GoDaddy Fights India Court Order That Could Expose 80M Domain Owners

For legal and regulatory professionals, this case crystallizes a growing tension between aggressive national cyber-fraud enforcement and the foundational privacy-by-default principle espoused by India’s own data protection law and the GDPR. The New Delhi court’s decision to reclassify domain privacy as a paid, rather than a default, service challenges the very architecture of digital rights and raises novel questions about jurisdictional conflicts, the extraterritorial reach of court orders, and compliance liability for multinational registrars. As the Delhi High Court weighs the appeal, its ruling could set a binding precedent for how common law jurisdictions reconcile consumer protection with data privacy.

GoDaddy has launched a high-stakes legal challenge against a December 2025 ruling by a New Delhi court that ordered the mass blocking of over 1,100 websites impersonating well-known brands such as Amazon and McDonald's. The court’s directives, aimed at curbing a surge in cyber fraud, go further than simple blocking: they require domain registration companies to strip away default privacy protections, making the personal details of all domain owners—names, addresses, phone numbers, and email addresses—publicly accessible. GoDaddy, in non-public court filings reviewed by Reuters, argues this undermines fundamental privacy rights and could destabilize the domain registration business in India, its largest emerging market. With 80 million domains under management and annual revenue of approximately $5 billion, GoDaddy warns the ruling is “commercially destabilizing” and could force registrars to exit the country entirely. Rivals Namecheap and Hosting Concepts have joined the appeal, signaling industry-wide alarm.

“

With 80 million domains under management and annual revenue of approximately $5 billion, GoDaddy warns the ruling is “commercially destabilizing” and could force registrars to exit the country entirely.

The background is stark. India’s cyber fraud epidemic has reached unprecedented levels: authorities logged 2.4 million complaints in the last year, alleging losses totaling $2.4 billion. The court, in its ruling, described fake websites as “engines for large-scale deception” and held that privacy features that shield domain owner identities act “as a cloak” for scammers. It mandated that privacy protection become a paid add-on service, rather than a default, to deter misuse. This approach, however, collides head-on with global data governance norms. GoDaddy’s appeal explicitly invokes India’s own Digital Personal Data Protection Act and the European Union’s General Data Protection Regulation (GDPR), both of which enshrine “privacy by default” as a core principle. By treating privacy as a premium feature, the court’s order creates a direct conflict with these frameworks, potentially exposing corporations and individuals to legal liability in multiple jurisdictions.