Domain privacy: what WHOIS shows and when you need protection

At a glance

• Domain privacy replaces your contact details in the public WHOIS record with those of a privacy service.
• Since ICANN’s GDPR changes, registrars already redact much of a registrant’s personal data, but the domain name, registrar, status and creation date are always published.
• You can see what your own record shows in a minute with ICANN Lookup.
• Namecheap includes its Domain Privacy free. At any registrar, check at checkout whether privacy is included and what it hides.
• For a network of sites, privacy on its own isn’t the footprint. The same owner details on every domain, or the same IPs and nameservers, are.

What domain privacy is

Namecheap describes its version this way (fetched 2026-10-28): “Domain Privacy is a Whois protection service provided by the Withheld for Privacy company.” It “puts its address information to the public Whois instead of yours,” and replaces your email with a unique forwarding address.

What WHOIS shows today

Much less than it used to. In 2018 ICANN’s Board adopted a Temporary Specification that changed registry and registrar requirements to comply with the EU’s GDPR, according to ICANN’s Registration Data Policy page (fetched 2026-10-28). That policy now replaces the temporary arrangement and has been in effect since 21 August 2025.

Under it, per the same page:

• Registries and registrars must publish the domain name, the registrar, the registrar’s IANA ID, the domain’s status and its creation date. Nameservers are published too, if they’re set.
• They must redact personal data such as the registrant’s name, street, postal code and phone where applicable law requires it, and they may redact it for other reasons.
• Registrant email is not shown when redacted. Instead, the registrar publishes an email address or a web form that reaches you.
• The registrant organization is published if you agree to it, and may be redacted if you don’t.

So, depending on where you live and which registrar you use, your record may already hide most personal details. What’s left visible varies by registrar and by what you entered in the organization field.

The protocol is changing too. ICANN’s RDAP page (fetched 2026-10-28) says RDAP “was created as the replacement for the WHOIS protocol,” and that as of 28 January 2025 registries and registrars of generic domains are no longer required to run WHOIS services, with exceptions for .com, .name and .post. RDAP stays mandatory. In practice, “WHOIS” is still the word everyone uses for the public record, whichever protocol serves it.

How to check your own WHOIS record

Don’t assume. Look it up:

1. Go to ICANN Lookup and enter your domain.
2. Read the registrant section. Check the name, organization, address, email and phone fields. Redacted fields usually say something like “REDACTED FOR PRIVACY” or show the privacy service’s details.
3. Check the organization field in particular. If you typed a company name when you registered, it may still be visible.
4. Note the registrar, the nameservers and the expiry date while you’re there. Those are public no matter what.
5. Compare with your registrar’s own lookup. For .com and .net, the registry is Verisign, and registrars also show the record from their own WHOIS page.

If you find your name or company on a domain you’d rather keep anonymous, turn on privacy at the registrar or edit the organization field.

Is WHOIS privacy free?

At many registrars, yes. Here’s what to look for:

Registrar	Privacy included?	What it hides	Exceptions
Namecheap (fetched 2026-10-28)	Yes, “we are offering privacy protection for free”	Contact details and email, replaced with Withheld for Privacy’s details and a forwarding address	Some TLDs don’t allow it, including .ca, .de, .fr, .uk, .us and .eu. For those, “Redacted for Privacy” is enabled automatically and leaves only the state or province and country visible.
GoDaddy	Check at checkout	Check whether the organization field is hidden too	Check the TLD list
Any other registrar	Check at checkout	Name, organization, address, email and phone	Country-code domains often have their own rules

Two things to confirm at any registrar: whether privacy is on by default or an extra, and whether it renews free or becomes a paid add-on.

Keep a private record working

Privacy hides your details from the public. It shouldn’t hide them from your registrar. Your registrar uses the email on file for renewal reminders: ICANN’s Expired Registration Recovery Policy (fetched 2026-10-28) has registrars send notices about a month and about a week before a domain expires. If that address is dead, you won’t see them, and a domain you meant to keep can lapse.

A few habits help:

• Keep the registrant email current and check it, even when the public record shows a forwarding address.
• Turn on auto-renew for any domain you want to keep.
• Re-check the public record after a transfer between registrars, since each registrar applies its own privacy settings.

Does domain privacy affect SEO?

We know of no evidence that privacy helps or hurts rankings directly, and Google doesn’t say it does. What privacy changes is who can connect your domains to you and to each other. For a single business site, that’s mostly about spam and unwanted sales calls. For a network of sites, it’s about footprints, covered next.

Domain privacy for PBNs

Our PBN guide lists WHOIS information, the same owner on all blogs, as one of the two most obvious harmful footprints, along with outbound links that only point to your own sites. If every domain in a network shows the same name or company, anyone can connect them in minutes.

The good news, as the guide puts it, is that WHOIS privacy “is not as big of an issue as a few years ago because with GDPR most registrars have started providing free privacy.” Not all though. Some registrars may still show some identifying information such as the organization name, so check every record yourself.

What we recommend for a network:

• Check every domain’s record after purchase. No real name, company or personal email should appear.
• Don’t fake the data. Privacy or redaction hides the same fields, and your real email still gets the renewal notices.
• Spread domains across popular registrars such as Namecheap and Dynadot rather than one account, and don’t register them all on the same day. Our guide lists both under domain footprints.
• Don’t worry that privacy itself is a pattern. With most registrars now offering it free, a private record doesn’t stand out.

Privacy is the easy part. The footprints that get networks found are usually in the hosting: shared IPs, and nameservers that only your network uses. use the hosting provider’s default nameservers. Custom nameservers that only your network uses are a footprint. Our posts on nameserver footprints, C-class IP hosting and PBN footprints go into each.

On Easy Blog Networks, each blog gets an IP and nameservers straight from the hosting provider it’s on, such as Amazon Web Services, DigitalOcean or Rackspace. Those nameservers are shared with thousands of other websites, so they don’t single out your network.

FAQ

Do I need domain privacy?

If you’re an individual, it keeps your home address and phone out of a public record, and it’s often free. If your registrar already redacts your data, privacy adds little beyond a forwarding email. Check your record first.

What does WHOIS show after GDPR?

The domain name, registrar, status, creation date and nameservers are always published. Personal details are redacted where the law requires it, and the organization field is shown only if you agree.

What is Verisign WHOIS?

Verisign runs the .com and .net registries, so a Verisign lookup shows the registry’s record for those domains: registrar, nameservers, status and key dates.

Is “Redacted for Privacy” the same as domain privacy?

Not quite. Redaction removes fields from the public record. A privacy service puts its own details in their place, with a forwarding email. Namecheap, for example, uses Domain Privacy where the registry allows it and turns on “Redacted for Privacy” automatically for TLDs that don’t. Either way, your personal details stay out of the public record.

Can someone still find out who owns a domain with privacy?

Not from the public record. The registrar still holds your real details, and ICANN’s policy includes a process for requests to disclose non-public data. If you’re buying a domain and want its past ownership, look at its history, as in our guide to how to check a domain’s ownership history.

Do I need privacy on PBN domains?

Yes, or redaction that hides the same fields. More important is that no domain shows your name or company. If you’re buying for a network, our guide to buying PBN domains covers the rest of the purchase, and our article on the domain life cycle explains when registrar records change hands.