Hide Domain Registration Details From WHOIS

To hide domain registration details, check what your record shows today, then use the registrar's redaction or a privacy service for a generic domain such as .com, and the registry's own rules for a country-code domain. Since 25 May 2018, ICANN's rules have had registrars and registries redact personal fields on generic domains, first under a temporary specification and, since 21 August 2025, under a policy that requires redaction where applicable law does. What you see still depends on the registrar and the extension, and redaction does not recall copies already taken.

A domain record can tie a name, a postal address, a phone number and an email address to a website. This guide explains what each field exposes, what ICANN's documents say is published, what stays public for four country-code registries, how to check your own record, and what to do about copies stored elsewhere.

This is information, not legal advice. Every rule below is labeled by the organization whose page we read, and a rule from one registry is never the rule for another. Pages change, so confirm the wording before you act.

What a domain registration record exposes about you

A domain registration record exposes whoever the registrar listed as the holder: usually a name, a postal address, a phone number and an email address, plus the registrar, the creation and expiry dates and the nameservers. The first four identify you. The last three describe the domain.

Each personal field does a different kind of damage. A name connects a pseudonymous project to a person. A postal address is the most serious, because it places a person at a physical location. A phone number invites unsolicited calls. An email address attracts spam and phishing, and one address reused across accounts lets a stranger connect them.

Related readRemove Bankruptcy From Search Results: What Can Go

What you type into the registrar's form is only the starting point. What is published depends on the policy that applies, the registrar's settings and whether anyone copied the record, and the rest of this guide separates those three.

How ICANN's temporary specification and RDAP changed WHOIS

ICANN's Temporary Specification for gTLD Registration Data took effect on 25 May 2018, and it is the reason most generic-domain records stopped showing personal data. The ICANN Board adopted it on 17 May 2018, in response to the European Union's General Data Protection Regulation (GDPR).

The specification told registrars and registries to treat these registrant fields as redacted unless the holder consented to publication: name, street, city, postal code, phone and fax. Admin and tech contacts were treated the same way, and the registrant email was replaced with an anonymized address or a web form. It kept a route for third parties with a legitimate interest to ask for hidden data, subject to a balancing test against the holder's rights.

A second change concerns the protocol. ICANN announced on 27 January 2025 that the Registration Data Access Protocol (RDAP) would replace WHOIS as the definitive source for gTLD registration data from 28 January 2025, with WHOIS services for gTLD registries and registrars sunsetted on that date. ICANN's announcement of RDAP replacing WHOIS says ICANN-accredited registrars and gTLD registries have offered RDAP since 2019, and it points users to lookup.icann.org for queries. People still say "WHOIS" for the lookup, but for generic domains the data is now served through RDAP.

The third change is the policy that replaced the temporary specification. ICANN's Registration Data Policy page says the consensus policy is effective on 21 August 2025, with a transition period from 21 August 2024 to 20 August 2025 in which contracted parties could follow the temporary specification, the new policy or a mix.

Related readRemove Your Date of Birth From the Internet

25 May 2018ICANN's Temporary Specification takes effect and gTLD personal fields start to be redacted

28 Jan 2025RDAP becomes the definitive source for gTLD registration data and gTLD WHOIS services are sunsetted

21 Aug 2025The Registration Data Policy becomes effective for gTLD registrars and registries

Dates from ICANN's Temporary Specification, its 27 January 2025 announcement and its Registration Data Policy page, all read for this guide.

What a generic domain record shows under the Registration Data Policy

Under ICANN's Registration Data Policy, a registrar or registry must redact registrant name, street, postal code and phone where applicable law requires redaction, and may choose to redact in other cases. Redaction is mandatory in some situations and optional in others, which is why two registrars can show different amounts for the same kind of owner. ICANN's Lookup tool post says the same: redaction varies across registrars and registry operators. The table summarizes the policy text, not any registrar's settings.

Three consequences follow. First, a redacted record still tells a reader your country and state or province. Second, the organization field is a common leak: a person who typed a company name sees it protected, while a person who typed their own name there may see it published if they or the registrar chose to. Third, the policy lets a party consider whether the holder is a legal person but does not require it, so a company is not automatically treated differently from an individual.

