Congrats from 123-Reg! You can now pay us an extra £6 or £12 a year for basically nothing
We'll just tack that on your .uk domain bill. You're welcome!
Analysis UK domain name holders are furious with registrar 123-Reg for automatically charging them an additional £6 a year for a service few of them want or even need.
Thousands of .uk domain owners have been informed this week that 123-Reg is "adding advanced protection features" to their domain in the next few weeks. The "upgrade" will happen automatically, and comes with three main advantages, according to the company:
- Guaranteed domain renewal
- Safeguard against theft
- Hiding your personal information
There are two big problems however: first, the service is completely unnecessary for the vast majority of .uk domain owners; and second, 123-Reg is automatically enrolling its customers and charging them £5.99 a year for the pleasure. UK domain names themselves only cost £10, or so, a year.
Incredibly, the company even tries to persuade its customers that they are getting a bargain. "As you are a valued customer, we have reduced the price for Domain Ownership Protection to £5.99 per year, saving you 50 per cent compared to buying new," reads an email from the registrar to its punters.
To make matters worse, this new protection service – which has been put together by UK registry Nominet following pressure from the industry – has yet to be finalized. And Nominet has made it plain that it doesn't think the service is really necessary anyway.
So what is going on?
It's all to do with the new European data privacy legislation, GDPR, and the global domain name registration service known as Whois.
Until earlier this year, owners of .uk domain names often had their personal information – including address, phone number, and email address – publicly listed in the Whois database.
For those who didn’t want that information made readily available online, registrars offered a "proxy service" where the registrars would add their own generic information in a domain name's registration records for an annual fee. Thus, if you looked up the details of a proxy-protected domain, you'd get an address for the registrar, and not the domain owner, safeguarding the privacy of the registrant.
Whois privacy shambles becomes last-minute mad data scrambleREAD MORE
However, when GDPR came into force in May this year, registries – and even global DNS overseer ICANN – concluded that posting any personal information to the internet without people's explicit permission was verboten. As such everyone, including Nominet, decided to redact all domains' personal information.
There are legitimate reasons for people to access the Whois domain information, however, and so new systems are being created that will allow approved organizations – such as the cops – to access that information through a special login to Nominet's systems. (Nominet also added a system where people can opt out of GDPR protections, and say they do want their details made public.)
Under pressure from registrars – who made a significant amount of income from the previous proxy service – Nominet agreed that it would also create a new proxy service, even though people's data will not be made public anyway.
Pay for delay
The only advantage to this new service is that it will force third parties like copyright lawyers and police forces to go through a second process before getting hold of domain-name registration information.
Instead of logging in and seeing the details immediately, a domain name that has the new service would require the third party to demand the details through Nominet. A registrar would be obliged to provide them to law enforcement within 24 hours, and to anyone else within 48 hours.
So for £6 a year – soon to be £12 a year – domain-name owners can buy themselves an extra obstacle between themselves and prying investigators, specifically, up to a 48-hour delay in certain third parties being given their personal information. That may be something some domain owners want, but it will be of limited appeal to the vast majority of domain name holders, most of whom see no real value in it. Remember, everyone's details are hidden from the hoi polloi by GDPR, anyway.
In a consultation on the new service held last month, Nominet COO Eleanor Bradley made it plain that the registry doesn't see much value in the service, either. "In a post-GDPR world, with personal data redacted from the .UK Whois, there may be a diminishing demand for services offering privacy," she commented. "However, we prefer to have the small number of registrars offering proxy services doing so within a recognised framework."
She noted that Nominet expects the proposed framework to cover "a limited number of domains" and that the service will still have to provide "relevant data at short notice."
Well, 123-Reg is keen to prove Nominet wrong by automatically signing up its customers to the service by dressing it up as a safeguard against theft.
While it would be harder for someone to get hold of a domain name's information through the new service, most registrars already offer protection services for high-value domain names, anyway.
As a result, the decision to automatically push customers onto the new service rather that require them to opt-in, has left many angry.
"Clarify your intent here!" roared one unhappy customer on Twitter. "It reads that you will upgrade my domain subscription to include an additional cost service, at some random date, without explicit consent, without an opt-out process and without actually activating it."
123-Reg got back to that customer insisting that it was not automatic, stating: "Please read the full email – 'Your domains will remain under their current privacy settings until you have activated Domain Ownership Protection.'"
But the wording of the email makes it plain that the service will be added – and charged for – automatically. "What happens next?" it reads. "We'll take care of the upgrade for you - there is nothing you need to do."
Several Reg readers have also been in touch, attaching copies of the emails they received, and complaining about the apparent lack of an opt-out to the new charge. We have contacted 123-Reg, and will update this story if and when they get back.
We should note that this is not the first time 123-Reg has done something like this. In September last year, it infuriated customers by automatically registering their .co.uk domain names under the new .uk address, arguing that they were free for two years. But those domains will stop being free next year, at which point customers will presumably faced another automated charge for a service that didn't ask for and in many cases don't want.
It also doubled registration fees the year before that for no apparent good reason, again maddening customers.
Rotten at the top
It's not just 123-Reg either: Nominet itself has faced repeated criticism for its own money-grubbing ways. The company has repeatedly bumped up the price of .uk domain names with little justification in order to fund a commercial push into the broader domain name market as well as invest in any technological buzzword issue that strikes its executives as interesting.
While using its monopoly in .uk names to fund a series of unsuccessful commercial expansions, Nominet has also abandoned its charitable trust, banking the money it saved in the process. And to make sure no one is aware of what is going on inside the member organization, it has stopped posting board reports and other critical information, while at the same time paying its board and senior staff massive bonuses and pay rises.
Faced with that culture at the top, perhaps it shouldn't be surprising that 123-Reg would seek to suck as much money as possible out of domain name holders by forcing a service on them that few will want or need. ®
Sponsored: Becoming a Pragmatic Security Leader