Latest news of the domain name industry

Recent Posts

Whois privacy will soon be free for most domains

Kevin Murphy, March 5, 2018, 16:17:36 (UTC), Domain Policy

Enormous changes are coming to Whois that could mark the end of Whois privacy services this year.
ICANN has proposed a new Whois model that would anonymize the majority of domain name registrants’ personal data by default, only giving access to the data to certain certified entities such as the police.
The model, published on Friday and now open for comment, could change in some of the finer details but is likely being implemented already at many registries and registrars.
Gone will be the days when a Whois lookup reveals the name, email address, physical address and phone number of the domain’s owner.
After the model is implemented, Whois users will instead merely see the registrant’s state/province and country, organization (if they have one) and an anonymized, forwarding email address or web form for contact purposes.
Essentially, most Whois records will look very much like those currently hiding behind paid-for proxy/privacy services.
Technical data such as the registrar (and their abuse contact), registration and expiry dates, status code, name servers and DNSSEC information would still be displayed.
Registrants would have the right to opt in to having their full record displayed in the public Whois.
Anyone wanting to view the full record would have to be certified in advance and have their credentials stored in a centralized clearinghouse operated by or for ICANN.
The Governmental Advisory Committee would have a big hand in deciding who gets to be certified, but it would at first include law enforcement and other governmental agencies.
This would likely be expanded in future to include the likes of security professionals and intellectual property lawyers (still no word from ICANN how the legitimate interests of the media or domain investors will be addressed) but there could be a window in which these groups are hamstrung by a lack of access to thick records.
The proposed model is ICANN’s attempt to bring Whois policy, which is enforced in its contracts with registries and registrars, into line with GDPR, the European Union’s General Data Protection Regulation, which kicks in fully in May.
The model would apply to all gTLD domains where there is some connection to the European Economic Area.
If the registrar, registry, registrant or a third party processor such as an escrow agent is based in the EEA, they will have to comply with the new Whois model.
Depending on how registrars implement the model in practice (they have the option to apply it to all domains everywhere) this means that the majority of the world’s 188 million gTLD domains will probably be affected.
While GDPR applies to only personal data about actual people (as opposed to legal persons such as companies), the ICANN model makes no such distinction. Even domains owned by legal entities would have their records anonymized.
The rationale for this lack of nuance is that even domains owned by companies may contain personal information — about employees, presumably — in their Whois records.
Domains in ccTLDs with EEA connections will not be bound to the ICANN model, but will rather have to adopt it voluntarily or come up with their own ways to become GDPR compliant.
The two largest European ccTLDs — .uk and Germany’s .de, which between them account for something like 28 million domains — last week separately outlined their plans.
Nominet said that from May 25 it will no longer publish the name or contact information of .uk registrants in public Whois without their explicit consent. DENIC said something similar too.
Here’s a table of what would be shown in public Whois, should the proposed ICANN model be implemented.
[table id=50 /]
The proposal is open for comment, with ICANN CEO Goran Marby requesting emailed input before the ICANN 61 public meeting kicks off in Puerto Rico this weekend.
With just a couple of months left before the law, with its huge fines, kicks in, expect GDPR to be THE hot topic at this meeting.

Tagged: , , , , , ,

Comments (5)

  1. Joe says:
    March 5, 2018 at 8:04 pm

    Of all the ways this could have gone, this seems like a fair compromise.

    Reply
  2. Eric Lyon says:
    March 5, 2018 at 9:02 pm

    I’m looking forward to this change. 🙂 – The downside is that the added anonymity might make it more difficult for buyers to uncover scammer/thieves when they can’t check/compare whois ownership. However, they would still have the email option, so that works in their favor.

    Reply
  3. Mark Thorpe says:
    March 6, 2018 at 1:20 am

    I emailed ICANN my opinion.
    No domain name whois personal Information should be blocked.

    Reply
    • ducduc says:
      November 17, 2018 at 6:49 pm

      Frankly, I don’t want just anyone to see my information. The only case would be a possible buyer of my domains or websites.

      Reply
  4. JZ says:
    March 6, 2018 at 2:44 am

    I’m not a fan. Say goodbye to contacting people to buy domains. Will the forwarding work? Who is handling the forwarding of 100 million domains?
    I will opt out for sure but how do you do this? Will you have to do it manually for every domain? Each registrar will have their own method? Sounds like its going to be another not needed mess. Thanks Europe.

    Reply

Add Your Comment