Unredacted data is available only on request. The policy describes case-by-case disclosure requests with responses due within 30 calendar days of acknowledgment, and ICANN's January 2025 announcement points requesters to its Registration Data Request Service or to the sponsoring registrar. Redaction blocks casual lookups. It is not secrecy from a lawful request.

Registrar redaction, privacy service or proxy service: which one hides you

Redaction is applied by the registrar to the public record. A privacy service replaces your contact details with the provider's. A proxy service makes the provider the legal holder.

ICANN's own pages define the two services. In a privacy service, the domain holder remains the registrant of record and alternate contact information is published in place of the home address. In a proxy service, the provider becomes the registered name holder of record and its own identity and contact details appear in the record. With a proxy, your rights over the domain depend on the contract you signed.

Related readHide Your Employer Online: Source-by-Source Routes

ICANN's privacy and proxy page also says the 2013 Registrar Accreditation Agreement requires providers to disclose their service terms, including pricing, to publish an abuse or infringement contact and to disclose business contact information. Read a provider's terms before relying on it. For names using an affiliated or accredited privacy or proxy service, the Registration Data Policy requires the full registration data of that service to be published, which may include a pseudonymized email.

We state no registrar's price or inclusions here: terms change, and a service may still need to be switched on in the control panel.

What stays public for country-code domains

Country-code domains are not covered by ICANN's gTLD policy. Each registry sets its own rules, and the published fields differ. The four below are labeled by the organization whose page we read, and none is a universal rule.

.uk (Nominet)

According to the Nominet registrars page read for this guide, the .UK WHOIS does not show the registrant's contact name or address by default. A registrant can consent to disclosure by choosing which fields to publish: the organization only, the address only, or both. If no organization is given, the contact name is used as the registrant, so disclosing the organization then displays the individual's name. That detail catches people who tick "show my organization" and expect a company name.

Nominet's 2018 announcement of its GDPR proposal said the searchable WHOIS would no longer include name and contact details from 25 May 2018, and that third parties with a legitimate interest could request data under its data release policy. A 2015 Nominet policy page described an earlier regime, as a plan taking effect on 1 September 2015, in which an individual not using the domain for trading could opt out of publishing a contact address. Both pages are dated history. A .uk record from before the 2018 change may therefore have shown more.

Related readHide Your Home Address on Company Registers

.eu (EURid)

EURid's GDPR page says the web-based WHOIS shows only the email address and language of a natural person who holds a .eu domain. For a legal person it shows the company name, city, region, country, email address and language. EURid also provides a request form for third parties who want personal data on the basis of a legitimate interest, and says it checks each request. For an individual, the practical task is the email address: use a dedicated mailbox.

.us (Registry Services, LLC)

The usTLD privacy policy, effective 14 March 2023, says the registry must publish registrant data in the public WHOIS at whois.us because of United States policy and its agreement with the Department of Commerce. The same page lists name, postal address, email address, telephone number and fax number among the data it collects, but it does not say which of those whois.us displays, so look up a .us domain to see. The usTLD privacy services policy, updated on 29 August 2019, says registrars, resellers and their partners may not offer anonymous or proxy registration services that stop the registry from having and displaying the true and accurate data. A .us domain therefore cannot be hidden behind a privacy service as the policy reads. If a public record is unacceptable, the realistic choice is a different extension.

.au (auDA)

The auDA WHOIS Policy (number 2025-11 on the page read) says street address, telephone and fax numbers are not published. It does publish the registrant's name and registrant ID, plus eligibility details. A contact name and email also appear, with the email on the web WHOIS only, not on port 43 or RDAP. Clause 4.3 says the registrant must give a contact email but need not use a personal one. The page lists more than one approval date in its version history, so check the current version. We did not review other public registers that may be searchable by ABN.

Related readProtect family privacy online from your public profile

Which route fits which domain: a decision table

The right route depends on the extension and on whether the domain belongs to a person or a business. Treat this as a first pass and confirm each point at the source.

For a business domain, publishing a registered company name and a working role mailbox can build trust, where hiding everything may read as evasive. That is a judgment, not a rule from the sources.

