When you register a domain, ICANN requires registrars to collect your real contact details: name, address, email address, and phone number. Historically, this information was published in a public database called WHOIS anyone could look up who owns any domain.
Domain privacy protection (also called WHOIS privacy, WHOIS guard, or privacy proxy) replaces your personal details in the public WHOIS record with substitute contact information from a privacy proxy service. Your real details are still held by the registrar (they are required to keep them) but are not publicly visible.
What WHOIS exposes without privacy protection
Before privacy protection became common, a WHOIS lookup on any domain could reveal:
- The domain owner’s full name
- Home or business address
- Email address
- Phone number
- Domain registration and expiry date
This data is harvested by:
- Spammers building targeted email and phone lists
- Domain hijackers who use personal details to impersonate owners in support calls
- Phishing attackers who craft targeted scams using the registrant’s name and contact info
- Competitors researching your domain portfolio and registration timing
What privacy protection does
With privacy protection enabled:
- WHOIS shows the registrar’s or proxy service’s contact details, not yours
- The privacy proxy email forwards legitimate correspondence to you (domain renewal notices, legal notices)
- Your real home address and personal email are not publicly associated with your domain
What privacy protection does NOT do:
- It does not prevent law enforcement or legal process from obtaining your real details from the registrar
- It does not hide ownership from ICANN or the registry
- It does not provide anonymity if you become party to a domain dispute (the Uniform Dispute Resolution Policy can compel disclosure)
- It does not protect you from a registrar data breach
Which registrars include privacy free
| Registrar | Privacy included? | Cost if not included |
|---|---|---|
| Cloudflare Registrar | Yes, free permanently | N/A |
| Namecheap | Yes, free (WhoisGuard) | N/A |
| Porkbun | Yes, free permanently | N/A |
| Squarespace Domains | Yes, free | N/A |
| GoDaddy | No | £7–10/yr extra |
| Ionos | No | £1–3/yr extra |
| 123-reg | No | £5–7/yr extra |
The implication for cost comparison: Any registrar that charges for privacy should have that cost added to their renewal price before comparison. A GoDaddy .com at £21.99/yr renewal + £8/yr privacy = £29.99/yr effective cost vs Namecheap at £10.88/yr with privacy included.
The 2018 GDPR change
GDPR (General Data Protection Regulation) changed WHOIS in the EU. Since May 2018, European registrars have been required to redact personal data from public WHOIS for EU registrants, even without privacy protection being explicitly enabled.
What this means in practice:
- EU-registered individuals get some privacy protection by default due to GDPR compliance
- The registrar still holds the data internally; it’s just not publicly displayed
- Non-EU registrars may still display EU registrant data publicly if they don’t comply with GDPR
Despite GDPR coverage, enabling explicit privacy protection is still recommended:
- Ensures coverage across all registries, including those outside GDPR scope
- Applies to .com and other gTLDs managed by US-based organisations
- Provides a clear privacy proxy rather than relying on registrar-level redaction
Business vs personal registrations
For business domains registered in a company name at a business address, the privacy calculus is different:
- The business address and company name are already publicly available through Companies House (UK) or equivalent registries
- WHOIS privacy on a business domain primarily protects the email address and direct phone number from harvesting
For sole traders and individuals registering domains at home addresses, privacy protection is essential. Your home address should never be in a public WHOIS record.
See also: WHOIS explained · Domain renewal trap · Namecheap vs GoDaddy