A paid privacy add-on sits next to almost every domain checkout, and it names the fields it will hide. Since a consensus policy took effect in August 2025, those same fields are already withheld from the public record by rule. That makes domain privacy vs public WHOIS a question about who relays a message rather than a question about who can read your address.
This is an independent editorial review. Network Solutions did not review or approve this article.
You can see the current listing for the service on the registrar’s official site:
Reading domain privacy vs public WHOIS in one table
The table sets out what each option actually changes. Each row gets its own section below. It avoids prices because the registration data rules move more slowly than any price list does.
| What you are comparing | Public registration record, no add-on | Paid privacy service |
|---|---|---|
| Registrant name, street, postal code and phone | Redacted by policy already | Replaced with the provider’s own contact details |
| Registrant country | Published, by requirement | Still published |
| Registrant organization | May be redacted, at the operator’s option | Substituted |
| Domain name, creation date, status, registrar URL | Published, by requirement | Published, unchanged |
| How a stranger reaches you | An email address or a web form that must not reveal the address | The provider’s channel, on its own terms |
| What the registrar still holds about you | Everything it is contractually required to keep | Everything it is contractually required to keep |
| Availability | Any gTLD | Most gTLDs, with named exclusions |
What domain privacy vs public WHOIS looks like after the 2025 policy
The rule that changed this is specific and dated. The Registration Data Policy for generic top-level domains states plainly that “This Policy is effective on 21 August 2025”, and its redaction section tells registrars and registry operators that each “MUST Redact the values for the following data elements subject to the exceptions outlined in the following subsections”. The named elements include “Registrant Name”, “Registrant Street”, “Registrant Postal Code”, “Registrant Phone” and “Tech Name”, while a registry operator must redact “Registrant Email” and “Tech Email”.
Set that beside what the paid product says it does. The registrar describes the service as replacing “the domain registrant’s mandatory ICANN contact information”, “including name, address, phone number, and email”, “with proxy information in the public WHOIS database”, and elsewhere says “it masks your personal information from being shown on the public WHOIS database” so that “your name, address, phone number, and email address will not be publicly visible.”
Those two lists are close to identical. The policy already covers name, street, postal code, phone and email. The product sells the same coverage as a purchase, which is not dishonest, but it does mean a buyer should know which of the two is doing the work.
The one field that stays public, and the one that is optional
The more useful half of the policy is what it keeps. Registrars and registry operators “MUST Publish the following data elements”, a list that includes “Domain Name”, “Registrar URL”, “Creation Date” and “Domain Status(es)”, and the policy adds separately that a “Registrar MUST Publish the Registrant Country data element”.
Country is therefore published whether or not you pay. The registrar’s own published sample record agrees with this, showing registrant fields rendered as “Statutory Masking Enabled” while the country line still reads with a value in it.
Organization is the interesting middle case. The policy says a “Registry Operator MAY Redact the Registrant Organization value”, and that registrars and registries “MAY Redact the Registrant City value”. A permission is not an obligation, so the organization line is the field where behavior genuinely varies between providers, and it is the one worth checking on a live record before deciding anything.
Where domain privacy versus public WHOIS stops being a display question
Put plainly, domain privacy versus public WHOIS is settled on three lines rather than on the whole record. Two of them are fixed by the policy, and the third is left to the operator. That is why two domains registered on the same day through two providers can show different amounts of information while both are fully compliant.
Where the difference between domain privacy and public WHOIS really sits
If the fields match, the difference between domain privacy and public WHOIS is the contact route, and the policy is unusually clear about how thin that route may be. A “Registrar MUST Publish an email address or a link to a web form to facilitate email communication with the relevant contact”, and whatever it publishes “MUST NOT identify the contact email address or the contact itself.”
An advisory on exactly that provision then narrows it further. It notes that the policy “does not include an explicit requirement that registrars provide a free text option” in the form, and that the earlier temporary specification’s instruction to “MUST provide functionality to forward communications received” was not carried into the policy. It describes a working implementation as a form that “permits the user to send a contact request to the registrant or technical contact”, where “Submission of the form initiates a system-generated message telling the contact that someone is trying to reach them.”
That is the honest state of the public route in 2026. A stranger can reach a form. What arrives at the other end may be a notification that someone tried, rather than the message itself.
What a privacy service adds on top of that
Mostly a different relay and a different operator. The registrar says “We replace your information with an alternate contact”, and describes account-level alerts sent to a verified phone number covering domain lock changes, privacy on and off changes, contact information changes and DNS changes. Those alerts are a security feature rather than a concealment one, and they are arguably the clearer reason to buy.
Coverage, exclusions, and what is not deleted
Two limits matter more than the marketing. The first is coverage: the service is “available for most top-level domains (gTLDs)”, with named exclusions including country-code and regulated extensions such as .CA, .DE, .US and .UK.COM. The policy quoted above governs generic top-level domains, so a country-code domain is a separate regime with its own rules and its own answer.
The second is retention. The registrar states that “we cannot remove data we retain for an active domain name holder” and that as an accredited registrar “we are contractually obligated to keep certain data regarding registered name holders”. Privacy here means not displaying, not deleting.
One page on the registrar’s own site is worth reading with the date in mind. Its data-protection explainer describes masking applied “for EU residents”, which reflects the earlier, residency-based arrangement rather than the 2025 policy quoted above, and the same page references a transfer framework that is no longer current. Pages outlive the regimes they describe, so check the dated policy rather than the explainer.
Deciding domain privacy or public WHOIS for beginners
For a first domain, domain privacy or public WHOIS for beginners comes down to five checks rather than a yes or no:
- Look up your own domain on any public lookup and read which lines actually show values.
- Check whether the organization line is populated, since that one is optional under the policy.
- Confirm your extension is a generic top-level domain, because country-code rules differ.
- Try the published contact form yourself and see what the far end receives.
- Decide if you are buying concealment, which may already exist, or alerts and a different relay, which do not.
Frequently Asked Questions
These come up once a reader has looked at a live record and found it emptier than expected.
If my details are already redacted, is the paid service pointless?
Not pointless, but the value has moved. The redaction of name, street, postal code, phone and email is now a policy requirement. What a paid service adds is a substituted contact, its own relay and, in this case, account change alerts.
Can anyone still find out who owns a domain?
Not from the public record alone for a generic top-level domain, because the identifying fields are redacted. The public record still shows the domain, its registrar, its creation date, its status and the registrant country.
Will a privacy service stop spam to my address?
It changes what is displayed rather than what has already been collected, and it does not erase anything the registrar is required to retain. Records scraped before redaction are outside any provider’s control.
Does this apply to country-code domains such as .US?
No. The policy quoted here covers generic top-level domains, and the privacy product itself excludes several country-code and regulated extensions, .US among them. Those run under their own registry rules.
You can read the service description and its exclusions on the registrar’s own site:
Bottom line
The fields a privacy add-on promises to hide are, for generic top-level domains, already withheld under a dated consensus policy, while the country line stays public either way. Before paying, look up your own record, check the organization line, and test the contact form to see what actually gets through.
