Cybersquatting is registering, trafficking in, or using a domain name with a bad-faith intent to profit from someone else’s trademark. In the United States it is defined by the Anticybersquatting Consumer Protection Act of 1999, codified at 15 U.S.C. § 1125(d) as part of the Lanham Act. The mark owner must show two things: that the domain is identical or confusingly similar to a distinctive mark, or dilutive of a famous one, and that the registrant acted with bad-faith intent to profit from it.
That second element carries the whole doctrine. Owning a short, memorable, or valuable domain is not unlawful. Neither is selling domains, nor owning one that happens to match somebody’s brand. What the law forbids is the intent to extract value from a mark you do not own, and a domain dispute turns on proving or disproving that state of mind.
Congress declined to define bad faith and instead gave courts nine nonexclusive factors in § 1125(d)(1)(B)(i). Read them together and they sketch a portrait rather than a test:
Courts are explicit that this is not arithmetic. A registrant can lose while several factors point their way, and win while several point the other way. The factors exist to help a judge answer one question: was this person after the mark’s value, or the domain’s own value?
Attached to them is a safe harbor at § 1125(d)(1)(B)(ii): bad faith “shall not be found” where the court determines the registrant believed, and had reasonable grounds to believe, that the use was a fair use or otherwise lawful. Courts read it narrowly, reserving it for genuinely reasonable belief rather than optimistic self-assessment, but it is why honest mistakes and real disputes over a shared word do not become cybersquatting.
The foundational case is Sporty’s Farm L.L.C. v. Sportsman’s Market, Inc., 202 F.3d 489 (2d Cir. 2000), the first appellate decision under the ACPA. An aviation catalog business had used the mark “sporty’s” for decades; a rival’s affiliate registered sportys.com and later stood up a Christmas tree farm to justify it. The Second Circuit found the mark distinctive and the pretext transparent. It also held the ACPA’s injunctive relief reached domains registered before the statute took effect, while its damages provisions did not.
Three systems address the same conduct and deliver very different things. Choosing among them is the practical core of this area.
The ACPA is a federal lawsuit. It can order forfeiture, cancellation, or transfer, and it is the only one of the three that awards money. Under 15 U.S.C. § 1117(d), a plaintiff may elect, any time before final judgment, statutory damages of not less than $1,000 and not more than $100,000 per domain name in place of actual damages and profits. Attorney’s fees are available in exceptional cases. It also brings the full apparatus of litigation: discovery, jurisdictional fights, years, and cost.
The UDRP, the Uniform Domain-Name Dispute-Resolution Policy, is not law at all. It is a contract. Every registrant in a gTLD agrees to it through their registrar under ICANN’s rules, which is why it binds a registrant in any country without any court asserting jurisdiction. A complainant must prove three elements together: the domain is identical or confusingly similar to a mark in which the complainant has rights; the registrant has no rights or legitimate interests in it; and the domain was registered and is being used in bad faith. That conjunctive requirement is stricter than the ACPA’s, and it defeats complaints against domains registered innocently years before a brand existed. Proceedings run through providers such as WIPO and the Forum, take roughly two months, cost low thousands of dollars, and involve no discovery, no live testimony, and no damages. The only outcomes are transfer or cancellation.
The URS, Uniform Rapid Suspension, is a stripped-down cousin for new gTLDs. It demands clear and convincing evidence, resolves in weeks for a few hundred dollars, and does one thing: suspend the domain for the rest of its registration term. The complainant does not receive it. This is a fire extinguisher for obvious abuse, not a way to acquire anything.
Nothing forces a choice. Section 1125(d)(3) preserves other remedies, and a losing UDRP party can still go to federal court.
Cybersquatters are frequently anonymous, offshore, or both, which would ordinarily make a U.S. lawsuit impossible. Section 1125(d)(2) solves this by letting the mark owner sue the domain name itself as the defendant, in the judicial district where the registrar or registry is located, when personal jurisdiction over the registrant cannot be obtained or the registrant cannot be found after due diligence.
This is why so many domain cases appear in the Eastern District of Virginia, home to Verisign’s .com registry. The trade-off is strict: an in rem action can yield only forfeiture, cancellation, or transfer. No damages, against a defendant who is a string of text.
The doctrine is narrower than brand owners often assume. Genuine criticism sites generally fall outside it, because there is no intent to profit. In Lamparello v. Falwell, 420 F.3d 309 (4th Cir. 2005), a site at fallwell.com criticizing Jerry Falwell’s views on homosexuality was held not to violate the ACPA. Resellers, competitors, and people who simply got there first are likewise outside it absent proof of bad faith.
