German court throws out ICANN's lawsuit against EPAG, a Tucows-owned registrar that stopped collecting WHOIS data because of GDPR
Context & Ripple Effects
ICANN has spent 2018 fighting to keep WHOIS data flowing after GDPR took effect: its accreditation program for restricting Whois access was already drawing fire from privacy advocates and EFF, and in May it went further by filing an injunction against EPAG, the Tucows-owned German registrar that said it would stop collecting registrant contact data. The court's dismissal of the lawsuit is the second defeat for that strategy — it had already rejected ICANN's request to compel EPAG's data collection on GDPR grounds.
First-order effects
- EPAG and parent Tucows can lawfully stop collecting WHOIS contact data without breaching their registrar agreement with ICANN, removing the legal risk that made them the test case.
Second-order effects
- Other EU-based registrars gain a court-validated template for dropping WHOIS collection, while ICANN must fall back on its contested accreditation model or renegotiate its contracts with registrars.
Third-order effects
- If national courts keep siding with data minimization, WHOIS erodes from a public global directory into a gated, jurisdiction-dependent record — pushing ICANN toward privacy-compliant access regimes rather than blanket publication.
The trend: GDPR enforcement is being tested through individual companies in national courts first, with each ruling like this one setting precedents that reshape how global internet infrastructure handles personal data.