The current dispute between GoDaddy and the Indian government traces its origins to a growing menace that has become all too familiar in India – fraudulent websites masquerading as trusted brands. Whether it’s fake banking portals, counterfeit e-commerce stores or bogus franchise websites, cybercriminals have increasingly been using lookalike domains to deceive consumers, steal sensitive information and siphon off money.

Concerned by the scale of the problem, more than 20 companies, including global giants such as Amazon, Microsoft and McDonald’s, approached the Delhi High Court seeking action against websites impersonating their brands. The court responded by ordering the suspension of over 1,100 fraudulent domain names. But it didn’t stop there.

Recognising that simply taking down fake websites was unlikely to solve the larger problem, the court also issued a series of broader directions aimed at making it harder for cybercriminals to misuse domain registrations in the first place. The proposed measures included changes to how registrars handle customer privacy, share registrant information and prevent the registration of domains that closely resemble well-known trademarks.

It is these wider directions – not the crackdown on fraudulent websites themselves—that GoDaddy has challenged before the Delhi High Court.

The Arizona-headquartered company has been careful to clarify that it supports efforts to combat cybercrime and online impersonation. Its concern, however, is that some of the proposed rules could have unintended consequences, exposing millions of genuine website owners to greater risks while placing domain registrars in the uncomfortable position of acting as investigators and arbiters rather than neutral service providers.

Why GoDaddy Believes The New Rules Could Backfire

At the heart of GoDaddy’s challenge is a simple argument: measures designed to make the internet safer could end up making it less secure for ordinary users.

The company’s biggest concern revolves around the privacy of domain owners. Today, when someone registers a website, their personal details (such as their name, address, phone number and email address) are often shielded from public view through privacy protection services. These services don’t prevent law enforcement agencies from obtaining information through the proper legal process, but they do keep sensitive personal data away from cybercriminals, spammers and anyone else looking to exploit it.

The Delhi High Court, however, observed that this default privacy has increasingly become a shield for fraudsters. It directed that such privacy protection should no longer be offered automatically and instead be made available only as an optional paid service.

GoDaddy believes this change could have far-reaching consequences.

According to the company, millions of legitimate users rely on privacy protection not because they have something to hide, but because they have something to protect.

Journalists investigating sensitive issues, activists speaking against powerful interests, small business owners running websites from their homes and independent bloggers could all find themselves more vulnerable if their personal information becomes easier to access. Making such details publicly available, the company argues, could expose users to harassment, phishing attempts, identity theft and even physical safety risks.

The company has also objected to another direction requiring registrars to disclose registrant information within 72 hours to anyone demonstrating a “legitimate interest.” While GoDaddy says it cooperates with law enforcement requests, it argues that the court’s order leaves a critical question unanswered – who decides what constitutes a legitimate interest?

Registrars, it says, are technology companies, not courts or investigative agencies, and expecting them to make legal determinations could create uncertainty as well as inconsistent outcomes.

Another area of concern relates to trademark protection. The court wants registrars to prevent the registration of domain names that closely resemble well-known brands, a move aimed at stopping scammers from creating deceptive websites that mimic trusted companies. While GoDaddy agrees with the objective, it argues that implementing such restrictions is not always straightforward. Many trademarks are based on common words or surnames, and distinguishing between legitimate use and bad-faith registration often requires legal interpretation rather than a simple technical check.

The company also warns that the implications extend well beyond India. Domain names operate on a global system, and registrars serve customers across multiple jurisdictions. GoDaddy argues that complying with country-specific rules that alter privacy settings or registration practices could create conflicts with privacy laws elsewhere, while forcing global registrars to redesign systems for a single market.

Taken together, the company believes these measures risk shifting domain registrars away from their traditional role as neutral intermediaries and turning them into gatekeepers responsible for deciding who can register websites, whose information should be disclosed and which domain names are permissible.

In GoDaddy’s view, that is a responsibility better suited to courts and law enforcement agencies than private companies.

Why India Believes Stronger Rules Are Necessary

While GoDaddy has framed the debate around privacy and due process, the Delhi High Court’s directions stem from a very different concern – the explosive rise of cyber fraud in India.

Over the past few years, fake websites have become one of the most effective tools in a scammer’s arsenal. Fraudsters routinely create domains that closely resemble those of banks, e-commerce companies, government agencies and well-known brands to trick unsuspecting users into sharing passwords, banking credentials and one-time passwords, or to lure them into making payments for products and services that do not exist.

The scale of the problem has become difficult to ignore. According to government data, India recorded nearly 2.4 million cyber fraud complaints last year, with victims collectively losing an estimated $2.4 billion. The government has repeatedly described cybercrime as one of the country’s fastest-growing security challenges, arguing that fraudulent websites often disappear as quickly as they appear, making it extremely difficult for investigators to identify those responsible.

