ccTLD Privacy & WHOIS Redaction Matrix
Audit personal data disclosure rules across national ccTLDs. Understand why sovereign extensions are exempt from ICANN GDPR mandates, which registries ban privacy proxies, and how to protect registrant identity.
Sovereign ccTLD Privacy Policies
| ccTLD | Country / Registry | Redaction Policy | Privacy Proxy Allowed | Privacy Risk | Key Regulatory Notes |
|---|---|---|---|---|---|
| .us | United States US Dept of Commerce (NTIA) / Registry Services LLC | Strictly Prohibited | No | High Risk | NTIA Policy mandates complete public disclosure of registrant name, physical address, email, and phone. Privacy proxies are subject to immediate domain deletion. |
| .de | Germany DENIC eG | Natural Persons Redacted | Restricted (Admin-C required) | Low Risk | DENIC completely redacts personal data for private individuals. Legitimate interest requests require a formal legal query. |
| .uk | United Kingdom Nominet UK | Non-Trading Opt-Out | Yes | Low Risk | Non-commercial consumers can opt out of address disclosure. Trading and commercial entities must display corporate registration data. |
| .ca | Canada CIRA (Canadian Internet Registration Authority) | Automatic Individual Redaction | Yes | Low Risk | CIRA automatically shields individual registrants. Corporate Canadian entities and trademark holders have public directory listings. |
| .au | Australia auDA (.au Domain Administration) | ABN/ACN Verified Public Listing | No | Moderate Risk | Registrants must supply an active Australian Business Number (ABN) or entity identifier. Business entity names and eligibility details remain public. |
| .fr | France AFNIC | Full Default Redaction for Individuals | Yes | Low Risk | Default anonymity for all private individuals. Corporate entries display registration numbers from the French Trade and Companies Register. |
| .in | India NIXI (.IN Registry) | Public Listing with Registrar Proxies | Yes (Registrar Dependent) | Moderate Risk | NIXI does not redact registrant data natively; privacy requires purchasing third-party registrar proxy shielding services. |
| .ru | Russia Coordination Center for TLD .RU/.РФ | Private Person Redacted | Restricted (Passport KYC Required) | Moderate Risk | WHOIS outputs "Private Person" for natural individuals, but strict domestic law requires uploading government passport documentation to register. |
Frequently Asked Questions
Why are sovereign ccTLDs exempt from ICANN GDPR WHOIS redaction rules?
ICANN policies (such as the Temporary Specification for gTLD Registration Data) apply exclusively to generic TLDs (.com, .net, .org, new gTLDs) via contracts between ICANN, registry operators, and accredited registrars. Sovereign country code top-level domains (ccTLDs like .de, .uk, .us, .ca) are governed by national law and local registry operators, not ICANN contracts.
Which major ccTLDs strictly prohibit third-party WHOIS privacy proxy services?
.us (United States) strictly bans privacy proxies under US Department of Commerce NTIA regulations, requiring verified legal names and physical contact details. Similarly, registries like .de (Germany), .au (Australia), and .it (Italy) mandate direct registrant identity verification.
How do European ccTLDs balance GDPR with registry transparency?
Most European ccTLDs (like Nominet for .uk and DENIC for .de) redact the name, street address, and phone number of private non-commercial individuals by default. However, commercial businesses and corporations must publish their legal company name and business contact details.
What are the security risks of registering a domain in an unredacted ccTLD?
Unredacted registries publicly display the registrant full legal name, physical home address, mobile phone number, and personal email. This data is indexed by automated reconnaissance scanners, leading to identity theft, targeted social engineering, swatting, and persistent spam harassment.