How to check your own exposure

Check before you change anything, and compare the public record with the one in your registrar account.

1. Look up the domainFor a generic domain, use ICANN's Lookup tool at lookup.icann.org, which uses RDAP. For a country-code domain, use that registry's own lookup, such as whois.us for .us.
2. Read every fieldNote whether the name, organization, address, phone and email are redacted, a relay, or real. Check the organization field first, since it is a common leak.
3. Compare with your accountOpen the contact settings at your registrar and see what is stored. The public record can differ from the stored one.
4. Search the detailsSearch for your name, your phone number and your email address together with the domain name in more than one search engine, to find sites that republish records.
5. Save dated evidenceTake dated screenshots of what you found, with the URL of each copy. You will need them for any removal request.
6. Change the source firstFix the registrar record, then request removal from copies. Doing it in the other order leaves the source feeding new copies.

ICANN's 2019 Lookup tool post links complaint forms for inaccurate data and for service outages. Where law does not require redaction, it is the registrar's decision, so a record that shows your city may be within the rules.

Archived and third-party copies of an old record

A change at the registrar does not reach copies that others have already stored. The ICANN documents read for this guide govern registrars and registries, not the owners of such copies, and each owner has its own rules.

Copies can sit in three places: web archives and search results that stored an old lookup page, any other site or database whose owner saved an old record, and private copies that no process can recall.

The Internet Archive's help page says a request to exclude material from web.archive.org is made by emailing the team with the URL or URLs, the time period to be excluded, the time period during which you controlled the site or account, and anything else that helps them understand the request. It does not promise an outcome beforehand, and it refers copyright claims and intimate images to separate processes. For any other site that republishes records, we did not read its policy, so look for its own help or contact page for a removal route and be ready for a refusal.

Related readRemove my photos from face search engines

A scenario, invented for illustration: a freelance illustrator registered a .com years ago with a home address. She turns on redaction, but a web archive and a site that republished the old record still show the address. She keeps dated screenshots and asks each owner to remove the page. One copy goes and one request is refused, which is a plausible mix.

A realistic order and timeline for hiding a domain record

The order is source, then copies, then monitoring. In our experience, a change at a registrar usually appears in public lookups within a day or two, while third-party copies take weeks and some never go. These are ranges from practice, not promises.

Check the record again after a renewal or a transfer, since settings are the registrar's to apply.

The next step if your details are exposed now

Start with the audit, fix the source, then work through the copies. Anything that exposes a home address comes first.

Questions people ask

Is WHOIS still public after GDPR?

Yes, but with less personal data on most generic domains. ICANN's policies require redaction of name, street, postal code and phone where applicable law requires it, and registrant country and state or province remain published. Country-code registries set their own rules: some hide addresses, and the .us registry says it must publish registrant data. Check the extension.

Does a privacy service make me anonymous?

Not fully. A privacy service publishes the provider's details in place of yours, but you remain the registrant of record, and the provider's terms say when it forwards messages or reveals your identity. Providers publish terms on when they reveal a customer, so read them first.

Can I hide my .us domain details?

Not through a privacy service. The usTLD privacy services policy says registrars and resellers may not offer anonymous or proxy registration that stops the registry displaying true data, and the registry says it must publish registrant data. If you cannot accept a public record, the realistic option is a different extension.

Why does my organization name show up in a redacted record?

Under ICANN's Registration Data Policy, redaction of the organization field is optional, and the registrar must publish it if the holder agrees. If you typed your own name in the field, your name is published whenever it is shown. Change the field, or ask the registrar not to publish it.

Can someone still find who owns my domain?

Sometimes, through a lawful request. This is the route for people with a real need, such as a rights holder or investigator. ICANN's policy describes case-by-case disclosure requests, and Nominet and EURid run their own request processes for people with a legitimate interest. Redaction stops casual lookups, not a justified request.

Do old WHOIS records disappear when I turn on privacy?

No. Redaction changes the live record only. Archived pages, historical data services and private copies keep what they stored. Ask each copy's owner to remove it, expect some refusals, and run the lookup and searches again after a month to catch new copies.