The world’s biggest seller of website addresses says a court order in India could make the internet less safe. GoDaddy is fighting new rules meant to stop fake sites impersonating famous brands. It warns the cure could expose millions of legitimate site owners, and not only in India.
The order came from the Delhi High Court. In December, the court blocked more than 1,100 websites posing as well-known companies. Then a judge went further, issuing sweeping measures that tech experts say rewrite how the internet is governed. GoDaddy has challenged them before a larger bench, according to non-public filings reviewed by Reuters, which broke the story.
Three changes stand out. Domain sellers can no longer offer free privacy protection by default. They must hand a buyer’s contact details to anyone with a “legitimate interest” within 72 hours. And the rules bar any address that merely varies a protected brand name.
A privacy fight with a European echo
GoDaddy’s core objection is about privacy. Strip out privacy-by-default, it argues, and the name, address, phone number and email of ordinary site owners go public. That exposes them to “foreseeable privacy and security risks” such as stalking and harassment.
This is where Europe enters the story. GoDaddy says the order clashes with India’s own data protection law and with the EU’s GDPR, both built on a privacy-by-default principle. Farzaneh Badii, a New York researcher on internet governance, put it bluntly. Europe redacted these details, she noted, because publishing them fuelled harassment and phishing.
“The people exposed will be journalists, activists, small business owners, and private individuals,” she said. “The brand impersonators will not.”
The reach is the other worry. Domain names work globally, not locally. GoDaddy says the ruling could force it to police web addresses across the world just to satisfy one national court.
India’s real fraud problem
India has a genuine reason to act. The government logged 2.4 million cyber-fraud complaints last year, worth some $2.4bn. Home Minister Amit Shah says one person falls victim every 37 seconds, and warns the problem risks becoming a “national crisis”.
More than 20 companies brought the case, among them Amazon, McDonald’s, Microsoft, Xiaomi and Colgate-Palmolive. The December ruling called the fake sites “engines for large scale deception”. India’s home ministry told the judge that registration details should be readily available for investigations.
The stance fits a wider pattern. New Delhi has repeatedly pushed global platforms like Meta, X and Google to police content harder, and made them appoint local grievance officers. GoDaddy, Arizona-based Namecheap and the Netherlands-based Hosting Concepts have all lodged appeals.
When McDonald becomes a monopoly
GoDaddy’s sharpest argument targets the ban on brand-name variations. Take McDonald’s. The word “McDonald” is Scottish in origin, it says, and blocking every variation would “confer a monopoly” over a common surname.
The maths gets awkward fast. Protecting “HUL”, the Indian arm of Unilever, would clash with 118 English words that contain the string, including “hulk”. It is “virtually impossible”, GoDaddy says, to register a domain with an English word that no trademark touches.
The rules are also proving hard to enforce. Despite the December order, Reuters found a fake McDonald’s franchise address still on sale through GoDaddy India for around $10.
GoDaddy calls the directives “commercially destabilising” and has hinted domain firms could “exit India”, one of its biggest emerging markets. A larger bench hears the appeals on 16 July. Whatever it decides could ripple far beyond India, shaping who gets to hide, and who cannot, on the open internet.