From the court’s perspective, simply blocking fake websites after they have already defrauded people is not enough. By the time a fraudulent domain is identified and taken down, the perpetrators have often registered dozens of new websites under different names, allowing the cycle to continue.

That is why the court’s directions focus not only on removing fraudulent websites but also on making the registration process more accountable. The underlying idea is straightforward: if those creating websites can be identified more quickly, investigators can respond faster, fraudulent domains can be shut down sooner and cybercriminals will find it harder to exploit anonymity.

Supporters of the move also argue that domain registrars are uniquely placed to help curb online fraud. Since they facilitate domain registrations and maintain registrant records, they believe registrars should play a more active role in preventing obvious abuse rather than remaining passive intermediaries after a website has gone live.

In other words, while GoDaddy sees the proposed rules as an erosion of privacy, the government views them as an essential step towards increasing accountability in an online ecosystem where anonymity has too often been exploited by criminals.

Is GoDaddy Right, Or Does India Have A Point?

GoDaddy’s concerns are not without merit. Privacy has long been one of the internet’s defining principles, and for many legitimate users, hiding personal information is a matter of safety rather than secrecy. A journalist investigating organised crime, an activist speaking out against powerful interests or even a small entrepreneur running a business from home may have perfectly valid reasons for not wanting their contact details to be publicly accessible.

At the same time, critics argue that the same privacy protections have also become a convenient shield for cybercriminals.

One of the government’s strongest counterarguments is that anonymity has repeatedly allowed fraudulent websites to operate with little fear of immediate consequences. Fake domains are often registered using privacy protection services, making it more difficult and time-consuming for investigators to identify those behind them. By the time authorities trace a website’s owner, the domain has frequently been abandoned and replaced with several new ones.

The debate also raises a broader question about accountability in the digital economy. GoDaddy maintains that domain registrars are merely service providers and should not be expected to decide who has a legitimate claim to customer information or which domain names should be allowed.

Critics, however, argue that registrars are no longer passive utilities. They register domains, collect customer information, charge registration fees and retain the ability to suspend or disable domains under certain circumstances.

If banks are expected to strengthen fraud controls and social media platforms are increasingly held responsible for illegal content, supporters of the court’s directions ask why domain registrars should be treated differently.

GoDaddy’s concerns over trademark restrictions have also found both support and criticism. The company is correct in pointing out that not every domain resembling a trademark is necessarily fraudulent. Many trademarks are based on common words, surnames or dictionary terms, making blanket restrictions difficult to enforce fairly.

Yet supporters of stricter rules argue that waiting until a fake website has already deceived consumers defeats the very purpose of prevention. Identifying suspicious registrations at an early stage, they contend, could stop scams before they begin.

Even the privacy debate itself is more nuanced than it first appears. The court has not suggested that privacy protection should disappear altogether. Instead, it has questioned whether such protection should be granted automatically to every registrant, including those who may have malicious intent.

Supporters believe introducing greater scrutiny at the registration stage could discourage fraudulent actors, while critics warn that additional barriers could also burden genuine users without significantly deterring determined criminals.

Ultimately, both sides are trying to solve the same problem – how to make the internet safer. Their disagreement lies in how that goal should be achieved.

GoDaddy believes stronger enforcement should not come at the cost of privacy and legal certainty, while the government believes greater accountability is essential if cybercrime is to be tackled effectively.

The Last Bit, A Debate That Extends Far Beyond GoDaddy

The dispute between GoDaddy and the Indian government is about far more than domain registrations. At its core, it reflects a larger shift in how governments around the world are beginning to view the internet.

For decades, the digital world was built on the idea that anonymity and privacy should be the default. Domain registrars, social media platforms and technology companies largely functioned as intermediaries, providing services while bearing limited responsibility for how those services were used. But as cybercrime, online fraud and digital impersonation have become more sophisticated, that approach is increasingly being questioned.

India is not alone in trying to place greater responsibility on technology companies. Governments across the world have introduced stricter rules for social media platforms, digital payment providers and online marketplaces, requiring them to do more to prevent fraud, remove illegal content and cooperate with law enforcement.

The Delhi High Court’s directions reflect that same thinking – that intermediaries should play a more active role in making the internet safer.

The challenge, however, lies in striking the right balance. Rules that are too lenient can allow cybercriminals to exploit anonymity with relative ease. Rules that are too stringent risk undermining the privacy and security of millions of legitimate users while placing additional compliance burdens on businesses.

Finding that middle ground will not be easy, particularly as cyber threats continue to evolve faster than regulations.

As the Delhi High Court considers GoDaddy’s challenge, the outcome could shape more than just how domain names are registered in India. It may also influence a much broader conversation about the future of the internet itself – whether it should continue to prioritise anonymity, or whether the growing scale of cybercrime means accountability must now take precedence.