A United States statute, and nothing outside it
The Anticybersquatting Consumer Protection Act is United States federal law and only that. It is codified at 15 U.S.C. 1125(d) and was enacted on 29 November 1999. It is not the UDRP, and it does not reach a dispute governed by another country's law. A name registered through a registrar outside the United States, held by a registrant outside the United States, in a country-code extension operated outside the United States, may sit entirely outside its reach. Whether it does is a jurisdictional question for counsel, and this page does not answer it. The same flag applies to everything below: the Federal Rules of Evidence, the subpoena practice that produces registrar records, and the remedies provisions at 15 U.S.C. 1117 are all US-specific.
What makes a court case different from an administrative proceeding, from the expert's side, is the machinery: discovery, compulsory process against the registrar, the registry and the host, and a live opponent who cross-examines the method rather than reading a filing.
Two prongs, and a clock anchored at registration
Liability under 1125(d)(1)(A) requires two things together. The person must have a bad faith intent to profit from the mark, and must register, traffic in, or use a domain name that is identical or confusingly similar to a mark that was distinctive at the time the domain was registered — or, for a famous mark, identical or confusingly similar to or dilutive of it — or that is one of the designations protected by the Red Cross and Olympic statutes the section cross-references (15 U.S.C. 1125(d)).
Two structural points set the collection scope, and both are technical rather than legal.
The prongs are conjunctive. A string comparison, however careful, reaches one half of the provision. Everything an expert assembles about resolution history, redirects, monetization and portfolio linkage goes to the other half.
The clock is anchored at registration. The statute tests the state of the mark as at the time of registration of the domain name. That phrase is why a defensible record is a timeline rather than a snapshot: the registration date has to be established to a standard that survives cross-examination, and the state of the register, the mark's use and the site's content have to be established as at that date. Building the record from today's registration data and today's website is the most common technical failure in this work.
Why the creation date is the hardest date in the file
The created date returned by a registration lookup looks like a fact and is an assertion by whoever published it. In my experience it is the field most likely to be wrong in a way nobody catches until deposition.
A name that expired, dropped and was re-registered by someone else can carry a creation date later than its first-ever registration — the record describes the current registration, not the string's history. Registrars have not been uniform about whether a date is preserved or reset across transfers. And a lookup run today returns today's published record, which may have been rewritten since the events in dispute.
The method is corroboration. Registrar-produced records, historical registration archives, passive DNS (a historical record of what a name resolved to, built from what sensors observed rather than queried live), certificate issuance entries and archived captures each carry their own dates, and the earliest independently dated evidence of the name being live is a check on the published date rather than a substitute for it. Where sources disagree, the report shows both.
Registrant identification is an element, not background
The statute limits liability for use to the registrant or that registrant's authorized licensee (1125(d)(1)(D)). That converts registrant identification from context into an element-level evidentiary task — and it is the task most damaged by redaction.
Published gTLD registration output routinely omits registrant name, street address, postal code, phone and email, with an alternative contact mechanism published in place of the address. The consequence is procedural rather than analytical: the identifying fields exist, the registrar holds them, and they reach the file through legal process rather than through a lookup. Where a privacy or proxy service sits on the public record, the underlying account file is the object of the subpoena.
An expert can narrow the target before process issues — through registration-data history, shared name servers, shared hosting addresses, shared certificate coverage, shared analytics and advertising account identifiers. Each of those is an inference with an innocent explanation available, each carries its own confidence statement, and none substitutes for the account file.
"Traffics in" makes transfer history evidence of an element
The statute defines trafficking to include sales, purchases, loans, pledges, licenses, exchanges of currency and any other transfer for consideration or receipt in exchange for consideration (1125(d)(1)(E)). That definition has a direct collection consequence: transfer history is evidence going to a statutory element, not background color. The records sit in several places and age at different rates:
- Registrar transfer records and the account history behind them — obtained by process.
- Registry-side transaction history — obtained by process.
- Registrant changes in historical registration data — third-party observations, sampled at intervals.
- Marketplace listings and landing pages offering the name — public while they exist, gone without notice when the listing is pulled.
- Escrow records — the only category in which a completed transaction is substantiated by an underlying document rather than by a report of one.
