Domain name registration details are undergoing changes due to new data privacy regulations and the Registration Data Access Protocol (RDAP). These changes will impact registrant information – what information is collected, stored, and publicly displayed about the registrant of a domain. The shift is towards reduced data sets and increased privacy including GDPR compliance.
What is RDAP?
Behind every domain name lies data about ownership, administrative, and technical contacts. The WHOIS protocol, first developed in the 1980s, has previously been the primary means of accessing this data. However, WHOIS lacked consistency (it has no standard output format) and security measures suitable for modern infrastructure and privacy regulations.
It is being replaced by the Registration Data Access Protocol (RDAP) which has better readability and complies with privacy regulations. For example, RDAP can provide differentiated access, e.g. for security services vs the general public. It therefore aims to address the security and consistency concerns of WHOIS.
RDAP became the official source for accessing domain registration data on 28 January 2025, although WHOIS continues to be available. ICANN has already mandated that gTLD (generic Top-Level Domains e.g. .com, .org, .net) must support RDAP by 2025 but country code TLDs (ccTLDs) are still at various stages of adoption.
Impact on registrant information
From 30 June 2025, global domain registries reduced the registrant information collected to match the minimum data sets outlined by RDAP. This means that the following data will no longer be required from the registrant:
- Organisation
- State/Province and postal code
- Fax number
- Additional administrative, technical, or billing contacts
By or on 21 August 2025, domain registrars will delete extra data still held on file if it is no longer required by the minimum data set or they will ensure it will no longer be publicly accessible.
Overall, this appears to be a positive step in removing outdated information (such as fax numbers) and increasing privacy (masking full addresses). However, with fewer details being available it may mean that domain names are harder to verify as belonging to genuine organisations or persons, which could thus be a challenge with the ever increasing scale of cyber crime.
