Anticybersquatting Consumer Protection Act: Bad Faith and Remedies

The Anticybersquatting Consumer Protection Act is a federal law, codified at 15 U.S.C. § 1125(d), that lets trademark owners sue anyone who registers, traffics in, or uses an internet domain name in bad faith to profit from someone else’s trademark.¹ It took effect on November 29, 1999, and remains the primary U.S. statute aimed at cybersquatting, where speculators register domains built around well-known brand names or personal names and then try to sell them to the rightful owner or exploit the traffic they attract.

What the Law Prohibits

The ACPA creates civil liability for any person who, with a bad faith intent to profit from another’s trademark, registers, traffics in, or uses a domain name that is identical to, confusingly similar to, or dilutive of a distinctive or famous mark.² Congress had specific abuses in mind: speculators registering hundreds of brand-name domains to extort trademark owners, operators redirecting consumers to pornographic or counterfeit sites to exploit a mark’s reputation, and registrants warehousing domains they never intended to use legitimately.¹

A separate provision, 15 U.S.C. § 1129, protects the personal names of living individuals. It imposes liability on anyone who registers a domain name consisting of another living person’s name, or a confusingly similar variation, without consent and with the specific intent to profit by selling it.³ This matters because the ACPA’s main trademark provision requires a distinctive or famous mark, and not every person qualifies.

How Courts Decide Bad Faith

Everything under the statute turns on whether the registrant acted in bad faith, so Congress spelled out nine factors courts may weigh. The list is non-exhaustive, and courts can look beyond it, but these factors set the framework:²

Whether the registrant holds any trademark or other intellectual property rights in the domain name.
Whether the domain consists of the registrant’s legal name or a name commonly used to identify them.
Whether the registrant previously used the domain in connection with a genuine offering of goods or services.
Whether the registrant is making a bona fide noncommercial or fair use of the mark on the site.
Whether the registrant intends to divert consumers away from the mark owner’s site in a way that harms the mark’s goodwill, either for commercial gain or to tarnish the mark.
Whether the registrant has offered to sell the domain to the mark owner or a third party for financial gain without intending to use it legitimately, or has a pattern of doing so.
Whether the registrant provided materially misleading false contact information at registration, or has a pattern of doing so.
Whether the registrant has acquired multiple domains they know are identical or confusingly similar to others’ distinctive marks or dilutive of famous marks.
The extent to which the mark incorporated in the domain name is distinctive and famous.

The statute also contains a safe harbor: bad faith “shall not be found” when the registrant genuinely believed, and had reasonable grounds to believe, that the use was a fair use or otherwise lawful.² Courts read it narrowly. In Virtual Works, Inc. v. Volkswagen of America (2001), the Fourth Circuit said “all but the most blatant cybersquatters will be able to put forth at least some lawful motives for their behavior,” and warned that reading the safe harbor too broadly “would frustrate Congress’ purpose by artificially limiting the statute’s reach.”⁴ The Fourth Circuit later clarified, in the 2023 Prudential case, that the safe harbor needs objective corroboration and cannot rest on a defendant’s self-serving denials of knowledge about a trademark.⁵

Remedies

A trademark owner who wins under the ACPA has several tools:

Forfeiture, cancellation, or transfer of the infringing domain to the trademark owner.
Temporary restraining orders and preliminary or permanent injunctions.
Statutory damages between $1,000 and $100,000 per domain name, at the court’s discretion, in place of proving actual harm. Courts must waive these damages if the registrant had reasonable grounds to believe the use was lawful.
Actual damages and the defendant’s profits, as an alternative to statutory damages.
Attorneys’ fees in exceptional cases.

Statutory damages are not available for domains registered before the law’s November 29, 1999 effective date.¹

Suing the Domain Itself

When a trademark owner cannot locate the registrant or cannot establish personal jurisdiction over them in any U.S. court, the ACPA lets the owner file an in rem lawsuit against the domain name itself.⁶ Congress built this in because many cybersquatters registered domains with false contact information or operated from countries beyond the reach of American courts.

To use the in rem route, the trademark owner must show due diligence in trying to find the registrant, typically by sending notice to the contact information in the domain’s registration records and publishing notice as the court directs. Jurisdiction lies in the district where the domain registrar or registry sits.⁷ Remedies are limited to forfeiture, cancellation, or transfer. No money damages.⁶

ACPA Versus the UDRP

The ACPA is not the only route. ICANN’s Uniform Domain-Name Dispute-Resolution Policy offers an administrative alternative, and trademark owners often choose between the two based on the complexity of the dispute and what they need out of it.

The UDRP is fast and relatively cheap. Cases typically resolve within about 60 days of filing, with filing fees running roughly $1,500 to $5,000 depending on how many domains are at issue.⁸ Complaints are filed online, and there is no discovery or testimony. The trade-off: the only remedy is transfer or cancellation. No damages, no injunctions, no fee awards.

The ACPA is full federal litigation with the expense and delay that entails. Its remedies are broader, and it expressly protects personal names, which the UDRP does not unless the complainant can prove established service mark rights in their name.⁹

UDRP rulings are not necessarily final. Either party can go to federal court to prevent or reverse a UDRP decision. In Barcelona.com v. Excelentisimo Ayuntamiento de Barcelona (2003), the Fourth Circuit ruled that federal courts owe “no deference” to UDRP panel decisions, described the UDRP process as “adjudication lite,” and held that a court’s reading of the ACPA supplants a UDRP panel’s. Because UDRP decisions can rest on principles “foreign or hostile to American law,” the ACPA lets a court reverse a UDRP outcome whenever the Lanham Act requires a different result.¹⁰

What Counts as a Domain Name

The statute defines “domain name” broadly and neutrally: any alphanumeric designation registered with or assigned by a domain name registrar, registry, or other registration authority as part of an electronic address on the internet.¹ That reach covers domains under newer generic top-level domains like .app, .shop, and .tech, not just the .com, .net, and .org extensions common when Congress wrote the law.

