ICANN files for injunction against German domain registrar who said it will stop collecting WHOIS data because of GDPR
Domain name overseer hopes to get clarification about data collection for domain name registrations. — ICANN has filed injunction proceedings against EPAG …
Context & Ripple Effects
ICANN entered this fight already on the defensive: its March plan to comply with the GDPR by restricting WHOIS access behind an accreditation program had drawn public criticism from privacy advocates including the EFF. Rather than negotiate another compliance model, Tucows-owned EPAG decided the safest GDPR posture was to stop collecting registration contact data altogether.
That put a German registrar in direct breach of ICANN's WHOIS collection requirements, and ICANN responded with injunction proceedings in EPAG's home jurisdiction — a choice that turns a policy dispute over registration data into a legal test of whether European privacy law overrides the contracts that hold the domain system together.
First-order effects
- EPAG now faces a German court ruling on whether its GDPR reading excuses non-collection, while every other EU-based registrar must decide whether to keep harvesting contact data and carry the compliance risk or follow EPAG's lead.
- For ICANN, an adverse ruling would make its WHOIS requirements unenforceable against registrars operating in Germany, one of Europe's largest domain markets.
Second-order effects
- The outcome sets the template for all registrars in the EU: if EPAG wins — as German courts went on to rule when they threw out ICANN's suit — ICANN is pushed back toward negotiated access models like its accreditation proposal, and registrars gain real leverage over the data terms of their agreements.
- Tucows, as EPAG's owner, absorbs reputational and contractual friction with ICANN across its whole registrar portfolio, not just the German subsidiary.
Third-order effects
- The deeper shift is structural: a global coordination body discovering that national privacy law can override its uniform contracts, which points toward fragmented, jurisdiction-by-jurisdiction administration of the DNS rather than one worldwide WHOIS standard.
- It also previews regulators treating ICANN itself as an accountable party rather than a neutral steward — a pattern that resurfaces when the California AG later demands records over the .org price-cap removal and sale.
The trend: National privacy law is forcing internet-governance bodies like ICANN to abandon uniform global data practices in favor of jurisdiction-by-jurisdiction compliance.