Radaris Domain Seizure Marks New Chapter in Data-Broker Litigation
The New Jersey Superior Court transferred the radaris.com domain to Atlas Data Privacy Corp on August 26, 2026, after the data-broker failed to appear for multiple hearings and was found in default under the state’s Daniel’s Law. The order, reported by Krebs on Security, is the most visible enforcement action against a U.S. data-broker to date, but it also underscores a broader industry assumption: that seizing a domain name will cripple a privacy-violating operation.
Legal Context – Daniel’s Law and Default Judgments
Daniel’s Law, enacted in New Jersey in 2022, grants law-enforcement officials, judges, and their families a statutory right to have their personal data removed from commercial people-search services. Violations incur a $1,000 fine per record. Atlas Data Privacy Corp filed the original suit in February 2024, alleging Radaris.com and a network of affiliated entities repeatedly ignored removal requests. After a 2017 default judgment of $7.5 million could not be collected, the court ordered Verisign to reassign the domain to the plaintiffs, a move later reaffirmed in 2026 when Radaris again failed to defend the case.
Shell Companies Undermine the Impact of Radaris Domain Seizure
Radaris’ corporate structure is deliberately opaque. The lawsuit identified at least twelve entities—Bitseller Expert Limited (Cyprus), Andtop Company (Marshall Islands), Digital Orbit Corp, Core Solutions Group Inc, and others—each sharing the same mailing address, payment cards, and administrative email accounts. This "island-hopping" strategy allowed the broker to shift the legal owner of a domain minutes before a judgment became enforceable. When the court finally ordered the transfer, the registrar complied, but the underlying infrastructure—hosting contracts, DNS records, and content-delivery networks—remained under the control of the same operators.
Why a Single Domain Seizure Is a Weak Remedy
The seizure removed the public-facing radaris.com URL, but the site’s homepage now displays a compliance notice and links to the original reporting. The data-broker can simply register a new domain (for example, radaris-search.com) and point existing DNS entries to the same backend servers. Moreover, the default judgment itself is vulnerable to procedural challenges; Radaris’ new counsel, Victor Worms, argues that a non-entity cannot be sued, seeking to vacate the judgment on due-process grounds. Even if the judgment stands, collecting the $7.5 million remains unlikely because the identified entities are offshore shell corporations with minimal assets in U.S. jurisdiction.
Technical Resilience of Modern Data Brokers
Modern data-brokers rely on distributed cloud services such as AWS, Azure, and Cloudflare. These platforms allow rapid migration of workloads to new domains with minimal downtime. The underlying databases and scraping pipelines continue to operate regardless of the domain name, meaning that a seizure often only disrupts branding, not the core data-harvesting business.
Jurisdictional Fragmentation Limits Enforcement
Shell companies registered in the Marshall Islands, British Virgin Islands, or Seychelles fall outside the reach of U.S. enforcement. While a U.S. court can order a registrar to reassign a domain, it cannot compel foreign registrars or hosting providers to cooperate, leaving the operator free to re-establish an online presence elsewhere.
Economic Incentives Keep the Business Viable
Revenue from selling personal dossiers is estimated in the low-millions of dollars per year. The cost of re-branding after a domain loss is a small fraction of that revenue, making the seizure a manageable expense for the broker.
Operational Consequences for Affected Parties
Law-enforcement officials in New Jersey were the primary victims. Their personal addresses, phone numbers, and family details were publicly searchable, creating a tangible security risk. The domain transfer has forced the broker to display a compliance notice, which may deter casual browsers, but determined actors can still locate the data through search-engine caches or third-party aggregators that have already scraped the information. Organizations that rely on people-search services for background checks must now reassess the reliability of any data sourced from Radaris-affiliated sites, as the legal turmoil raises questions about data integrity and provenance.
What to Watch Next
- Appeal Activity – Victor Worms’ motion to vacate the default judgment could delay enforcement of the domain transfer for months, if not years.
- Regulatory Momentum – New Jersey’s aggressive stance may inspire other states to adopt similar statutes, prompting a wave of litigation against data brokers that operate across state lines.
- Technical Counter-measures – Privacy-focused NGOs may begin publishing "kill-lists" of domains associated with illicit data brokers, encouraging registrars to adopt stricter verification processes.
- Internal Monitoring – See our related analysis of privacy-law enforcement trends for additional context: Privacy-Law Enforcement Trends.
Stakeholders should monitor court filings for any amendment to the judgment and consider supplemental technical mitigations, such as DNS-based blocklists and threat-intel feeds that flag known data-broker domains. Organizations handling sensitive personnel data should also audit their reliance on third-party people-search APIs, replacing them with vetted, privacy-by-design alternatives where possible.
A Cautionary Tale for the Privacy-Enforcement Community
The Radaris domain seizure is a high-profile victory, yet it also serves as a cautionary tale: legal tools that target a single digital asset rarely dismantle a distributed data-harvesting operation. Effective mitigation will require a multi-pronged approach—combining litigation, regulatory pressure, and technical disruption—to reduce the incentive for data brokers to continue publishing personal information without consent.
Related coverage
- TikTok child privacy settlement: $400 million deal resolves DOJ COPPA lawsuit
- Linux Kernel Local Root Exploit: Public Exploits Released for Four Vulnerabilities
- Cisco ISE zero-day Exploits API Endpoint Authentication