Is Domain Squatting Illegal? ACPA, UDRP, and Bad Faith

Yes, domain squatting is illegal when someone registers, traffics in, or uses a domain name that copies or closely mimics another party’s trademark with a bad faith intent to profit from it. The federal Anticybersquatting Consumer Protection Act, codified at 15 U.S.C. § 1125(d), makes that conduct a civil violation and lets the trademark owner force a transfer of the domain and collect statutory damages of up to $100,000 per name.¹² Registering a domain someone else merely wants is not illegal. Registering one that trades on their brand is.

What the Law Actually Prohibits

Congress passed the ACPA in 1999 to shut down a very specific practice: grabbing domain names that match established brands and then exploiting their value. Two things have to line up before the law applies. First, the domain has to be identical or confusingly similar to a distinctive trademark, or confusingly similar to or dilutive of a famous one. Second, the person who registered or is using it has to have a bad faith intent to profit from that mark.¹

The statute also reaches names protected by other federal law, such as the Red Cross emblem and Olympic Committee marks. Personal names count too when they function as protected marks, so squatting on a celebrity’s name can violate the ACPA the same way squatting on a corporate brand does.¹

How Courts Decide Whether Someone Acted in Bad Faith

Bad faith is the pivot of every ACPA case. The statute gives courts nine non-exhaustive factors to weigh, and no one factor decides the question. Courts can also look at evidence outside the list.¹

Signals that point toward bad faith include:

Offering to sell the domain to the trademark owner or a third party for a profit, without ever having used it for a real business.
Providing false contact information at registration or failing to keep it accurate.
Registering a stockpile of domains that mirror other people’s trademarks, showing a pattern.
Setting up the domain to divert traffic away from the trademark owner’s site, especially for ad revenue or to tarnish the brand.
Targeting a highly distinctive or famous mark, which is harder to have picked innocently.

The same statute lists factors that cut the other way. A registrant who holds their own trademark rights in the name, is commonly known by it, uses the domain for a legitimate business, or runs a genuine noncommercial site such as a fan page or parody has real ground to stand on.¹

When Registering a Domain Name Is Not Illegal

Plenty of domain activity has nothing to do with cybersquatting. The ACPA includes a safe harbor: a court cannot find bad faith if the registrant “believed and had reasonable grounds to believe that the use of the domain name was a fair use or otherwise lawful.”¹ That is a meaningful protection for anyone who registered a name in good faith and only later heard from a trademark owner.

The dividing line between squatting and ordinary domain investing is whether the name belongs to someone as a trademark. Generic or descriptive terms like shoes.com or insurance.com are not trademarks in their descriptive sense, and buying and reselling common-word domains falls outside the ACPA. Registering CocaCola-deals.com hoping the company will pay to get it back does not. Criticism and commentary sites generally sit within protected noncommercial use, though the analysis gets harder once ad revenue is involved.

Typosquatting Counts Too

One of the most common squatting patterns is typosquatting: registering a domain that is a slight misspelling or visual lookalike of a known brand. A swapped letter, a dropped character, a different top-level domain like .co in place of .com — the goal is to catch people who mistype a URL and land them on ad-filled pages, phishing forms, or “for sale” notices. Courts and UDRP panels routinely treat these registrations as bad faith because there is no innocent reason to register a misspelling of a famous brand.

What Happens to Someone Who Cybersquats

A trademark owner who wins under the ACPA can obtain a court order canceling the domain or transferring it to them. They can also elect statutory damages between $1,000 and $100,000 per infringing domain name, “as the court considers just,” at any time before final judgment.² In particularly egregious cases, courts can add attorney’s fees and the defendant’s profits on top.

Two boundaries are worth naming. The ACPA is a civil statute, not a criminal one, so a violation leads to a court order and money damages rather than jail time. And the law targets the person who registered or is using the domain in bad faith, not the registrar that sold it.

How a Trademark Owner Fights Back

Someone whose mark has been squatted on has two main paths, and they lead to different places.

The UDRP: Faster and Cheaper

The Uniform Domain-Name Dispute-Resolution Policy is an administrative process run through ICANN. Every registrar agrees to follow it, which means every person who registers a domain has already consented to the process.³ To win a UDRP complaint, the trademark owner must prove all three of the following:

The domain is identical or confusingly similar to a trademark in which they have rights.
The registrant has no rights or legitimate interests in the domain.
The domain was registered and is being used in bad faith.

Missing any one of those elements sinks the complaint.³ Note the “and” in the third element: the UDRP requires bad faith at registration and in current use, which is stricter than the ACPA’s “or.”

Filing fees for a single-panelist decision run about $1,500 at WIPO for one to five domains and $1,330 at Forum for one to two domains, rising to $1,480 for three to five.⁴⁵ ICANN has also approved the Asian Domain Name Dispute Resolution Centre, the Canadian International Internet Dispute Resolution Centre, and the Czech Arbitration Court.⁶ Most disputes resolve in roughly 60 days: the registrant has 20 days to respond, and a panel is typically appointed and issues a decision within 14 days after that.⁷

The catch: the only remedy a UDRP panel can order is cancellation or transfer of the domain. No money changes hands.³ A losing registrant also has 10 business days after the decision to file a lawsuit and freeze the transfer, which rarely happens but keeps the outcome from being truly final.

The ACPA Lawsuit: Slower, Costlier, More Powerful

A federal court action under the ACPA is slower and can run into tens of thousands of dollars in legal costs, but it delivers what the UDRP cannot: monetary damages, discovery, and the full authority of a federal court. Courts can transfer the domain, award the statutory damages described above, and in strong cases add fees and defendant profits.² Discovery matters when the squatter’s identity or the scope of their operation is unclear, because UDRP panels work only from written submissions and cannot compel evidence.

Suing the Domain Itself

Sometimes the squatter is anonymous, has used fake registration details, or sits in another country beyond the reach of U.S. courts. The ACPA lets the trademark owner sue the domain name itself in that situation, through an in rem action filed in the federal district where the registrar or registry is located. Notice has to go to the registrant at the addresses on file with the registrar, along with any published notice the court orders.¹ The tradeoff is that the only available remedy is cancellation, transfer, or forfeiture of the domain. No statutory damages, no actual damages, no attorney’s fees.

Which Path Fits Which Situation

For a straightforward parking page or a “for sale” domain, the UDRP is usually the better starting point: it costs a fraction of a lawsuit and resolves in about two months. A federal lawsuit fits when the trademark owner wants financial damages, the facts are complex enough that discovery would help, or the squatter is running a sophisticated operation across many domains. An in rem action becomes the fallback when the registrant cannot be identified or reached despite reasonable effort. Filing a federal lawsuit while a UDRP proceeding is pending can cause the panel to suspend or terminate the administrative case, so the two tracks need to be coordinated rather than run in parallel by default.⁷

1
Office of the Law Revision Counsel. 15 USC 1125 – False Designations of Origin, False Descriptions, and Dilution Forbidden
2
Office of the Law Revision Counsel. 15 USC 1117 – Recovery for Violation of Rights
3
ICANN. Uniform Domain Name Dispute Resolution Policy
4
World Intellectual Property Organization. Schedule of Fees Under the UDRP
5
Forum. UDRP Fee Schedule
6
ICANN. List of Approved Dispute Resolution Service Providers
7
ICANN. Rules for Uniform Domain Name Dispute Resolution Policy