WHOIS Data Redaction and its Impact on Unsolicited Emails: A Field Experiment

Abstract

The Internet Corporation for Assigned Names and Numbers (ICANN) mandates the disclosure of certain information for registered domain names. However, the European Union General Data Protection Regulation (GDPR) curtails what information can be publicly accessible, including personally identifiable information (PII). It has been suggested that public disclosure of registration data leads to email spam, but no systematic study of this effect has been conducted. This study fills this gap by empirically assessing the impact of public PII disclosure on spam email volume. Over a year-long field experiment, we registered 66 domain names with disclosed and undisclosed PII and analyzed incoming unsolicited email advertising. Our results revealed that domains with publicly disclosed contact information received a mean of 19.7 spam emails per domain, more than quadrupling the mean of 4.2 for domains with undisclosed information. This significant increase in spam emails linked to public PII disclosure indicates a clear negative impact. ICANN stakeholders should consider these findings, recognizing the potential privacy implications and spam risks of disclosing domain contact information.