What is WHOIS and what happened to it under GDPR?

WHOIS was a public database containing a domain owner's name, address, phone number and email. After GDPR arrived, much of that data disappeared from public view because registrant details count as personal data.

Why do most registrars now redact registrant information by default?

Most registrars began redacting registrant information by default to avoid compliance risks under GDPR. Access to full records now often requires a specific request rather than a simple lookup.

If I change my own privacy settings, will my WHOIS data become public?

Not necessarily, because registry WHOIS servers may redact data regardless of your own settings. What you see publicly can depend on the registry, the registrar and your own privacy choices.

What concerns did cybersecurity commentators raise about WHOIS redaction?

Cybersecurity commentators raised concerns in 2018 that losing open WHOIS data would make it harder to investigate abuse. The tension between accountability online and personal privacy is still the core of the debate.

GDPR WHOIS Redaction Explained: Ireland's DPC and Record Fines

Q: Why does Ireland's Data Protection Commission matter for GDPR enforcement?

GDPR enforcement often runs through the national regulator where a company has its European base, and for many large technology firms that regulator is Ireland's DPC. This is why the Irish authority shapes how the rules are applied to ordinary users' data far beyond Ireland.

For years, anyone could look up who owned a domain name. A name, an address, a phone number and an email sat in a public database called WHOIS. Then the EU's General Data Protection Regulation (GDPR) arrived, and much of that data disappeared from view. This post offers a GDPR WHOIS redaction explained in plain terms, looks at why Ireland's Data Protection Commission (DPC) matters so much for enforcement, and ends with practical steps for protecting your own domain details.

The starting point is a sourced case file published by Thank Your Robot, which covers how WHOIS went dark, Ireland's DPC confidentiality law, the LinkedIn fine and the largest DPC fines. The summary available to us is brief, so this article sticks to what that summary names and to reporting we have already published.

How GDPR turned WHOIS dark

WHOIS was built as an open directory. It lists the identity and contact details of a domain's registrant, which under GDPR counts as personal data when the registrant is an individual. Commentary from the period before GDPR took effect described a two-fold legal problem: the database was publicly accessible by design, and questions arose over who controlled it and on what legal basis the data was published.

The practical result, as one industry analysis from 2025 put it, is that most registrars began redacting registrant information by default to avoid compliance risks. Access to full records now often requires a specific request rather than a simple lookup.

There is a detail many site owners miss. A discussion on Cloudflare's community forum notes that registry WHOIS servers may redact data regardless of your own settings. In other words, what you see publicly can depend on several layers: the registry, the registrar and your own privacy choices. Redaction is therefore not always something you switch on or off yourself.

The change was not welcomed everywhere. Cybersecurity commentators raised concerns in 2018 that losing open WHOIS data would make it harder to investigate abuse. That tension between accountability online and personal privacy is still the core of the debate.

Why Ireland's DPC matters for enforcement

GDPR is an EU-wide law, but enforcement often runs through the national regulator where a company has its European base. For many large technology firms, that regulator is Ireland's DPC. This is why the Irish authority shapes how the rules are applied to ordinary users' data far beyond Ireland.

The Thank Your Robot case file also points to Ireland's DPC confidentiality law, a reminder that how a regulator handles its investigations, and what it can disclose about them, affects how transparent enforcement looks from the outside. We cannot detail the law's provisions from the summary, so check the original source for specifics.

For a view of the regulator's own priorities, our coverage of Ireland's DPC 2025 Annual Report summarizes the key compliance risks the commission flagged, based on a summary from law firm Arthur Cox.

What the record DPC fines show

The case file highlights the LinkedIn fine and the largest DPC fines. Those penalties show that GDPR is not just a paperwork exercise. Regulators can and do attach large financial consequences to how personal data is handled.

One example we have covered in detail: the DPC fined Google €403 million for improperly processing users' location data, after finding the company infringed GDPR through its handling of that data between 2018 and 2020. Read our report on how Ireland fined Google €403M over location data misuse for the specifics. We also looked at how the case exposed a tracking feature that was still live, which is a useful reminder that a fine does not automatically end a practice.

The common thread between WHOIS redaction and these fines is the same principle: personal data should not be collected, published or processed without a solid legal reason. Domain registrars responded to that principle by redacting. Large platforms are being asked to answer for it through penalties.

What This Means For You

If you own a domain as an individual, your name, home address, phone number and email could once have been visible to anyone. Redaction has reduced that exposure, but it is not a guarantee. As the Cloudflare discussion shows, the result depends on your registry, your registrar and your settings.

If you are simply an internet user, the DPC's record fines are a sign that regulators are willing to enforce data protection rules against very large companies. They do not remove the need for your own caution, but they do shape what companies are allowed to do with your data.

How to keep your domain registration details private

Check your registrar's privacy settings. Look for a domain privacy or WHOIS privacy option. Registrars such as HostGator describe it as a service that hides your personal contact information from the public WHOIS database.
Verify what is actually public. Run a WHOIS lookup on your own domain and see what appears. Do not assume redaction is on just because of GDPR.
Remember that settings and display can differ. Registry servers may redact data even when your registrar's privacy feature is disabled, so a redacted result does not prove your setting is active.
Use dedicated contact details. A separate email address and a business or forwarding address limit what could be exposed if redaction fails.
Keep your registrar record accurate. Privacy tools hide data from the public, but you still need valid contact details on file with your registrar.

Takeaways

A GDPR WHOIS redaction explained in one sentence: privacy law pushed domain registration data out of public view, and enforcement by regulators such as Ireland's DPC keeps the pressure on companies that mishandle personal data. Take a few minutes this week to check your registrar's privacy and redaction settings and confirm what a public lookup shows for your domains. Then read about the DPC's largest recent penalties, starting with our coverage of the Google €403M location data fine and the DPC 2025 annual report, to see how enforcement is shaping the protection of your data.