GoDaddy just told an Indian court that a privacy ruling could be bad enough to push it out of the country entirely. That’s not a small threat coming from the world’s largest domain registrar.
The dispute traces back to a Delhi High Court order from December 2025, issued in a case called Dabur India Ltd. v. Ashok Kumar. In it, more than 20 companies, including Amazon, Microsoft, McDonald’s, and Colgate-Palmolive, had complained about a wave of fake websites impersonating their brands for phishing and counterfeit scams. As a result, the court treated it as systemic fraud rather than routine trademark infringement, blocked over 1,100 fraudulent sites, and issued 14 directions binding every registrar operating in India.
Three of those directions, specifically, are what’s driving GoDaddy’s appeal. Under the order, registrars must hand over a domain owner’s name, address, phone number, and email within 72 hours to anyone claiming a “legitimate interest.” In addition, they can no longer offer free WHOIS privacy protection by default. And finally, they have to refuse registrations for domains that closely resemble protected trademarks.
GoDaddy‘s appeal, which Reuters reported runs to 5,121 pages, argues there’s no reliable way to verify who actually has a legitimate interest in someone’s identity. Consequently, handing over that information on request, the company says, exposes ordinary website owners to real risks like stalking and harassment. Meanwhile, Namecheap and Hosting Concepts, which runs Registrar.eu, have filed similar challenges of their own.
Underneath all this, though, sits a much older debate about WHOIS data. Registration details used to sit in the open by default, until privacy services and, later, GDPR pushed the industry toward redacting most of it. Even so, ICANN already allows disclosure in specific situations, but that process is discretionary, nothing like the mandatory 72-hour window the Delhi court just imposed. Therefore, if that standard holds in a market as large as India, brand owners elsewhere will likely point to it as precedent.
Ultimately, a larger bench of the Delhi High Court is set to hear the combined appeals on July 16, 2026. The court could soften the disclosure rule and the ban on default privacy, or leave the order intact. Either way, the case is shaping up to test how much power a single national court has to reset domain privacy norms the industry spent years building globally.
