ع
The world’s largest domain registrar has mounted a legal challenge to directives from the Delhi High Court that seek to combat fake websites impersonating major brands by overhauling privacy practices for domain registrations. In more than 5,000 pages of appeal documents reviewed by Reuters, GoDaddy argued that removing default privacy protections would publicly disclose personal details of legitimate site owners and expose them to foreseeable privacy and security risks such as stalking and harassment. The company further contended that the global reach of domain names could compel it to apply the rules worldwide while it lacks any mechanism to evaluate claims of legitimate interest in data requests within the court-imposed 72-hour deadline.
According to a Reuters review of the non-public filings, one appeal document described the directives as commercially destabilising and suggested they may force domain companies to exit the Indian market altogether. The December ruling followed petitions from more than 20 companies including Amazon, McDonald’s, Microsoft, Xiaomi and Colgate-Palmolive against fraudulent sites, with the court blocking more than 1,100 such addresses and labelling them engines for large scale deception. Among the 14 measures introduced, the judge ordered that masking registration details should become a paid service since it had acted as a cloak for rogue operators.
National Crime Records Bureau figures show cyber crime cases registered in India rose from 52,974 in 2021 to 86,420 in 2023 while the government received 2.4 million complaints of alleged cyber fraud amounting to $2.4 billion last year. Home Minister Amit Shah stated this year that one person falls prey to cybercrime every 37 seconds in India and warned that lack of action risks turning the menace into a national crisis. Court documents indicate the order followed an unreported 59-page submission from the IT ministry voicing concern over domain name abuse and lack of stringent verification together with input from the home ministry that registration details should be readily available for investigations.
GoDaddy said in its appeal that stopping privacy-by-default features will result in public disclosure of name, address, telephone and email of legitimate website owners. New York-based internet governance researcher Farzaneh Badii said, “The people exposed will be journalists, activists, small business owners, and private individuals. The brand impersonators will not.” The company also argued that diluting the privacy feature runs contrary to India’s data protection law and the European Union GDPR mandate for privacy by default.
Company figures show GoDaddy manages 80 million domains for more than 20 million users and generates annual revenue of about $5 billion with India its largest emerging market region. Rivals Namecheap and a Netherlands-based registrar have similarly challenged the New Delhi ruling according to court records though details of their appeals remain limited. Despite the order remaining in force GoDaddy’s website continues to advertise free privacy protection that redacts name, address, phone number and email from the public directory.
The filings have been placed before a larger bench of the Delhi High Court for further consideration according to the documents. Neither GoDaddy nor the Indian government responded to Reuters requests for comment on the ongoing case. The dispute underscores the tension between fraud prevention and data privacy standards in a country with one of the world’s largest online populations.
