Domain WHOIS Privacy and GDPR: What It Really Protects and When to Skip It
By Thomas Lovas Lokoy — researched and drafted with AI assistance, then fact-checked and approved by Thomas before publishing · Editorial policy
WHOIS privacy is a service that replaces your name, address, email and phone number in the public registration record with the details of a proxy, while you stay the legal owner of the domain. Since 21 August 2025 much of that data is hidden anyway: ICANN's Registration Data Policy makes registrars redact the registrant's name, street address, postcode and phone number wherever data protection law applies, and many redact every record. So the first job is to look up your own domain and see what is already hidden. The paid add-on is worth having in a few specific cases, which this page lists, and it is a line you can strike off the invoice in the rest.
The one-line version
Two completely different things can hide your details in a domain lookup, and only one of them is something you buy. Confusing them is why people either pay for privacy they already have, or assume they are hidden when they are not.
What a privacy service actually does
When you register a domain you hand the registrar a name, a postal address, an email address and a phone number. Some of that has historically been published in the public registration record, the thing everyone still calls WHOIS, and which is increasingly served by its successor protocol, RDAP.
A privacy service, sold as WHOIS privacy, domain privacy, ID protection or a dozen other names, replaces the published values with the details of a proxy the registrar operates. Your name comes off. A forwarding address goes on. A relay email address goes on, usually one that forwards genuine mail to you and drops the rest.
You remain the registrant. This is the part people get wrong. The proxy appears in the public record; it does not own your domain. You keep the legal registration, the right to renew it, the right to move it and the right to sell it. If a privacy provider ever behaves as though it owns the name, you are dealing with a badly designed service, not with how privacy is supposed to work.
The other thing that hides your data, which you do not buy
Separately from any paid service, data protection law means that a great deal of registration data is simply not published any more. ICANN's Registration Data Policy, in force since 21 August 2025, requires registrars to redact the registrant's name, street address, postcode and phone number wherever data protection law applies, lets them redact more widely for "a commercially reasonable purpose", and replaces the registrant email with an anonymised address or a web form. Requests for the underlying data go through a disclosure process rather than an open lookup. What stays public regardless is the registrar, the dates, the status codes, the nameservers, and your state or province and country; what a WHOIS record shows lists every field.
The practical consequence: look up your own domain before you pay for anything. If the public record already shows redacted fields and a role-based contact rather than your name, a privacy add-on is buying you a smaller increment than the sales page implies.
The size of that increment varies by registry, by registrar, by whether you registered as a person or a company, and by where you are. It is not a constant, and anyone who tells you it is has not checked.
Redaction, privacy service, neither: what a stranger sees
The difference is easiest to see field by field. The middle column is what the policy's redaction rules produce (sections 9.1 and 9.2, read on 16 October 2026); the right-hand column is what section 9.2.5 requires when a privacy or proxy service is used, namely that the registrar "MUST Publish the full Registration Data of the Privacy or Proxy Service".
| Field | Redacted record | Record with a privacy service |
|---|---|---|
| Your name | Shown as redacted | The privacy service's name |
| Street, postcode, phone | Shown as redacted | The privacy service's address and phone |
| City | May be redacted | The privacy service's city |
| State/province and country | Yours, published | The privacy service's |
| Organisation | Published only if you agree | The privacy service's |
| An anonymised address or web form | The service's relay address | |
| Registrar, dates, status codes, nameservers | Published | Published |
Two things follow. A redacted record still tells a stranger your country and usually your state or province; a privacy service hides even that. And neither column changes the bottom row: the registrar, the dates and the nameservers stay public whatever you pay for.
Who includes it and who charges
Registrars package this differently, and the price that matters is the one that recurs. On 16 October 2026 the registrars' own pages said:
| Registrar | Privacy service | Source |
|---|---|---|
| Porkbun | Free WHOIS privacy listed with every domain | porkbun.com |
| Cloudflare Registrar | Personal data redaction "for free" | Cloudflare docs |
| Dynadot | Free domain privacy listed on its price page | dynadot.com |
| EuroDNS | Paid add-on, listed at EUR 5.00 a year | eurodns.com |
Our own registrar data also lists free privacy at Namecheap and Spaceship; both block automated page reads, so check their checkout before relying on it.
A worked example. Five domains held for five years with a EUR 5.00-a-year add-on cost 5 × 5 × 5.00 = EUR 125.00 in privacy fees alone, on top of the registrations. At a registrar that includes it, the same line is zero. The fee is per domain, so it scales with exactly the kind of portfolio that most wants privacy. If a registrar charges for it, set that against whatever else the registrar does better; our EuroDNS review is an example of where a paid add-on can still be worth it for other reasons.
What privacy does not do
This is the honest section, and it is the reason to read the whole page rather than the first heading.
- Your registrar still holds your real data. It has to. It bills you, it verifies you, and under the 2013 Registrar Accreditation Agreement it must verify your email address or phone number, and if you do not respond within fifteen days it must verify manually or suspend the domain.
- It is not a shield from legal process. Courts, law enforcement and legitimate rights-holder requests go through a disclosure route that every registrar must link from its homepage. Privacy raises the effort required; it does not remove the path.
