ICANN's proposal to comply with EU's GDPR by restricting access to Whois information via an accreditation program faces criticism from privacy advocates, EFF
IF YOU HEAD over to a Whois service and search for wired.com, you'll see that this site is registered to our publisher Conde Nast at One World Trade Center in New York City. Tweets: @eff Tweets: @eff : ICANN is in a last-minute rush to make its WHOIS database of domain registrant information compliant with the new European data protection law, the GDPR. It wouldn't be in this mess if privacy hadn't been an afterthought until now. http://www.wired.com/...
Context & Ripple Effects
ICANN has been fighting a two-front war over Whois data since the GDPR loomed: it first floated changes back in 2015 that would disallow proxy registration for commercial domains, which EFF flagged as a privacy risk, and then it took the enforcement route — filing an injunction against Tucows-owned registrar EPAG when it stopped collecting registrant contact data (the May 2018 injunction).
The accreditation program now under fire is ICANN's fallback after the German courts sided with the registrar twice — first throwing out the lawsuit in June (the EPAG ruling) and then rejecting the request to compel data collection in July (the follow-up rejection). With litigation closed off, ICANN is trying to keep Whois access alive through gatekeeping instead of mandates, and privacy advocates see the same afterthought pattern EFF warned about three years earlier.
First-order effects
- Registrars like EPAG get a compliance template that keeps some form of Whois disclosure alive without forcing them to publish personal data wholesale — but only if they sign on to ICANN's accreditation terms.
- EFF and privacy advocates gain a concrete target: a proposal they can attack in ICANN's multistakeholder process rather than just litigate against registrar-by-registrar.
Second-order effects
- The German rulings have already established that EU law outranks ICANN contracts for European registrars, so any accreditation scheme must clear GDPR review or it simply reproduces the EPAG standoff across every EU-based registrar.
- Security researchers, journalists, and anti-abuse teams who rely on open Whois lookups face a permissioned-access regime where their access depends on being accredited — turning a public directory into a credentialed service.
Third-order effects
- If the accreditation model holds, domain registration data becomes the clearest instance of a broader shift: datasets long treated as public infrastructure get reclassified as personal data with gated access, and whoever runs the gate — here ICANN — gains durable control over who can investigate domains at all.
The trend: GDPR is converting open internet directories into permissioned systems, with ICANN's accreditation fight marking the moment Whois crossed from public record to gated access.