Since the EU's General Data Protection Regulation (GDPR) took effect on 25 May 2018, most WHOIS records no longer show a domain owner's name or contact details — they show "REDACTED FOR PRIVACY" instead. ICANN's Temporary Specification for gTLD Registration Data, adopted 17 May 2018, requires registrars and registries to withhold registrant personal data — name, street address, city, postal code, phone, and fax — from the public record unless the registrant consents to publish it. The data is still collected and retained; it is simply hidden. To reach it, you now use one of three routes: a registrar-provided anonymized contact, the tiered access built into RDAP, or ICANN's Registration Data Request Service (RDRS), a standardized request system launched in November 2023.
That is the summary an AI overview will give you. What it can't give you is the part that actually matters when you are staring at a redacted record during an investigation: precisely which fields survived, why global redaction happened even for non-EU registrants, and which of the three access paths is worth your time for a given goal. This post is the field guide. (For the related question of whether the data that is shown can be trusted, see WHOIS Accuracy and Limitations; for the successor protocol, see What is RDAP.)
What actually changed in 2018
Before GDPR, a WHOIS lookup returned the registrant's full contact card: real name, physical address, email, and phone number, all publicly queryable and bulk-downloadable. That made WHOIS a workhorse for security researchers, trademark lawyers, and spammers alike. GDPR made publishing that personal data without a lawful basis illegal for anyone processing EU residents' information — and because a registrar can't reliably know in advance whether a registrant is an EU resident, most simply redacted all gTLD registrant data globally. It was cheaper and safer than maintaining two policies.
The result is a public record that has been split in two. Operational metadata about the domain stayed public. Personal data about the human behind it went dark. The diagram below shows the split.
Redacted vs. public: the field-by-field reference
When you run a lookup, it helps to know in advance which fields carry signal and which are gone. This table maps every common WHOIS field to its post-GDPR status and why.
| Field | Post-GDPR status | Why / what governs it |
|---|---|---|
| Registrant name | Redacted | Personal data under GDPR; hidden by ICANN Temporary Spec (2018) unless consent given |
| Registrant street / city / postal | Redacted | Personal data; withheld by default |
| Registrant email | Redacted or anonymized | Often replaced with a per-domain forwarding address or web form |
| Registrant phone / fax | Redacted | Personal data; withheld |
| Registrant country / state | Often public | Not treated as identifying on its own; many registrars still show it |
| Admin & technical contacts | Redacted | Same personal-data rules as registrant |
| Creation / updated / expiry dates | Public | Domain metadata, not personal data — key for security triage |
| Sponsoring registrar | Public | Needed for transfers and abuse routing |
| Registrar abuse contact | Public | Required by ICANN; your first stop for abuse reports |
| Domain status codes (EPP) | Public | Operational state (e.g. clientHold, transferProhibited) |
| Name servers | Public | Required for DNS resolution; useful for infrastructure pivots |
| DNSSEC status | Public | Security configuration, not personal data |
The practical takeaway: redaction removed the who, but left the what and when. That is why WHOIS still matters for interpreting domain dates and age even when the owner is invisible.
The three ways data still flows
Redaction hides personal data from the anonymous public. It does not delete it, and it does not close every door. There are three layers of access, from easiest to most privileged.
1. Registrar-provided anonymized contact
Many redacted records still include a way to reach the registrant without revealing them: an anonymized forwarding email (a random string @privacy-provider) or a link to a web contact form in the registrant email field. This is the layer that overlaps with commercial WHOIS privacy / proxy services — optional products where a provider substitutes its own details for yours and forwards legitimate mail. Since GDPR redaction now covers most gTLDs by default, these paid services mainly add value for country-code TLDs that still publish full data, and for guaranteeing message forwarding.
2. RDAP tiered access
RDAP (Registration Data Access Protocol) is the structured, JSON-over-HTTPS successor to the plain-text WHOIS protocol, and ICANN now requires gTLD registries and registrars to run it. RDAP returns the same redacted data to the anonymous public — but it was purpose-built with tiered access in mind. An authenticated, authorized requester can receive a fuller response than an anonymous one, all through the same protocol. That design is what makes accredited access programs technically possible without reverting to the old free-for-all.
3. ICANN RDRS (the request path)
When you have a legitimate reason to see the redacted data, the standardized route for gTLDs is ICANN's Registration Data Request Service (RDRS), launched 28 November 2023. It gives parties with a legitimate interest — law enforcement, cybersecurity investigators, IP professionals, consumer-protection advocates, government officials — one consistent form to request non-public data, upload supporting legal documents, save templates, and track requests across participating registrars. Crucially, RDRS only routes and standardizes the request. Each registrar still decides whether to disclose. It is a proof-of-concept pilot that ICANN's Board has extended through December 2027 while the community debates a permanent access model (the proposed SSAD, System for Standardized Access/Disclosure).
What this means for security work
If your job depends on WHOIS — threat intel, brand protection, phishing takedowns — the honest answer is that the anonymous, bulk, pivot-on-registrant workflow is gone and is not coming back. Adapt by leaning on the metadata that survived: name-server overlaps, registrar patterns, and creation dates as a risk signal (a domain registered three days ago behaving like an established brand is a red flag regardless of who owns it). For the cases where you genuinely need the person, use RDRS rather than hoping a scraper still works.
Run a lookup below and read the record with the redacted/public split in mind — the fields that come back are exactly the ones GDPR left standing.
Bottom line
GDPR did not break WHOIS; it rebalanced it. Personal data is redacted by default, privacy and proxy services layer on top for the TLDs that still publish, RDAP carries the same redaction with the plumbing for tiered access, and RDRS gives legitimate requesters one standardized door to the non-public data — at least through 2027, while ICANN works out what permanent access looks like. Knowing which fields survive and which access path fits your purpose is the difference between staring at "REDACTED FOR PRIVACY" and actually getting what you need.