Important Update: Afilias has since announced an update to their WHOIS plans. Please refer to the linked article for the latest information.

Afilias Leads the Way: Minimizing Public WHOIS Data in Response to GDPR

The digital landscape underwent a profound transformation on May 25, 2018, with the advent of the European Union’s General Data Protection Regulation (GDPR). This pivotal legislation, designed to empower individuals with greater control over their personal data, sent ripples across industries worldwide, including the domain name system. Among the most significant early responses came from Afilias, a major registry operator, whose decision to drastically reduce the personal data displayed in public WHOIS records marked a watershed moment for domain privacy.

For years, the internet community’s focus regarding GDPR’s impact on WHOIS data primarily centered on registrars. These entities, responsible for registering domain names, typically collect and manage registrant information. However, a substantial portion of top-level domains (TLDs) operates under a “thick WHOIS” system. In this model, the registry — the organization that manages the registration of domain names under a specific TLD — also maintains the personal data of registrants, often mirroring or supplementing the information held by registrars. This structure placed a direct burden on registries like Afilias to re-evaluate their data handling practices in light of the new regulatory environment.

The GDPR Mandate and the WHOIS Conundrum

The General Data Protection Regulation (GDPR) is a comprehensive data privacy law that took effect across the European Economic Area (EEA). Its core objective is to protect the fundamental right to privacy and the protection of personal data for all EU citizens. GDPR introduces strict requirements for how personal data is collected, processed, stored, and displayed, emphasizing principles such as data minimization, purpose limitation, and accountability. Publicly displaying personal contact information — such as names, addresses, emails, and phone numbers — as traditionally mandated by WHOIS, directly conflicts with several key tenets of GDPR, particularly when the data subjects are natural persons residing in the EU.

The long-standing requirement for a publicly accessible WHOIS database was rooted in principles of transparency and accountability, intended to facilitate contact with domain owners for various reasons, including technical issues, legal disputes, and intellectual property infringement. However, in an era of heightened privacy concerns and sophisticated data harvesting, this transparency increasingly became a liability, exposing individuals to spam, identity theft, and unwanted solicitations. Afilias, as an Irish company, falls directly under the jurisdiction of the GDPR, compelling a decisive response to ensure compliance and protect the privacy rights of its registrants.

Afilias’ Bold Step: A New Era for WHOIS Data

In a landmark announcement made to its registrars, Afilias declared its intention to minimize almost all personal contact data from the public WHOIS records for its owned TLDs. Effective May 25, 2018, the same day GDPR became enforceable, Afilias-managed WHOIS records would no longer display any contact data whatsoever. Instead, the public display would be limited to operational technical data, such as registrar information, registration and expiration dates, and nameservers. This strategic move represented one of the most significant shifts in WHOIS data management in the history of the domain name system, setting a precedent for other registries and registrars globally.

Afilias articulated that this decision was a direct measure to address its compliance obligations under GDPR. While the traditional WHOIS often contained extensive details about the registrant, administrative contact, and technical contact, the new Afilias WHOIS output would be significantly streamlined. The change aimed to strike a critical balance: maintaining essential operational information necessary for the functioning of the internet while rigorously protecting the personal data of domain registrants.

To illustrate the extent of this change, Afilias provided a visual representation of the future WHOIS output:

This visual underscored the stark contrast with previous WHOIS displays, prominently showing the removal of personal identifiers and contact details, leaving only core technical and registrar-level information visible to the general public. This radical approach signaled a clear commitment from Afilias to prioritize data privacy in line with GDPR requirements.

Affected Top-Level Domains (TLDs)

The impact of this policy change was immediate and widespread across a significant portfolio of TLDs managed by Afilias. The list of Afilias-owned TLDs explicitly affected includes:

• .info
• .mobi
• .pro
• .poker
• .pink
• .black
• .red
• .blue
• .kim
• .shiksha
• .promo
• .lgbt
• .ski
• .bio
• .green
• .lotto
• .pet
• .bet
• .vote
• .voto
• .archi
• .organic
• .llc

Furthermore, Afilias indicated that other Afilias-supported TLDs would have the option to adopt this approach, creating a potentially varied landscape for WHOIS data across different extensions. This flexibility acknowledged the diverse operational models and compliance considerations for various TLD managers.

Implications for Key Stakeholders

Afilias’ decision created significant ripples, fundamentally altering the existing paradigm for various entities that rely on WHOIS data.

Law Enforcement Agencies (LEAs)

One of the most immediate and critical concerns raised by the minimization of WHOIS data was its impact on law enforcement agencies. Traditionally, LEAs have utilized public WHOIS records to identify individuals associated with malicious online activities, cybercrime, fraud, and other illicit behaviors. The removal of contact data presented a significant hurdle, potentially hindering investigations and increasing the complexity of tracing perpetrators.

