The short version
Domain privacy is a service that keeps your name, street address, phone number and email out of public domain lookups. Ten years ago it mattered a great deal, because the public WHOIS directory printed all of that by default. Today, for generic extensions such as .com, .net and .org, ICANN's Registration Data Policy already requires or allows registrars to redact most personal fields. [1]
That does not make privacy services pointless. Redaction under the policy leaves some fields to the registrar's discretion, always publishes your country, and does not apply to country-code extensions, which set their own rules. A privacy service substitutes its own details for yours across the board, so it is a sensible default when your registrar includes it at no charge. The real decision is less about paying for privacy and more about choosing an extension and registrar where privacy is actually available.
What ICANN's current rules redact, and what they still publish
ICANN's Registration Data Policy took effect on 21 August 2025 and applies to ICANN-accredited registrars and generic top-level domain registry operators. [1] It requires redaction where applicable law requires it, and lets registrars and registries also redact for a commercially reasonable purpose or where limiting redaction is not technically feasible. In practice, many registrars redact broadly.
The lookup protocol is changing too. ICANN describes RDAP, the Registration Data Access Protocol, as the replacement for WHOIS, and says that as of 28 January 2025 generic-domain registries and registrars are no longer required to provide WHOIS services, with exceptions it lists for .com, .name and .post. [2] Whichever protocol a lookup uses, the redaction rules are the same.
| Field in a public lookup | Under the Registration Data Policy | With a privacy service |
|---|---|---|
| Domain name, registrar, creation and expiry dates, status, abuse contact | Always published [1] | Still published |
| Registrant name, street, postal code, phone, fax | Redacted where the policy's redaction conditions apply [1] | Replaced with the service's details [3] |
| Registrant email | Not shown; the registrar must publish an email address or web form that does not identify you [1] | Replaced with a forwarding alias [3] |
| Registrant organization and city | May be redacted at the registrar's or registry's discretion [1] | Replaced with the service's details [3] |
| Registrant country, and state or province if collected | Must be published [1] | The service's details are shown instead [3] |
Redaction versus a privacy service
These are two different mechanisms, and Namecheap offers both. Its Domain Privacy, provided by Withheld for Privacy, puts the privacy company's address information in the public record instead of yours and replaces your registrant, admin and technical emails with a unique withheldforprivacy.com address that forwards to you. Namecheap says you can also schedule that alias to change every few days, so addresses harvested from lookups stop working. [3]
Its second option, Redacted for Privacy, masks your name, address, phone and email in Namecheap's own lookup output but still shows your state or province and country. Namecheap says this option is switched on automatically at registration or transfer when an extension does not support the privacy service, provided the registry allows it. [3] ICANN's policy also notes that when a domain uses a privacy or proxy service, the service's full registration data is published, which is why the privacy company's details appear in place of yours. [1]
Two practical consequences follow. First, if you register as a business and fill in the organization field, redaction alone may leave your company name visible; a privacy service replaces it. Second, you still have to give your registrar accurate details. Privacy hides them from the public; it does not remove them from the registrar's records.
Which registrars include privacy at no charge
Free privacy is common enough that paying an add-on fee for it is a reason to look elsewhere. The registrars below state on their own pages that privacy or redaction is included. Each one also has exclusions by extension, so check the specific extension before you buy.
| Registrar | What its page says | Conditions to note |
|---|---|---|
| Namecheap | Offers privacy protection for free, provided by Withheld for Privacy [3] | Only for domains registered with Namecheap [4]; not available for the extensions listed below [3] |
| Cloudflare Registrar | Free WHOIS redaction [5] | Cloudflare says it does not mark up domain prices [5] |
| Porkbun | WHOIS privacy listed among features that come free with every Porkbun domain [6] | Extension-level exceptions are not covered on the pricing page |
| Squarespace Domains | Domain privacy included for free with all eligible domains registered through Squarespace [7] | Eligibility depends on the domain |
Extensions where privacy works differently
Namecheap says not all registries allow privacy tools, and lists the extensions its Domain Privacy cannot be used with: .ad, .com.au, .net.au, .org.au, .ca, .ch, .cn, .cv, .de, .es, .com.es, .nom.es, .org.es, .eu, .fr, .gg, .id, .in, .co.in, .is, .li, .nl, .nu, .sg, .com.sg, .uk, .co.uk, .me.uk, .org.uk, .us, .barcelona, .cat, .kyoto, .law, .locker, .music, .nyc, .paris, .vote and .voto, plus one internationalized extension. [3]
For most of those, Namecheap applies its Redacted for Privacy mask where the registry allows it. It adds that a small number of extensions it manages through an upstream provider, such as .fr, .ch and the .au family, cannot use either option, although it says the registry usually redacts those lookups anyway. Redacted for Privacy also cannot be applied to .ca domains registered as a corporation. [3]
.us is the strictest common case. The usTLD Privacy Services Policy, updated 29 August 2019, has a section headed Prohibition on Anonymous or Proxy Domain Registrations that bars registrars and their affiliates, partners and contractors from offering services that prevent the registry from having and displaying true and accurate registrant data. [8] .co is another country-code extension with its own rules: its registration policy says applicants agree that registration data may be published on a public registration database and that inaccurate data can lead to cancellation or suspension. [9] ICANN's redaction policy does not govern country-code extensions, so always read the registry's own policy.
