GoDaddy challenges India court order, says $2.4B fraud fight violates GDPR

For legal and regulatory professionals, the Delhi High Court case represents a pivotal test of judicial overreach into domain governance. The order not only targets fake websites but also mandates a fundamental shift from privacy-by-default to a paid model, a move that directly contravenes India’s own data protection statute and the EU’s GDPR. The outcome could influence countless cross-border digital operations and define the limits of court-ordered tech compliance.

GoDaddy’s appeal against a New Delhi court order signals a high-stakes collision between India’s escalating cyber fraud crackdown and globally accepted privacy norms. At the center of the dispute is a December 2025 ruling that ordered the blocking of over 1,100 fake websites impersonating brands such as Amazon and McDonald’s, and — more critically — mandated that domain privacy protection become a paid service, stripping away the ‘privacy by default’ model. GoDaddy argues that this forced exposure of registrant data (names, addresses, phone numbers, emails) would not only violate India’s own Digital Personal Data Protection Act and the EU’s GDPR but also invite harassment, stalking, and identity theft against millions of legitimate website owners. The company has called the directives ‘commercially destabilizing’ and warned that domain registration companies could be forced to exit India entirely.

“

Authorities registered 2.4 million cyber fraud complaints valued at $2.4 billion in 2025 alone, a staggering volume fueled by a booming digital user base.

India’s motivation is clear. Authorities registered 2.4 million cyber fraud complaints valued at $2.4 billion in 2025 alone, a staggering volume fueled by a booming digital user base. Fake e-commerce sites, phishing portals, and counterfeit payment gateways have proliferated, leveraging default WHOIS privacy to hide behind anonymized registrations. The court branded these sites ‘engines for large-scale deception’ and concluded that free privacy functions as a shield for criminals. By monetizing privacy, the court aims to introduce a friction model — legitimate users can still hide their details, but at a cost, while law enforcement gains a clearer path to track bad actors.

Yet GoDaddy and competitors Namecheap and Hosting Concepts contend the remedy is worse than the disease. In legal filings, GoDaddy emphasized that domain registrars across the world rely on privacy-by-default to comply with data protection frameworks, and that suddenly pivoting to a paid model would fracture the global WHOIS system, invite jurisdictional chaos, and erode user trust. For a company managing 80 million domains and generating roughly $5 billion in annual revenue, India is not just a regulatory headache — it is its largest emerging market, and any threat to operations there carries material financial risk.

The ruling also raises profound internet governance questions. If India’s approach succeeds, other nations grappling with fraud may follow suit, creating a patchwork of conflicting mandates that could balkanize the internet. Registrars might be forced to implement geo-fenced WHOIS disclosure, a technically complex and legally fraught endeavor. The appeals process at the Delhi High Court is thus being watched not only by domain registrars but by brand owners, cybersecurity firms, privacy advocates, and global internet governance bodies.