The question is not new. In 2015, ICANN was reviewing procedures for situations where WHOIS requirements conflicted with national privacy laws. Since then, the rules and technology used to publish domain registration data have changed significantly.
Today, RDAP is the primary protocol for accessing generic top-level domain (gTLD) registration information. Personal contact details may be redacted from public results, while registrars must still collect and maintain the information required by applicable policies.
For domain owners, the important distinction is between information that is publicly visible, information withheld under registration-data rules, and information protected through a separate privacy or proxy service.
If you're registering a domain, you can review NiceNIC's Domain Privacy options to understand the protection available for eligible extensions. The exact treatment of registration data depends on the domain extension and its applicable rules.
Why Did WHOIS Conflict With Privacy Laws?
WHOIS was originally designed to provide access to information about domain registrations. For many years, public lookup results could include the registrant’s name, organization, postal address, telephone number and email address.
This created an ongoing conflict between the need for reliable registration information and national laws protecting personal data.
In 2015, ICANN’s Implementation Advisory Group on WHOIS Conflicts with National Law examined improvements to procedures for handling those conflicts. Its report was published on October 5, 2015, and the resulting work contributed to later revisions of ICANN’s conflicts procedure.
The issue was not simply whether WHOIS should exist. It was how registrars and registries could comply with their contractual obligations when local privacy laws restricted the collection, publication or disclosure of personal information.
ICANN revised the procedure in 2017 and subsequently updated it to reflect its broader Registration Data Policy framework.
The current procedure is described in ICANN's Registration Data Directory Services Conflicts with Privacy Law.
That historical debate remains relevant, but the rules governing public registration data today are not the same as those discussed in 2015.
RDAP Replaced WHOIS as the Primary gTLD Lookup Protocol
On January 28, 2025, the Registration Data Access Protocol (RDAP) became the definitive source for delivering gTLD registration information, replacing the traditional WHOIS requirement for most gTLDs.
RDAP provides standardized, machine-readable registration information and supports secure access, internationalized data and differentiated access to registration records.
The term “WHOIS” remains common in domain search tools and registrar products. Some legacy WHOIS services also remain available. However, for current gTLD registration data, users should rely on RDAP-based sources.
ICANN provides a free Registration Data Lookup Tool for checking public gTLD registration information.
What Information Can Still Be Public?
Depending on the domain and applicable policies, public registration records may include:
- The domain name and sponsoring registrar.
- Registration, update and expiration dates.
- Domain status codes and nameservers.
- Relevant registrar contact information.
- Registrant information that applicable rules require or permit to be published.
Personal contact fields may be redacted, meaning the underlying information is not displayed in the public result.
For example, a lookup may show that a domain is registered and identify its registrar without revealing the registrant’s private telephone number or street address.
RDAP does not mean that all registration data is public. It also does not mean that the registrar stops collecting registration information.
Those are separate requirements.
What Does ICANN's Current Registration Data Policy Require?
ICANN’s Registration Data Policy took effect on August 21, 2025, replacing the Interim Registration Data Policy for gTLDs. The policy was subsequently revised in May 2026, including changes concerning urgent lawful disclosure requests.
The policy establishes requirements for collecting, processing, publishing and disclosing registration data.
Under its redaction provisions, registrars and registries must apply specified redaction requirements where necessary to comply with applicable law. The policy also permits redaction in certain other circumstances.
This means that public registration records do not necessarily contain every personal detail collected during registration.
For example, the registrant’s name, postal address, phone number and certain other contact fields may be withheld from public display under the applicable redaction rules.
At the same time, some information may remain visible, and publication requirements can differ by data element. Organization information and a registrant’s consent to publication can also affect what appears in the public record.
The complete requirements are set out in the ICANN Registration Data Policy.
For domain owners, the practical point is straightforward: public redaction is a registration-data policy mechanism, not proof that a separate WHOIS Privacy service has been purchased or activated.
Redaction, WHOIS Privacy and Proxy Services Are Not the Same
These three mechanisms are frequently discussed together, but they have different meanings.
1. Registration Data Redaction
Redaction means that specified registration data is withheld from public lookup results.
The actual registered domain holder does not change simply because their personal information is redacted.
Redaction may be required or permitted by applicable policy and law, even when the registrant has not subscribed to a separate privacy service.
2. WHOIS Privacy Services
A conventional privacy service allows the customer to remain the registered domain holder while using alternative contact information for permitted public registration fields.
For example, an eligible registration may use a privacy contact address instead of exposing the customer’s personal address.
NiceNIC offers free Domain Privacy for eligible domain extensions, subject to the applicable registry rules.