Who needs privacy, and who can skip it
- Turn it on: anyone registering in their own name, especially sole traders, newsletter writers and freelancers whose home address is their registrant address.
- Turn it on: anyone who wants a private alias address they can filter or rotate, rather than relying only on the registrar's contact form. [3]
- Optional: a company that wants its legal name visible as the domain holder for trust reasons, and whose registered office is already public.
- Not possible: .us registrants. [8] Choose a different extension if hiding your home address matters to you.
- Do not pay extra: if a registrar charges an annual privacy fee for a .com, compare it with registrars that include privacy at no charge. [3] [5] [6] [7]
Worked example: a freelancer choosing between .com and .us
A designer working from home wants a short domain for a portfolio and email. At Namecheap, a .com qualifies for free Withheld for Privacy, so a public lookup would show the privacy company's details and a forwarding alias rather than her home address. [3]
The same name as a .us cannot use a privacy or proxy service under the usTLD policy, and Namecheap lists .us as unsupported. [3] [8] If she registers the .us in her own name with her home address, she should expect those details can be displayed. The low price of a .us does not offset that for someone working from home. If she still wants the .us, she can at least register with a business address she is comfortable publishing, as long as it is accurate.
Checklist before you register
- Check whether your extension is on your registrar's privacy exclusion list before paying. [3]
- Confirm privacy is included in the price, and whether it stays free on renewal or only while you remain a customer.
- Use an email address you control long term as the registrant email; renewal and transfer notices go there even when it is hidden.
- Decide whether to fill in the organization field; it may stay visible if only redaction applies. [1]
- After registration, run a lookup on your own domain and confirm what is actually shown.
- If you transfer the domain later, recheck privacy at the new registrar; Namecheap's service only covers domains registered with Namecheap. [4]
Questions before you decide
Is domain privacy free at Namecheap?
Namecheap's knowledgebase says it offers privacy protection for free, provided by Withheld for Privacy, and that the service can only be used with domains registered with Namecheap. Some extensions are excluded; see the list in this guide.
Does WHOIS still exist?
ICANN describes RDAP as the replacement for the WHOIS protocol and says that as of 28 January 2025 generic-domain registries and registrars are no longer required to provide WHOIS services. Lookups still work; they increasingly run over RDAP.
Can I hide my details on a .us domain?
No. The usTLD Privacy Services Policy prohibits anonymous or proxy registration services that stop the registry from having and displaying true registrant data, and Namecheap lists .us among the extensions its Domain Privacy cannot be used with. Plan as if your .us contact details can be public.
If my details are hidden, can people still contact me?
Yes. ICANN's policy requires the registrar to publish an email address or web form that does not reveal your address. Namecheap uses a Contact domain holder form, and its Withheld for Privacy service forwards mail sent to a unique alias address.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- ICANN Registration Data Policy Accessed 29 Oct 2026
- ICANN: Registration Data Access Protocol (RDAP) Accessed 29 Oct 2026
- Namecheap Knowledgebase: Do you provide any domain privacy protection services? Accessed 29 Oct 2026
- Namecheap Knowledgebase: Can I use your Domain Privacy service for a domain not registered through Namecheap? Accessed 29 Oct 2026
- Cloudflare Registrar Accessed 29 Oct 2026
- Porkbun domain pricing Accessed 29 Oct 2026
- Squarespace Domains Accessed 29 Oct 2026
- usTLD Privacy Services Policy Accessed 29 Oct 2026
- .CO Registration Policies Accessed 29 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.