To retire the outdated Whois privacy argument in cybersquatting disputes — It’s time
It’s 2024. UDRP Complainants must stop making an argument that’s no longer true.
John Berryhill won another UDRP this stretch. While there’s a lot I could write regarding his successful defense (pdf) of the domain name transco.com, I want to focus on one of the Complainant’s arguments that bothers me.
Many complainants argue that the registrant’s use of Whois privacy suggests they registered the domain in bad faith. Transco Railway Products Inc. made that argument in this case.
There might have been a time when this argument had some inkling of truth, but that was a long, long time ago.
Ever since the European Union’s GDPR regulation went into effect in 2018, most registrars have added Whois privacy by default.
Yet complainants still say Whois privacy suggests the domain owner is trying to hide their identity since they’re up to no good.
I imagine complainants are just checking a box of all of the possible reasons a domain owner could be found to have registered a domain in bad faith. But throwing a flawed argument into a case ought to hurt the case.
In the case for transco.com, the panel wisely noted this:
The Panel has considered and found unconvincing the Complainant’s argument that the Respondent’s use of a privacy service when registering the disputed domain name evidences bad faith. The utilization of a privacy service is a standard, if not default, feature of contemporary domain registrations.
This is the first time I’ve seen a panel succinctly make this point; more panels ought to do so.
I reached out to Berryhill to ask him what he wrote regarding Whois privacy in the response. He provided this excerpt from his response:
The WHOIS argument is a relic of UDRP days gone by. The last major update to the UDRP Rules was in 2013, in which UDRP Rule 4(b) was expressly amended to what is now the common practice:
“Any updates to the Respondent’s data, such as through the result of a request by a privacy or proxy provider to reveal the underlying client data, must be made ahead of the two (2) business day period concludes or ahead of the Registrar verifies the information requested and confirms the Lock to the UDRP Provider, whichever occurs first.”
The registrar has complied with UDRP Rule 4(b) and the Respondent has complied with its obligation to provide accurate contact information. The UDRP Rules have been that way for over ten years now, and it is time to retire this silly argument, particularly in view of the fact that many registrars now provide no choice in the matter and automatically apply the ICANN Temporary Specification implementation of GDPR to all domain registrations by default.
Amen.