However, privacy-service availability should not be confused with registration-data redaction. Both can reduce public exposure, but they do so through different arrangements.
For a more detailed explanation of the service itself, see Free WHOIS Privacy Explained: What It Protects and What It Does Not.
3. Proxy Registration Services
A proxy service is legally different from a conventional privacy service.
Under a proxy arrangement, the proxy provider becomes the registered domain holder of record and allows the customer to use the domain under the relevant service agreement.
That distinction matters because the registrant of record has legal rights and responsibilities associated with the domain.
ICANN explains these arrangements in its official Privacy and Proxy Service Guidance.
A hidden contact record does not, by itself, tell you whether a domain uses redaction, privacy protection or a proxy registration arrangement.
Do the Same Privacy Rules Apply to Country-Code Domains?
Not necessarily.
ICANN’s Registration Data Policy applies to the gTLD registries and accredited registrars within its contractual scope. Country-code top-level domains (ccTLDs) generally follow their own registry policies and applicable local laws.
This can produce different results even when two domains are registered through the same registrar.
.CA: Individual and Business Registrants Have Different Rules
Canada’s .CA registry, CIRA, provides automatic WHOIS privacy protection for individuals registered under the relevant Canadian Presence Requirements categories.
However, non-individual registrants, such as businesses, may have different public-data treatment. Additional privacy options can depend on the registrar and applicable rules.
CIRA explains these distinctions in its official .CA WHOIS privacy guidance.
.UK: Registry Privacy and Disclosure Procedures
For .UK domains, Nominet follows its own policies for publication and release of registrant information.
Nominet states that it does not publish registrants’ personal information without their consent. It also provides procedures through which eligible third parties may request nonpublic information for legitimate purposes.
Those procedures are explained in Nominet's personal data release guidance.
These examples show why a general statement such as “all domains include WHOIS Privacy” can be misleading.
Some registries automatically restrict public exposure of personal information. Others distinguish between individual and business registrations or impose separate conditions on privacy and proxy services.
Before registering or transferring a ccTLD, verify the specific extension’s registration, publication and privacy requirements rather than assuming that gTLD rules apply.
Can Nonpublic Registration Information Still Be Disclosed?
Yes, under applicable legal and policy-based procedures.
Redaction and privacy protection do not make a domain registration completely anonymous or exempt it from lawful requests.
ICANN’s Registration Data Policy establishes requirements for reviewing requests for nonpublic gTLD registration information.
Requesters may include law enforcement authorities, intellectual property professionals, cybersecurity specialists and other parties with a legitimate interest in particular registration data.
ICANN’s Registration Data Request Service (RDRS) provides a standardized request mechanism for participating registrars.
However, submitting a request does not automatically entitle the requester to the information. The relevant registrar evaluates disclosure requests under applicable policies, privacy requirements and legal obligations.
NiceNIC publishes its own Request for Disclosure of Nonpublic Registration Data policy, explaining the process for relevant gTLD registrations and the information requesters must provide.
That process does not automatically extend to ccTLDs, which may follow different registry and legal requirements.
For a domain holder, the distinction is important: information can be withheld from public lookup services while remaining available to the registrar and potentially subject to lawful, case-by-case disclosure.
What Should Domain Owners Check Before Registration?
Domain privacy is not determined by the registrar alone. The domain extension, registry policy, applicable law and type of privacy arrangement all matter.
Before registering a domain, confirm whether its public registration details will be redacted automatically or whether a separate privacy service is available.
If the domain belongs to a business, also check how organization information is handled. Avoid assuming that rules for individual registrants will apply to corporate registrations.
After registration, review the actual public record using an appropriate lookup service. For gTLDs, ICANN Lookup provides an RDAP-based starting point.
If you are choosing an extension through NiceNIC, you can check domain availability and review the applicable Domain Privacy options before completing the registration.
Whatever the public record displays, keep accurate contact information with your registrar. Privacy protection does not remove registration verification requirements or responsibilities associated with domain ownership.
Domain Privacy Has Changed, but the Underlying Question Remains
The 2015 discussion about WHOIS and national privacy laws was part of a much longer effort to balance access to domain registration information with personal data protection.
RDAP has modernized how gTLD registration information is retrieved, while ICANN’s Registration Data Policy provides a framework for public data, redaction and lawful disclosure.
Privacy services and proxy arrangements remain separate concepts, and country-code domains continue to require attention to their individual registry policies.
For anyone registering or managing domains, the most useful question is no longer simply whether “WHOIS Privacy” is enabled.
It is which information is publicly visible, why it is visible or withheld, and which rules apply to the particular domain extension.
