Cybersquatting and Domain Name Law: UDRP, ACPA, and How to Reclaim Your Brand

A $100,000-Per-Domain Law and Why It Still Isn't Enough

In 1999, Congress passed the Anticybersquatting Consumer Protection Act (ACPA) after finding that bad actors were registering thousands of trademarked names as domain names and then demanding ransoms. Statutory damages range from $1,000 to $100,000 per infringing domain—yet cybersquatting complaints to ICANN's arbitration system still exceed 7,000 cases per year. Two distinct legal regimes now govern domain name disputes: the Uniform Domain-Name Dispute-Resolution Policy (UDRP), administered internationally by ICANN-accredited providers, and the ACPA, a U.S. federal statute. Understanding both is essential for any brand owner who discovers a squatter has registered their name.

How Cybersquatting Works

Cybersquatting is the bad-faith registration of a domain name that is identical or confusingly similar to a trademark, personal name, or brand, with the intent to profit from the goodwill of the mark's owner. The practice exploded in the mid-1990s when domain registration costs dropped to $35 and the commercial value of an internet address became clear. Common forms include:

• Classic squatting: Registering a famous brand's .com before the brand owner does, then demanding payment.
• Typosquatting: Registering misspelled versions (e.g., "gooogle.com") to capture traffic from typing errors.
• Reverse domain hijacking: A trademark owner filing a UDRP complaint in bad faith to wrest a legitimately registered domain from its owner.
• Gripe sites: Registering "[brandname]sucks.com" for criticism—often protected speech, but contested in UDRP proceedings.

The UDRP: Fast, Cheap, and International

The Uniform Domain-Name Dispute-Resolution Policy, mandatory for all generic top-level domain registrations since 1999, provides a faster and cheaper alternative to federal litigation. The UDRP process is administered by accredited dispute resolution providers, most prominently the World Intellectual Property Organization (WIPO) and the Forum.

To prevail under the UDRP, a complainant must prove all three elements: (1) the domain is identical or confusingly similar to a trademark in which the complainant has rights; (2) the registrant has no rights or legitimate interests in the domain; and (3) the domain was registered and is being used in bad faith.

Proving Bad Faith Under the UDRP

The bad-faith element is the most contested. UDRP panels have identified several circumstances that constitute evidence of bad faith:

• Offering the domain for sale to the trademark owner at above-registration-cost price.
• Registering the domain primarily to disrupt the business of a competitor.
• Using the domain to attract users commercially by creating confusion with the complainant's mark.
• Registering a domain without using it ("passive holding")—which WIPO panels have found sufficient when the mark is famous and no plausible good-faith use is conceivable.

The landmark WIPO case Telstra Corp. v. Nuclear Marshmallows (2000) established that passive holding of a domain can constitute bad faith, overcoming the argument that a dormant site cannot cause harm.

The ACPA: When You Need Money Damages

The ACPA, codified at 15 U.S.C. § 1125(d), supplements the UDRP by providing monetary remedies available only through federal court. A plaintiff must show the defendant had a "bad faith intent to profit" from a mark that was distinctive or famous at the time of registration. Courts weigh nine statutory factors in assessing bad faith intent:

Strategies for Brand Owners

Brand owners facing cybersquatting should first assess whether the UDRP or ACPA (or both) is appropriate. UDRP is faster and cheaper when the sole goal is recovering the domain. ACPA litigation is appropriate when significant damages are sought or when the squatter has caused substantial commercial harm. Preventive strategies include registering domains across major TLDs before launching a brand, using domain monitoring services that alert owners when similar names are registered, and enrolling in ICANN's Trademark Clearinghouse, which provides priority notification rights for new gTLD launches.

This article is for informational purposes only and does not constitute legal advice. Consult a qualified attorney for legal guidance specific to your situation.