legitimate interest

Redaction does not make registration data unreachable. Law enforcement, intellectual property owners, cybersecurity researchers and victims of fraud can ask the sponsoring registrar for disclosure. Under GDPR the registrar has to weigh the requester’s legitimate interest against the registrant’s rights, so a good request should:

• identify the requester and their authority or role;
• name the domain and the specific data fields needed;
• explain the purpose and legal basis, with evidence such as screenshots or trademark registrations;
• explain why the data is necessary and why less intrusive options are not enough.

The Registration Data Request Service

ICANN launched the Registration Data Request Service (RDRS) in November 2023 as a free, central system for submitting these requests to participating registrars. It routes requests but does not decide them: the registrar still makes the final decision, and participation is voluntary.

NIS2 in the European Union

The EU NIS2 Directive adds obligations for registries and registrars serving the EU, including keeping accurate registration data and responding to lawful requests from legitimate access seekers without undue delay, with 72 hours used as the reference period. National implementation differs between member states.

How ccTLDs handle registrant privacy

ccTLD registries are not bound by ICANN policy and set their own rules, often based on national law:

• .de: DENIC does not publish registrant personal data in its public lookup and handles access requests through its own procedure.
• .uk: Nominet hides personal data of individual registrants, while some organization details may remain visible.
• .eu: EURid shows limited data publicly, mainly an email contact and language, with more available on justified request.
• .tr: registrant data for .tr domains managed through TRABIS is handled under Turkish data protection law (KVKK), and personal details are not openly displayed.

Because the rules differ so much, a lookup result that is perfectly normal for one extension may look incomplete for another.

How redaction affects transfers, renewals and verification

Privacy rules have side effects that domain owners notice mostly when something goes wrong. Before 2018, a gaining registrar could read the registrant email from WHOIS and send a transfer confirmation there. With that address now hidden, the old Form of Authorization step for gTLD transfers is no longer enforced in the same way, and the authorization code has become the main proof of control. That makes protecting the code even more important, as we explain in our domain transfer lock guide.

Redaction also affects people who buy expiring or aftermarket domains. Due diligence that once relied on reading the owner’s name now depends on registration dates, status codes, historical DNS and the seller’s cooperation. And because reminder emails come from the registrar to an address nobody else can see, an outdated email can quietly cause missed renewal notices and verification requests.

• After any change of email provider or company domain, update the registrant contact at every registrar you use.
• Respond to contact verification emails promptly; ignoring them can lead to the domain being suspended.
• Do not rely only on registrar reminders for expiry dates, since those messages are easily filtered as promotional mail.

Practical tips for domain owners

Privacy does not remove your responsibility to keep registration data accurate. Registrars periodically verify contact details, and an unanswered verification email can lead to suspension. Keep your email address current, check what your public record shows using the TLDix WHOIS/RDAP lookup, and remember that redaction applies to the record, not to every other place your name appears, such as SSL certificate details, imprint pages or DNS TXT records. If you manage several domains, tracking their expiry dates in the domain panel means you are not depending on registrar emails that may land in a forgotten inbox.