There are limits. In GoForIt Entertainment LLC v. DigiMedia.Com LP, a federal court in the Northern District of Texas held that subdomains are not actionable under the ACPA because they are not registered with a domain name registration authority. Only the second-level domain, the portion directly to the left of the top-level extension, meets the statute’s registration requirement.¹¹ Screen names and file names also fall outside the statute.

Key Court Decisions

Sporty’s Farm v. Sportsman’s Market (2d Cir. 2000)

The first federal appellate decision interpreting the ACPA. Omega Engineering registered “sportys.com” in 1995 and later transferred it to a newly created subsidiary that sold Christmas trees under the name “Sporty’s Farm.” Sportsman’s Market, which had long run a catalog business under the “Sporty’s” mark, sued. The Second Circuit found “overwhelming evidence” of bad faith: Omega had no intellectual property rights in the name, had not used the domain for legitimate commerce until after litigation began, and had transferred it to a subsidiary under suspicious circumstances. The court ordered Sporty’s Farm to relinquish the domain. Damages were denied because the registration predated the statute.¹²

Shields v. Zuccarini (3d Cir. 2001)

The first appellate case holding that “typosquatting” violates the ACPA. John Zuccarini, a serial domain registrant who had acquired thousands of misspelled versions of popular names and brands, registered five variations of “Joe Cartoon,” a site run by graphic artist Joseph Shields. Visitors who mistyped the address were redirected to advertising pages. After being sued, Zuccarini converted the sites into supposed “political protest” pages, which the Third Circuit rejected as a “spurious explanation cooked up” after the lawsuit was filed. The court affirmed $10,000 in statutory damages per domain name and $39,109.46 in attorneys’ fees, finding the case “exceptional.”¹³

Lamparello v. Falwell (4th Cir. 2005)

The case that tested the ACPA against the First Amendment. Christopher Lamparello registered “fallwell.com” in 1999 to host a site criticizing Reverend Jerry Falwell’s views on homosexuality. The site carried a disclaimer of non-affiliation and linked to Falwell’s official site. The Fourth Circuit reversed a district court injunction, holding that Lamparello’s use was noncommercial, constituted bona fide criticism, and lacked any bad faith intent to profit. Trademark law, the court said, does not give mark owners the right “to control language” or “shield itself from criticism by forbidding the use of its name in commentaries critical of its conduct.”¹⁴

Prudential v. Shenzhen Stone Network (4th Cir. 2023)

This decision addressed what counts as a “registration.” Prudential sued over “pru.com,” which a Chinese company called Shenzhen Stone Network had bought on the open market in 2017 for $100,000. The domain sat largely idle, redirecting to a parked page with ads for Prudential and its competitors. Prudential, which had held trademarks for “PRU” since 2002, tried to buy the domain, and when SSN refused a $50,000 offer, Prudential filed an in rem action in the Eastern District of Virginia.¹⁵

The Fourth Circuit held that “registration” is not limited to the very first time a domain is created. Renewals, transfers to new owners, and changes to registration records all qualify as re-registrations that can trigger ACPA liability. That reading aligned the Fourth Circuit with the Third and Eleventh, which had reached the same conclusion in Schmidheiny v. Weber (2003) and Jysk Bed’N Linen v. Dutta-Roy (2015). The Ninth Circuit remains the outlier, having held in GoPets Ltd. v. Hise (2011) that only the initial creation of a domain counts as a registration.⁵ The split matters because many valuable domains were originally registered decades ago by parties unrelated to today’s holder, and the narrow reading would effectively immunize later acquirers.

Criticisms and Limits

One longstanding concern is “reverse domain name hijacking,” where a trademark owner uses the threat of an ACPA lawsuit to seize a domain from a registrant who has a legitimate claim to it. The bad faith factors and safe harbor are supposed to prevent this, but commentators have argued the balance is hard to hold in practice, given how the cost of federal litigation can pressure small domain holders into surrendering names rather than fighting.⁴

The statute has also struggled to keep pace with the internet it was written for. Congress drafted the ACPA when domain names were the main way consumers found businesses online. Social media account squatting, private registration services that shield registrant identities, and the liability of international registrars fall largely outside its reach. The unresolved circuit split on re-registration adds further uncertainty for trademark owners and domain holders depending on which part of the country they are in.⁴¹⁵

1
GovInfo. Senate Report 106-140, Anticybersquatting Consumer Protection Act
2
Cornell Law Institute. 15 U.S. Code § 1125
3
Office of the Law Revision Counsel. 15 U.S.C. § 1129, Cyberpiracy Protections for Individuals
4
UNLV Scholars. Cybersquatting Analysis
5
Wiley Law. Fourth Circuit Finds Re-registration of a Domain Can Be Cybersquatting
6
Berkeley Technology Law Journal. In Rem Jurisdiction Under the ACPA
7
Columbia Academic Commons. In Rem Jurisdiction and Domain Names
8
Mintz. Remedies for Cybersquatting: A Comparison of the UDRP and ACPA
9
Fenwick & West. UDRP Versus ACPA
10
FindLaw. Barcelona.com v. Excelentisimo Ayuntamiento de Barcelona
11
Traverse Legal. Are Subdomains Actionable Under ACPA
12
Justia. Sporty’s Farm L.L.C. v. Sportsman’s Market, Inc.
13
FindLaw. Shields v. Zuccarini
14
FindLaw. Lamparello v. Falwell
15
Boston College Law Review. The ACPA Circuit Split on Re-registration