Domain registration giant GoDaddy challenged a Delhi High Court order that introduced sweeping rules to curb fake websites impersonating well-known brands. The company said the directions could expose legitimate website owners to privacy and security risks, create difficulties for businesses across the world and even force domain service providers to reconsider operating in India, reported Reuters.
The legal battle comes as India steps up efforts to tackle online fraud. The rapid growth in internet and smartphone use has also led to a rise in cybercrime. Government data shows authorities received around 2.4 million complaints of alleged cyber fraud last year involving losses of nearly $2.4 billion, according to the Reuters report.
The dispute began after several Indian and international companies approached the Delhi High Court against fake websites that used their names and trademarks. Companies including Amazon, McDonald’s, Microsoft, Xiaomi and Colgate-Palmolive complained that fraudulent websites misled customers, offered fake franchises or carried out scams by using their brand identities.
In December, the court ordered the blocking of more than 1,100 such websites. It also introduced several new directions aimed at preventing similar fraud in the future. Those measures have now become the focus of appeals filed by GoDaddy and other domain registration companies.
Why GoDaddy challenged court order?
GoDaddy has filed an appeal before a larger bench of the Delhi High Court against the December order. Court documents reviewed by Reuters show the company believes the new rules go far beyond stopping fraudulent websites and could affect genuine businesses.
One of the court’s directions says domain registration companies should no longer offer privacy protection free of cost by default. Instead, website owners who want to hide their registration details would have to pay separately for the service.
GoDaddy said that this change could expose the names, addresses, telephone numbers and email addresses of genuine website owners. It said such information could become publicly available, increasing the risk of stalking, harassment and other security threats.
The company also said the order conflicts with India’s data protection law and the European Union’s General Data Protection Regulation (GDPR), which support a “privacy by default” approach, reported Reuters.
Another direction requires domain registration companies to provide website registration details to anyone with a “legitimate interest” within 72 hours. GoDaddy said it has no authority or practical method to decide who qualifies as having a legitimate interest, as reported by Reuters.
The company also objected to a direction that bars domain names that resemble protected trademarks. It said such restrictions could affect businesses with legitimate names and become extremely difficult to implement because domain names operate across international borders rather than within one country.
According to GoDaddy, the court’s order could have worldwide consequences because the company manages domain names for customers across many countries. It also argued that the measures could become commercially difficult enough to force some domain service providers to exit the Indian market.
GoDaddy stated annual revenue of about $5 billion and manages nearly 80 million domain names for over 20 million customers, as reported by Reuters. Company executives described India as its largest emerging market region in 2024.
Other domain service providers, including Namecheap and Hosting Concepts, have also challenged the same order before the court.
Concerns raised by experts and government
The Delhi High Court introduced the new directions after hearing petitions filed by over 20 companies that claimed fake websites had damaged their brands and deceived customers.
In one case, McDonald’s complained about more than 100 websites that allegedly used its famous Golden Arches logo and offered fake franchise opportunities in exchange for large amounts of money, reported Reuters.
The court described such websites as “engines for large scale deception” and said stronger safeguards were necessary to prevent misuse of well-known trademarks.
GoDaddy said completely blocking domain names similar to protected trademarks could create fresh problems. It cited the example of the word “McDonald,” which has Scottish origins and exists as a common surname. According to the company, giving exclusive control over such words could unfairly restrict legitimate use.
The company added that protecting abbreviations such as “HUL,” the name commonly associated with Hindustan Unilever Limited, could affect many ordinary English words that contain the same sequence of letters, reported Reuters.
Internet governance researcher Farzaneh Badii criticised the order and warned that removing privacy protections would mainly expose journalists, activists, small business owners and ordinary individuals rather than fraudsters.
Government, however, has consistently said that stronger verification and easier access to domain registration information are necessary to investigate cybercrime. Internal government documents submitted before the court showed authorities were concerned about domain name abuse and believed registration details should be readily available during investigations.
Home Minister Amit Shah recently said one person falls victim to cybercrime every 37 seconds in India and warned that the growing threat could become a national crisis if not addressed effectively, as reported by Reuters.
Despite the court order, GoDaddy’s Indian website continues to advertise free lifetime privacy protection that hides customers’ personal details from public records. The Delhi High Court is scheduled to hear the appeals on July 16.