WHOIS Domain Privacy: What Your Registration Shows
Owning a website has long meant owning a public record. The rules changed, but the details you give your registrar still matter.
By Siddharth ShankarUpdated October 11, 2026WHOIS is the public directory that lists who registered a domain name. Since ICANN's Temporary Specification took effect on 25 May 2018, many records show "REDACTED FOR PRIVACY" for personal fields. ICANN's Registration Data Policy, effective 21 August 2025, replaced the interim rules. Registrant name, street, postal code and phone are redacted, and registrars must offer a contact email address or web form. Privacy and proxy services add another layer.
Your email is the key to most of your accounts. Has it already leaked?
Free · About 30 seconds · No sign-up · Email not stored
Anyone who has registered a domain for a blog, a side business or a family website has supplied contact details to a registrar. For years those details were published for the world. That is no longer the default, but the full story is more careful than "WHOIS is private now".
What WHOIS is
WHOIS is a public lookup service for domain registration data. It was designed so that people could contact the owner of a domain about technical problems, abuse or legal matters. A record traditionally listed the registrant's name, organization, mailing address, email address and phone number.
Because the data was open, it was also collected in bulk. Marketers, scammers and data brokers could pair a name with a street address and phone number, all taken from a hobby website registration.
What changed in 2018 and 2025
ICANN, the body that coordinates domain names, adopted a Temporary Specification effective 25 May 2018, after the EU's data protection law took effect. Many records started displaying "REDACTED FOR PRIVACY" in personal fields.
ICANN's Registration Data Policy became effective on 21 August 2025 and replaced the interim approach. Under it, redaction is required where personal data must be withheld under law. The redacted fields include:
- Registrant name
- Street address
- Postal code
- Phone number
Registrars must offer an email address or web form for contacting the registrant, so a person can be reached without seeing private details. Redacting the organization field is optional, which matters if you register a domain in a company name tied to your home.
Privacy services and proxy services
Registrars also sell extra protection, and the two types work differently.
- Privacy service: you remain the registrant, but the public record shows substitute contact details.
- Proxy service: the provider becomes the registrant of record, and its information is displayed.
A proxy gives stronger separation on the public record, but it also means the provider is the legal holder of the domain, so read the contract carefully before choosing one.
Quick check before you read on: is your email in a known data breach? Free, about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
What can still expose you
Several details can slip through even with redaction turned on:
- Older records captured before 2018 may be kept by third-party archives
- Fields that are not on the redacted list, depending on the registrar
- The organization name, if redaction of that field is not applied
- A website that prints your address, phone or email on a contact page
Check the pages of your own site as well. The domain record may be clean while the footer shows a home address.
How to check your own domain
1Look up the domain
Use a lookup tool from your registrar or a public WHOIS search, and read each field as a stranger would.
2Compare registrant, admin and technical contacts
Confirm that no personal field is displayed and that the contact route is an email address or web form.
3Check the organization field
If you registered under a company name that uses a home address, ask your registrar whether that field can be hidden.
4Decide on a privacy or proxy service
If you want more separation, compare plans, ownership terms and renewal costs.
5Search for older copies
Search your name together with the domain and look for archived records. Treat anything found as a candidate for removing from search results.
Keep registration contacts accurate
Registrars must be able to reach you, so do not enter false information. Use a role-based email address that you check, and keep it separate from your personal inbox. That also helps if your email later appears in a breach, covered in what to do when your email is in a data breach.
Sources
- ICANN: Registration Data Policy (effective 21 August 2025; Temporary Specification from 25 May 2018; redaction)
Frequently asked questions
Is WHOIS still public?
The directory still exists, but many fields for individuals are redacted. Under ICANN's policy, registrant name, street, postal code and phone are redacted.
What is the difference between privacy and proxy services?
With a privacy service you remain the registrant and substitute details are shown. With a proxy service the provider becomes the registrant of record.
Does domain privacy protect me from every lookup?
No. It hides fields in the public record, but your registrar keeps your real details, and older archived copies may exist.
Should I use fake details to stay private?
No. Registrars require accurate contact data, and false details can put the domain at risk. Use redaction or a privacy service instead.
Can my domain connect to my home address?
It can if your website prints one or if an older record was archived. Check the site and search results periodically.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Compare data removal services
See which services work in your country, what they cost, and the free do-it-yourself route.
Compare removal services →Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.