- It does not hide your hosting. DNS records, IP addresses, mail server names, TLS certificate transparency logs and the site's own content are all public and all separate from the registration record. Plenty of "anonymous" domains are trivially attributable from a certificate log; how to find the owner of a domain shows the routes.
- It does not stop the emails you actually need. Renewal notices, transfer approvals and verification messages still have to reach you. If a relay silently eats one of those, you can lose a domain. Check that the relay forwards, and check the mailbox behind it.
- It is not the same as a registry that publishes little. ICANN's policy covers generic extensions such as .com; each country-code registry sets its own publication rules, and some publish more about organisations than about individuals. That is a property of the extension you chose, not of anything you bought.
When it is worth having
Enable it if any of these describe you:
- You registered with a home address and a personal mobile number. This is the strongest case by a distance. The record is not just contact data; it is where you live.
- You are a sole trader or freelancer where the business address and the home address are the same address.
- You hold many domains and would rather they not be trivially clustered under one identity, for a rebrand, a stealth launch, or simply because a portfolio is a target list.
- You work somewhere exposure has consequences: journalism, law, healthcare, domestic-abuse support, political organising, anything where a name plus an address is a risk rather than an inconvenience.
- You are about to negotiate a purchase and do not want the seller to price you by looking you up.
- You do not want your state or province in the public record, which redaction alone still publishes.
When to skip it
- You are an established company publishing a company address. Your registered address is already a matter of public record in most jurisdictions. Hiding it in the domain record buys nothing and costs a little credibility with the small share of people who check.
- The record already publishes almost nothing for your registrant type. Look first, then decide.
- The service is a paid add-on you would be buying twice. Some registrars include it; some charge for it; some renew it at a different price from the introductory one. Read the line item.
- You need the record to be verifiable. A few contexts, such as certain partnerships, some advertising platforms and some payment onboarding, go easier when the domain visibly belongs to the company that says it does. The policy lets you consent to publishing your organisation name for exactly this reason.
What to check before you pay
Work through this at the checkout, not afterwards:
- Is privacy included or extra? If extra, what does it cost at renewal, not at signup? The introductory price and the standing price are different numbers and only one of them recurs.
- Does the relay email forward reliably, and does it forward transfer and renewal notices in particular?
- Can you turn it off temporarily without a support ticket? You will need to, at least once, during a transfer or a sale.
- What is the provider's disclosure policy? A one-line "we comply with legal requests" is normal. A provider that will hand over your data on an unverified complaint is not.
- If you later transfer the domain, does the privacy service travel with it, or does your data become public for the days in between? Turn privacy off deliberately, transfer, and turn the new registrar's service on; the domain transfer guide covers the order of steps.
The counter-argument, stated fairly
There is a real case against privacy that is worth hearing. A published, accurate registration record is how the domain system was supposed to work: a name attached to someone accountable for it. Every layer of proxying between a domain and a human makes fraud investigation slower and makes it easier for the same bad actor to run a hundred names.
If you are running a business that asks strangers for money, some transparency is an asset. "Who is behind this site" is a question buyers do ask, and the answer "nobody will say" is not a great one. The honest position is that privacy is right for people and often wrong for companies, and that the marketing which sells it as universally necessary is selling an add-on, not giving advice.
If you already registered without it
Nothing is unrecoverable. Turn privacy on at your registrar, as most let you do it retroactively, and understand that the previous record may persist in third-party lookup archives for a long time. Those archives are not under your registrar's control and cannot be recalled.
Then change what actually matters going forward: use a role address rather than a personal one, use a business address if you have one, and use a phone number you are willing to have known. Privacy is a lot easier when there is less to hide in the first place.
Where to go next
Run our WHOIS lookup on your own domain first; it shows exactly which fields are already redacted. If you are choosing where to register, our domain privacy protection guide goes deeper on how registrars package and price this, and Porkbun vs Namecheap compares two registrars that include it. If the reason you are reading this is that you are worried about losing control of a name, privacy is the smaller half of that problem; how to protect a domain from hijacking is the other half, and the more important one.
Frequently asked questions
Do I still need WHOIS privacy after GDPR and the 2025 redaction rules?
Often not. Since 21 August 2025 ICANN's Registration Data Policy makes registrars redact your name, street address, postcode and phone number wherever data protection law applies, and many redact every record. Redaction still publishes your state or province and country, though, and a privacy service hides those too. Look up your own domain before deciding.
Does WHOIS privacy make me the owner of record, or the privacy company?
You stay the registrant, with the right to renew, transfer and sell the domain. The privacy service only appears in the public record, which section 9.2.5 of the policy requires to show the service's details in place of yours.
Can someone still find out who owns a domain with privacy turned on?
Through the record alone, rarely. But the registrar holds your real data and discloses it to lawful requests, and hosting, DNS, certificate logs and the website itself are separate public sources that privacy does not touch.
How much does WHOIS privacy cost?
At many registrars nothing: on 16 October 2026 Porkbun, Cloudflare Registrar and Dynadot all listed it free on their own pages. EuroDNS listed it as an add-on at EUR 5.00 a year per domain, which over five domains and five years is EUR 125.00.
Should a company turn on WHOIS privacy?
Usually not. A company's registered address is normally public already, and a visible organisation name helps with partnerships, advertising platforms and payment onboarding. The policy lets a registrant consent to publishing its organisation name for that reason.
Sources
Last updated:
