Privacy Lookup

It queries the domain's public RDAP record, the modern standardized replacement for WHOIS, and inspects the registrant contact entry for a name, organization, email, phone number, and country. If those fields contain real-looking personal or business details, they're flagged as exposed; if they're missing entirely or clearly belong to a privacy/proxy provider, the domain is reported as protected.

There's a difference between paying for a WHOIS privacy add-on and a registry redacting data by default. Since GDPR took effect in 2018, most major gTLD registries (.com, .net, .org, and others) stopped publishing registrant PII in RDAP records for every domain automatically, regardless of whether the owner purchased privacy protection — so 'Redacted by Registry' simply means that baseline protection is already in effect.

This is uncommon for modern gTLDs but does happen with some country-code TLDs (ccTLDs) that have their own registry policies not bound by GDPR, older cached records, or registrars that didn't enable privacy protection by default at registration time. If you see real contact details here and didn't intend that, check your registrar's account settings for a WHOIS privacy or ID protection option.

It depends on the registrar — many now include basic WHOIS privacy at no extra cost as a standard feature, while others charge a small annual fee for a dedicated privacy/proxy service that swaps in its own contact details. Either way, most registries also apply their own baseline redaction regardless of what your registrar offers, which is why so many domains show as protected even without an explicit paid add-on.

Certain legal processes, like a UDRP domain dispute or a subpoena, can compel registrars and privacy services to reveal the underlying registrant details even when they're publicly hidden. Day-to-day, though, a privacy or proxy service reliably keeps the real owner's contact information out of public RDAP and WHOIS lookups, with the provider's own details shown instead.