Yes. Cybersquatting is illegal in the United States, where the ACPA (Anticybersquatting Consumer Protection Act, 15 U.S.C. 1125(d)) makes it a civil violation to register, traffic in or use a domain name that is identical or confusingly similar to someone else’s distinctive trademark with a bad faith intent to profit from that mark. Outside the courtroom, cybersquatting is also prohibited everywhere for generic top-level domains by the UDRP (Uniform Domain-Name Dispute-Resolution Policy), a contractual rule every gTLD registrant agrees to when registering. Two qualifications matter. The ACPA is a civil statute, so a cybersquatter is sued, not arrested, and in most countries cybersquatting is a civil wrong rather than a crime. And the word only covers registering a name to trade on someone else’s trademark; registering a domain that someone else would like to own is not, by itself, illegal. For the definition and the tactics squatters use, see our page on what cybersquatting is.
What the ACPA requires a trademark owner to prove
The ACPA, enacted in 1999, gives a trademark owner a claim against a domain registrant when three things are true: the mark was distinctive or famous when the domain was registered, the domain is identical or confusingly similar to the mark, and the registrant had a bad faith intent to profit from the mark. That third element is the one most cases turn on.
Congress supplied nine factors a court may weigh in deciding bad faith. Several point toward innocence: the registrant’s own rights in the name, a domain that is the registrant’s legal name, prior use for a genuine business, and noncommercial or fair use of the mark. Others point toward guilt: an intent to divert consumers from the mark owner’s site, an offer to sell the domain without having used it, false contact information in WHOIS (the public registration record for a domain name), and a pattern of registering domains that match other people’s marks. No single factor decides a case, and the statute adds a safe harbor: bad faith “shall not be found” where the registrant reasonably believed the use was fair or otherwise lawful.
Remedies under the ACPA
A successful plaintiff can obtain transfer or cancellation of the domain, an injunction, the defendant’s profits, actual damages and costs, or can elect statutory damages instead of proving loss. The Senate Judiciary Committee report accompanying the Act describes that remedy as “not less than $1,000 and not more than $100,000 per domain name, as the court considers just,” and the same report recorded that by May 1999 one London computer club had registered over 75,000 domain names by automated program, according to U.S. Senate Report 106-140 on the Anticybersquatting Consumer Protection Act. That range, now at 15 U.S.C. 1117(d), is per domain, which makes the ACPA a serious threat to bulk registrants.
Holding a domain for ransom is cybersquatting
The ACPA reaches beyond the classic case of a stranger registering a brand name. In DSPT International v. Nahum, the Ninth Circuit affirmed a $152,000 jury verdict against a former employee who registered his employer’s domain and withheld it to extract disputed commissions. The court held that a person is liable under the statute “if he subsequently uses the domain name with a bad faith intent to profit from the protected mark by holding the domain name for ransom,” and the award included roughly $31,572 the company spent rebuilding its website, as set out in the Ninth Circuit’s opinion in DSPT International, Inc. v. Nahum. A developer, contractor or ex-employee who registered the company’s domain in good faith can therefore become a cybersquatter the moment the name is withheld to force a payment.
In rem actions when the registrant cannot be found
Cybersquatters often hide behind false contact details or live outside the court’s reach. The ACPA anticipates this with an in rem provision, an action against the domain name itself rather than against a person, filed in the district where the registrar or registry is located when the registrant cannot be found or reached. The remedy is limited to transfer or cancellation, with no damages, but for a plaintiff whose only goal is the name, that is enough.
The UDRP is a contract, not a law
The UDRP prohibits the same conduct on a different footing. It is not legislation; it is a policy ICANN requires every accredited registrar to build into its registration agreement, so a registrant is bound by contract to submit to an administrative proceeding if a trademark owner files a complaint. A panel can order the domain transferred or canceled, and nothing more: no damages, no injunction, no finding that binds a court. Because it applies worldwide to gTLDs regardless of where the parties live, the UDRP handles the overwhelming majority of cybersquatting disputes, with court actions reserved for cases that need damages or discovery. Our comparison of UDRP, URS and ACPA sets the three procedures side by side.
What is not cybersquatting
The limits of the definition matter as much as the definition. Registering a dictionary word or descriptive phrase for its ordinary meaning is lawful, even if a company later builds a brand on that word, because the mark must exist and be targeted at the time of registration. A domain registered before the trademark existed is not cybersquatting. A reseller who uses a brand name in a domain to sell that brand’s genuine goods, and says so clearly, generally has a legitimate interest. A criticism site that uses a mark to identify its subject, without commercial motive, is protected. And personal names are a special case: the ACPA has a separate provision against registering a living person’s name to sell it for profit, but a name never used as a trademark cannot support an ordinary cybersquatting claim. Each of these is a dispute of a different kind, covered in our guide to the types of domain name disputes. Cybersquatting is also distinct from theft: a stolen domain involves no trademark question, only an unauthorized transfer, and belongs to the remedies in our domain hijacking hub.
Cybersquatting outside the United States
Few countries have a statute written specifically for cybersquatting. Most treat it under general trademark, unfair competition or passing-off law, and many country-code top-level domains have their own dispute policies adapted from the UDRP. A UDRP complaint is available for any gTLD domain anywhere in the world, while a ccTLD domain and any claim for money depend on the country concerned. Whatever the local label, registering someone else’s mark to profit from it is treated as wrongful almost everywhere.
How DNAccess helps with cybersquatting matters
Whether a case belongs in a UDRP proceeding or a federal court turns on evidence: when the domain was registered, what the registrant knew and how the name has been used. We assemble that record from registration history, WHOIS and DNS archives and captured page content, and I have testified as an expert witness in domain name litigation. If you are not certain your name is protectable, our guide on how to trademark a domain name explains the first step. For a specific domain, contact us and we will say which remedy fits.