German court rejects ICANN's request to compel domain registrar EPAG to collect contact information for WHOIS, as it would violate GDPR
Context & Ripple Effects
ICANN has spent 2018 fighting to preserve full WHOIS data collection as GDPR took effect. Its first move was an accreditation program to restrict Whois access, which privacy advocates including EFF attacked as inadequate. When Tucows-owned registrar EPAG said it would stop collecting registrant contact data rather than risk GDPR liability, ICANN went to court in Germany.
That litigation has now failed twice: an interim request was denied in early June, and this ruling rejects ICANN's bid outright. The decision lands alongside Germany's broader judicial posture — the same country's highest court had already ruled that Google need not pre-screen search results for defamatory content, signaling deference to platforms over compelled policing.
First-order effects
- EPAG and other EU-based registrars can lawfully stop collecting and publishing registrant contact details without breaching their ICANN contracts, since a German court will not enforce that contractual duty against GDPR.
- ICANN loses its test case for enforcing the WHOIS requirement through national courts, leaving its compliance model — the accreditation approach privacy advocates already criticized — as the remaining path.
Second-order effects
- Registrars across the EU gain cover to follow EPAG's lead, shrinking the publicly searchable WHOIS dataset and forcing researchers, brand-protection firms, and law enforcement who depend on it to seek access through gated channels instead.
- ICANN faces pressure to renegotiate its registry-registrar agreements for GDPR jurisdictions or watch uniform data-collection obligations become unenforceable in one of its largest markets.
Third-order effects
- If courts keep siding with GDPR over ICANN's contracts, domain governance splits into regional regimes: a thin public WHOIS in Europe and fuller disclosure elsewhere, eroding the single global directory ICANN was built to maintain.
- The pattern extends beyond domains — as Austria's later ruling on Google Analytics showed, European regulators are willing to penalize routine US-linked data flows, pushing infrastructure operators toward jurisdiction-by-jurisdiction compliance designs.
The trend: GDPR is fragmenting once-uniform internet governance obligations, with European courts consistently refusing to enforce data-collection mandates that conflict with privacy law.