While the initial assessment implied a severe impediment (“they’re screwed”), Afilias quickly reiterated its commitment to working constructively with LEAs. The registry expressed an intent to explore potential mechanisms to ensure that law enforcement agencies are not unreasonably restricted in their access to necessary WHOIS data. This commitment highlighted the ongoing challenge of balancing privacy rights with the imperative of public safety and security, necessitating the development of new, secure, and accredited access models for verified law enforcement requests.

Trademark and Intellectual Property (IP) Owners

Similarly, trademark and intellectual property owners have historically relied on WHOIS data to enforce their rights, investigate infringement, and combat cybersquatting. Without readily accessible contact information for domain registrants, the process of identifying and contacting alleged infringers becomes considerably more challenging. This situation left brand protection efforts in a state of uncertainty, requiring new strategies for dispute resolution and intellectual property enforcement.

Afilias acknowledged this challenge, stating that without an established “accreditation” mechanism for trademark and IP interests to access WHOIS data, public access would be eliminated. The registry indicated that access would only be reconsidered once a consensus emerged on a secure and compliant framework for such access. This stance underscored the need for the broader internet governance community to develop standardized, secure, and GDPR-compliant access protocols for legitimate legal interests, ensuring that privacy enhancements do not inadvertently create safe havens for illicit activities.

Registrars

For domain registrars, Afilias’ registry-level action had direct implications but also offered flexibility. Afilias stated that from a registry standpoint, this action would not impact registrars’ ability to continue transferring “thick data” – the full registrant information – to the registry. This meant registrars could continue their existing data collection and submission practices to the backend registry system. However, registrars were given the autonomy to similarly truncate their own public WHOIS display, aligning their practices with Afilias’ approach if they chose to do so. This provided registrars with the necessary flexibility to adapt their own public-facing services while maintaining the underlying data for their own operational needs and potential future accredited access mechanisms.

ICANN Compliance

Perhaps one of the most complex challenges for Afilias was navigating the conflict between its contractual obligations with the Internet Corporation for Assigned Names and Numbers (ICANN) and the new GDPR requirements. ICANN registry contracts traditionally mandated the display of full WHOIS data, a requirement directly at odds with GDPR’s strict privacy provisions. To address these potential contract compliance issues, ICANN itself had suggested to Afilias that a “local law exemption” could be sought.

As an Irish company, Afilias planned to consult with the Irish Data Protection Authority (DPA) and local counsel. The objective was to determine the best approach for applying local law (GDPR) to WHOIS output, effectively seeking a legal basis to override the ICANN contractual requirement for full public display. This situation highlighted a broader systemic challenge within internet governance, where international contractual frameworks sometimes clash with national or regional data protection laws, necessitating innovative legal interpretations and policy adjustments.

Country Code Top-Level Domains (ccTLDs)

The implications of GDPR extended beyond generic TLDs. Afilias also acknowledged that some of the country code Top-Level Domains (ccTLDs) it supported could be affected by GDPR, especially if they had registrants or registrars within the EU. The treatment of such cases by various national DPAs was unclear at the time. ccTLD operators were informed that they might or might not adopt the Afilias approach to WHOIS, and they might contact registrars separately regarding their specific policies. This further underscored the fragmentation of WHOIS data policy in the evolving regulatory landscape, with national laws and operator policies creating a patchwork of compliance requirements.

The Broader Context: Unresolved Issues and the Future of WHOIS

Afilias’ move, while bold and necessary, was just one piece of a much larger and evolving puzzle. The registry itself admitted that a host of other GDPR-related issues remained unresolved, requiring ongoing engagement and community dialogue. These included:

• Consent Management: The complexities of obtaining and managing explicit consent from registrants for the processing and public display of their personal data, especially given the dynamic nature of domain registrations.
• Natural vs. Legal Person Status: Distinguishing between individual registrants (natural persons protected by GDPR) and organizational registrants (legal persons, whose data may be treated differently), and how this distinction should be reflected in WHOIS.

The path forged by Afilias highlighted the urgent need for a new model for WHOIS — one that respects individual privacy rights while still providing legitimate access to data for specific, verified purposes. This ongoing discussion within ICANN and the wider internet governance community has since focused on the development of “tiered” or “gated” access models, where different levels of information are made available to different categories of users based on their legitimate interest and accreditation.

Conclusion: A Precedent for Privacy

Afilias’ decision to significantly minimize public WHOIS data in response to GDPR marked a seminal moment in the history of domain name management. It was a proactive and decisive step towards prioritizing individual data privacy in an increasingly regulated digital world. This action not only brought Afilias into compliance with a crucial European law but also set a powerful precedent for other registry operators and the entire domain industry.

While the immediate aftermath presented challenges for law enforcement and intellectual property owners, it also catalyzed critical discussions about developing new, secure, and compliant mechanisms for accessing domain ownership data. The era of unchecked public access to personal registrant information effectively ended, ushering in a future where transparency must be carefully balanced with the fundamental right to privacy. As the digital landscape continues to evolve, Afilias’ initial response stands as a testament to the profound and lasting impact of GDPR on how personal data is handled across the internet.