Anonymised WHOIS in the age of the GDPR: a challenge to ICANN’s rules?
Introduction
In a context marked by increasingly stringent requirements regarding the protection of personal data, the management of information relating to domain name registrants is undergoing significant developments. The current practice of masking WHOIS data forms part of this trend, but it is not without raising certain concerns. Indeed, it appears to be in tension with the principle of transparency historically upheld by ICANN. A question therefore remains: is the anonymization of domain name holders truly compatible with the rules governing the domain name system?
What is WHOIS and why is it essential?
WHOIS is a distributed registration data system that enables the identification of domain name registrants. It contains key information such as the registrant’s identity and contact details, the registrar, and the domain name’s registration and expiry dates.
Historically, this system is grounded in a core ICANN principle: transparency. This principle ensures the balanced functioning of the domain name ecosystem by, in particular:
- Enabling the traceability of rights holders
- Ensuring the effectiveness of protection and dispute resolution mechanisms
In practice, WHOIS operates as a regulatory tool, maintaining a balance between the freedom to register domain names and the accountability of registrants.
The ICANN framework: transparency and registrar obligations
The framework established by ICANN aims to ensure the reliability, accessibility, and transparency of domain name registration data. Under the Registrar Accreditation Agreement (RAA), registrars are required to collect and maintain accurate, complete, and verifiable registrant information, within the limits imposed by the GDPR, and to implement mechanisms allowing access to such data under regulated conditions, particularly in the context of administrative or judicial proceedings.
Beyond these obligations, the system is based on a fundamental principle: registrant accountability. The registration of a domain name implies that its holder can be identified and held responsible for its use. This identifiability is essential for the effective exercise of third-party rights, whether to issue notices, initiate UDRP proceedings, or enforce decisions.
From a technical standpoint, WHOIS operationalises ICANN’s regulatory model by ensuring traceability of domain name holders.
Anonymised WHOIS: how it works and potential abuses
Since the entry into force of the GDPR on 25 May 2018, numerous registrars have adopted a particularly cautious approach to the management of WHOIS data, especially where such data relates to natural persons, leading in practice to a largely systematic anonymization, often applied by default.
In this context, they have progressively adjusted their practices in order to reconcile personal data protection requirements with the historical transparency obligations of the WHOIS system. This evolution has resulted in a restriction of public access to identifying data, as well as in the development of technical masking solutions.
Masked WHOIS data rely on privacy or proxy services offered by registrars, whereby the registrant’s details are replaced with those of an anonymisation service provider. As a result, identifying information is concealed, and a third party appears as the point of contact, rendering the registrant’s identity only indirectly accessible.
While this evolution reflects legitimate data protection concerns, it has directly impacted the effectiveness of enforcement mechanisms. It complicates the identification of registrants, delays dispute resolution, and hinders domain name recovery actions, while facilitating abusive practices such as phishing, counterfeiting, and typosquatting.
In practice, anonymised WHOIS increasingly operates as a concealment tool, departing from the transparency-based logic historically underpinning the DNS. This results in a form of over-compliance, where data protection effectively prevails over accessibility requirements, thereby weakening a core element of ICANN’s regulatory model.
For further information regarding the fraudulent uses of domain names, we invite you to consult our previously published article.
Reconciling data protection (GDPR) with ICANN transparency requirements
The widespread use of anonymised WHOIS highlights a structural tension requiring a balancing of competing interests: on the one hand, the protection of personal data, and on the other, the need for transparency and registrant identifiability.
In this context, mechanisms have emerged to reconcile these objectives, most notably differentiated access models.
Although WHOIS data are no longer publicly accessible, they may be disclosed to parties demonstrating a legitimate interest, particularly in contentious contexts. This model, commonly referred to as “gated Whois,” seeks to preserve data confidentiality while ensuring the effective enforcement of rights.
This development is rooted in the ICANN Temporary Specification for gTLD Registration Data (2018), adopted in response to the GDPR. This framework reshaped access to WHOIS data by establishing anonymisation by default while organising controlled access mechanisms.
A practical illustration of this system can be found in UDRP proceedings. Upon the filing of a complaint, the dispute resolution provider requests a registrar verification, enabling the identification of the underlying registrant despite anonymised WHOIS data.
However, outside such structured mechanisms, access to registration data remains fragmented and largely dependent on registrar practices. Disclosure conditions and response times vary significantly, limiting effectiveness, particularly in situations requiring urgent action.
Conclusion
The reconciliation between GDPR requirements and the need for access to registration data does not depend solely on regulatory texts, but on the implementation of reliable operational mechanisms ensuring proportionate, secure, and effective access.
Failing this, there is a risk of entrenching a system in which legitimate data protection concerns undermine the effectiveness of regulatory tools and the enforcement of rights.
Dreyfus law firm assists its clients in managing complex intellectual property cases, offering personalized advice and comprehensive operational support for the complete protection of intellectual property.
Nathalie Dreyfus with the support of the entire Dreyfus team.
Q&A
1. Can WHOIS data qualify as personal data?
Yes, as long as they enable the identification of a natural person, they fall within the scope of the GDPR.
2. Does the GDPR require full anonymisation of WHOIS data?
No, the GDPR requires the protection of personal data, but does not mandate systematic anonymisation. This is often the result of a cautious interpretation by those involved.
3. Are WHOIS data always accurate?
They are required to be. Registrars have a contractual obligation to collect and maintain accurate and up-to-date data, even if such data are not publicly accessible.
4. Can WHOIS data be obtained outside UDRP proceedings?
Yes, through disclosure requests. However, outcomes depend on registrar practices and the assessment of the asserted legitimate interest.
5. Can a UDRP proceeding be initiated without knowing the registrant’s identity?
WHOIS anonymization does not prevent filing a UDRP complaint. The complaint can be brought against an “unknown” registrant or a privacy service, it being specified that the registrar will disclose the underlying registrant’s identity during the proceedings.
The purpose of this publication is to provide general guidance to the public and to highlight certain issues. It is not intended to apply to particular situations or to constitute legal advice.

