The law also protects the accused. Reverse domain name hijacking is the abuse of these systems by a mark owner trying to seize a domain the registrant legitimately holds. UDRP panels can formally declare it, which is a reputational sanction rather than a monetary one. The ACPA goes further: 15 U.S.C. § 1114(2)(D)(v) gives a registrant whose domain was suspended, disabled, or transferred under a registrar’s policy an affirmative civil action, and a court may order the domain reactivated or transferred back.
A separate provision, 15 U.S.C. § 8131 (formerly § 1129), covers personal names rather than trademarks: it reaches anyone who registers a domain consisting of a living person’s name, without consent, with the specific intent to profit by selling it. Remedies are injunctive only, plus possible costs and fees.
Liability runs to the registrant, not the intermediary. Registrars enjoy a statutory shield: § 1114(2)(D)(iii) provides that a registrar, registry, or other registration authority is not liable in damages for registering or maintaining a domain for another “absent a showing of bad faith intent to profit,” and § 1114(2)(D)(i) limits their exposure for complying with a court order or a dispute policy.
The Ninth Circuit went further in Petroliam Nasional Berhad v. GoDaddy.com, Inc., 737 F.3d 546 (9th Cir. 2013), holding the ACPA provides no cause of action for contributory cybersquatting at all. Because Congress created a new statutory claim where no common law claim existed, the court declined to graft secondary liability onto it. The consequence: pursue the registrant, and treat the registrar as a channel for relief rather than a target.
What is cybersquatting? Cybersquatting is registering, trafficking in, or using a domain name with a bad-faith intent to profit from someone else’s trademark, where the domain is identical or confusingly similar to a distinctive mark or dilutive of a famous one. It is defined in the United States by the Anticybersquatting Consumer Protection Act, 15 U.S.C. § 1125(d), enacted in 1999. Merely owning a valuable domain is not cybersquatting; the bad-faith intent is the entire offense.
What is the difference between the UDRP and the ACPA? The UDRP is a contractual arbitration process every registrant agrees to through ICANN. It is fast and cheap, has no discovery, and can only transfer or cancel the domain. The ACPA is a federal lawsuit that can order transfer or cancellation and also award actual damages, profits, attorney’s fees, or statutory damages of $1,000 to $100,000 per domain name. The UDRP also requires bad faith in both registration and use, while the ACPA requires only a bad-faith intent to profit.
How much can you sue for in a cybersquatting case? Under 15 U.S.C. § 1117(d), a plaintiff may elect statutory damages of not less than $1,000 and not more than $100,000 per domain name, chosen at the court’s discretion, any time before final judgment. The alternative is actual damages plus the defendant’s profits. Statutory damages are unavailable in an in rem action and were unavailable for domains registered before the ACPA took effect in 1999.
Is a criticism or gripe site cybersquatting? Usually not. The ACPA reaches only a bad-faith intent to profit, so a genuine noncommercial criticism site generally falls outside it. In Lamparello v. Falwell (4th Cir. 2005) the court found no ACPA violation for a site at fallwell.com that criticized Jerry Falwell’s views. The statute also has a safe harbor protecting anyone who reasonably believed the use was a fair use or otherwise lawful.
Going further: Domain Names and Cybersquatting, the practical guide .
This page is general legal information, not legal advice, and it does not create an attorney-client relationship.
The Ninth Circuit shielded a noncommercial gripe site from infringement and dilution claims but held that ACPA cybersquatting requires no commercial use.
The Ninth Circuit held that ACPA registration means initial registration only, so transferring a domain that predates the mark is not cybersquatting.
The Fourth Circuit held that a domain 'registration' actionable under the Anticybersquatting Consumer Protection Act includes later re-registrations, then sustained in rem jurisdiction over PRU.COM and a bad-faith finding against its Chinese owner.
The Ninth Circuit's answer to the original cybersquatter, holding that registering a famous mark as a domain name to sell it back to the owner was commercial use that diluted the mark under federal law.
How the Ninth Circuit imported initial interest confusion into web search, holding that a rival's domain name and hidden metatags could infringe a trademark even without point-of-sale confusion.
The Fourth Circuit held that fallwell.com was neither infringing nor cybersquatting, because likelihood of confusion turns on the whole site and the ACPA targets profit-seeking, not criticism.
The Fourth Circuit held that 'People Eating Tasty Animals' could not shield peta.org behind the First Amendment, because a domain identical to a mark conveys ownership before any visitor sees the joke.
Decided weeks after the ACPA became law, the Second Circuit's sportys.com ruling supplied the template for how courts would read bad-faith intent, distinctiveness, and a brand-new statute applied to conduct that predated it.
