3

I used to get scammers ringing my phone because I didn't buy domain privacy. Being in the EU, Do I still need to buy this service if I dont want scammers and spam ringing my phone by looking up whois?

Thanks

  • 1
    Did you reach out to the registrar you bought the domain from to ask them to remove sensitive information out of the registration? I did that for one of my domains and I did not have to pay a thing, they removed the sensitive info right away. – Dakta Moriamé Jul 21 '19 at 12:46
1

They are two different things.

Typically, (it depends a little on the TLD), personal data is stored at two places: the registrar and the registry.

Typically, in gTLDs, there is a public whois server at the registry, and at each registrar, to get access to data. In ccTLDs instead it is often only at the registry.

In any way, a given source can send back only the data it has, or less, but not more. Of course now with the GDPR less and less data is published publicly by default, which means you get whois results like:

Registry Registrant ID: REDACTED FOR PRIVACY
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: Name.com Inc.
Registrant Street: REDACTED FOR PRIVACY
Registrant City: REDACTED FOR PRIVACY
Registrant State/Province: CO
Registrant Postal Code: REDACTED FOR PRIVACY
Registrant Country: US
Registrant Phone: REDACTED FOR PRIVACY
Registrant Phone Ext: REDACTED FOR PRIVACY
Registrant Fax: REDACTED FOR PRIVACY
Registrant Fax Ext: REDACTED FOR PRIVACY
Registrant Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.
Registry Admin ID: REDACTED FOR PRIVACY

But it remains that:

  • whatever data you give to a registrar may end up at registry also, per requirements (not true yet for .COM/.NET that remains a thin registry still, but that exception will disappear soon)

  • if you use some proxy/privacy service then the registrar will send that data (and not yours) to the registry: so even the registry will not know the "real data", and can technically not show anything else than the proxy/privacy service details. The registrar and its whois, can display what it wants.

They are caveats in both direction:

  • GDPR applies to EU citizens with also constraints on the providers (Wikipedia says: "The regulation applies if the data controller (an organisation that collects data from EU residents), or processor (an organisation that processes data on behalf of a data controller like cloud service providers), or the data subject (person) is based in the EU. Under certain circumstances, the regulation also applies to organisations based outside the EU if they collect or process personal data of individuals located inside the EU. "); this is certainly not worldwide. So whatever protection you can derive out of it will depend a lot on your citizenship/residency and which providers (both registrar and registry) you use; note that views diverge: Iceland (in EEA but not in European Union, GDPR applies still) registry decided to continue publishing everything in whois, seeing no disagreement about that and GDPR, see http://domainincite.com/22939-iceland-breaks-ranks-on-whois-will-publish-emails ; so based on which TLDs you register domain names in, you can get very different results in whois output... (things will change a little soon with RDAP providing a uniform output format, but that still does not solve the problem on what to give as data to whom)
  • you have to trust the privacy/proxy service you use, be it your registrar or not. It has first to work correctly and hide your identity (but will probably revert things to you as soon as a dispute is coming), and even that sometimes breaks (like providers first creating the domain with your data, then switching to proxy contact; this could as well be user errors not selecting both service at domain creation). Of course for the external world, that service is the real owner of the domain, and it controls emails delivery to contact and so on... technically it could steal your domain without problems. There are also consequences for transfers between registrars.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.