The listing is the one that disappears, and preserving it live — full response captured and hashed — is the step most often left too late.
The remedies structure decides what gets counted
The equitable remedies under 1125(d)(1)(C) are forfeiture or cancellation of the domain name, or transfer of it to the mark owner. The monetary provisions live at 15 U.S.C. 1117: actual damages and the defendant's profits under 1117(a), or an election of statutory damages under 1117(d), which the statute frames as a per-domain-name amount within a range it fixes. This page publishes no figure and takes no position on what any party would recover; the amount is for the court.
The structural point is what matters to an expert. Because the statutory election operates per domain name, the count and identification of the names is a technical question. Because profits under 1117(a) require proof of the defendant's revenue, the route the money took is a technical question too: advertising network publisher identifiers, affiliate tags, parking service accounts, marketplace and escrow records, recovered from archived page source and from produced account records.
One statute is routinely conflated with this one. The separate cause of action for registering another living person's name, now at 15 U.S.C. 8131, carries injunctive relief only — no factor test, no statutory damages, no in rem provision.
A UDRP outcome does not settle the court case
Paragraph 4(k) of the UDRP states that the administrative proceeding does not prevent either party from submitting the dispute to a court of competent jurisdiction for independent resolution, before the proceeding is commenced or after it concludes (ICANN UDRP). They are different tests applied by different bodies on different records. Neither is an appeal from the other, and describing one that way in a report is an error an opponent will use.
Paragraph 4(k) also carries the deadline that most often makes an engagement time-critical. After a registrar is informed of a decision to transfer or cancel, it waits ten business days before implementing, and will not implement if it receives official documentation that a lawsuit has been commenced against the complainant in a jurisdiction to which the complainant submitted. Where an expert is brought in at that point, the collection window is measured in days, and the material that only exists live — the listing, the parking page, the redirect chain, the resolution state — has to be captured inside it.
The statute runs the other way too. A registrant whose name was suspended, disabled or transferred under a registrar policy of that kind may bring an action under 15 U.S.C. 1114(2)(D)(v). The evidentiary target in that direction is narrow and squarely technical: what was represented to the registrar, and what the contemporaneous technical record actually showed.
What the ACPA record cannot establish
The record an expert builds is a record of what happened and when. It does not reach intent, and no expert should present it as though it does. Bad faith intent to profit is a legal determination reserved to the court.
Beyond that, each source has a specific defect that belongs in the report rather than in cross-examination:
- Published creation dates are assertions. For a name that dropped and was re-registered, the date may not mean what it appears to mean — and the statute's central test is anchored to it.
- Redaction removes the identifying fields. Registrant name, address, phone and email are absent from public gTLD output and reach the file only through the registrar.
- Historical registration archives are third-party observations — sampled at intervals, with gaps, and with no chain of custody back to the registrar.
- Passive DNS shows only what a sensor saw. Absence of a record is not evidence that the record never existed.
- Web archives crawl on their own schedule. Robots exclusions, script-rendered pages and login walls produce blank periods, and a capture proves a period rather than a day unless its timestamp is recorded.
- Country-code extensions often sit outside gTLD policy entirely, with their own registration-data regimes.
Stating these is not a concession. It is the difference between an opinion that survives examination and one dismantled by the first question about coverage.
Authentication, and what a retaining attorney should expect
US-specific. Stated generally and without application to any matter: authentication runs through Federal Rule of Evidence 901, including 901(b)(9) for evidence describing a process or system — the rule under which a collection method, meaning the tool, the version, the timestamp and the hash, is described. FRE 902(13) and 902(14) allow certification in place of live foundation testimony. Registrar, registry and host records are business records under FRE 803(6). The opinion itself is governed by FRE 702 as amended effective 1 December 2023.
In practice: every artifact hashed at collection, the collecting system's clock and time zone recorded, tools and versions recorded, and the analysis scripted so the other side can re-run it. Preservation precedes pleading, because the volatile material is gone long before discovery opens.
Bill Hartzer has testified in domain-related legal cases and has provided expert witness reports in others, and has worked in this field since 1996. The current engagement record is maintained at hartzer.com. Whether to bring a claim, where, and on what theory are decisions for counsel; this page describes only what the technical record consists of and how it is built.