If you sell .EU domains to UK residents, you may already be aware of an announcement made by the European Commission last March on the future of .EU domains registered to UK organizations and individuals. In short, once the UK officially withdraws from the European Union, individuals with an address in the UK and Gibraltar, and UK companies without a presence elsewhere in the EU, will no longer meet the eligibility requirements.

Much to the disappointment of the domain community, the European Commission has decided against “grandfathering” the 300,000 .EU domains already registered with a GI or GB country code, an action which would have allowed existing owners to renew their domains indefinitely, despite the country code no longer being eligible. We would have appreciated a more creative solution than existing registrants simply losing their right to ownership. Regardless, it’s time to start preparing affected registrants for this change.

No one knows how Brexit will proceed, but in late January 2019, EURid, the .EU registry, released details on how it would approach this transition. There are three possible scenarios:

1. Hard Brexit: The UK leaves the EU with no deal on March 30, 2019.
2. Soft Brexit: The UK leaves the EU on or after December 31, 2020, following a planned transitional period.
3. Soft Brexit with .EU Provisions: The UK leaves the EU with a planned transitional period, and the deal includes provisions for .EU domains.

Below you’ll find what each of these three scenarios would mean for .EU registrants based in the .UK.

Scenario 1 — In the event of a “hard Brexit”

If the UK leaves the EU on March 30, 2019, without having reached a withdrawal agreement, here’s what will happen. You can also jump to the summary table below.

Starting at March 30, 2019, 00:00 CET (March 29, 2019, 19:00 EDT), EURid will immediately stop allowing new registrations of .EU domains using a GB (Great Britain) or GI (Gibraltar) country code. For existing domains, EURid will no longer allow registrant transfers to GB or GI residents.

In March 2019, EURid will contact existing registrants who have listed a postal address with a GB or GI country code, giving them “the possibility to demonstrate their compliance with the .eu regulatory framework by updating their contact data.” For organizations, this would involve indicating a legally established entity in one of the eligible EU27 or EEA Member States. For individuals, this would involve updating their residence to a physical address located in one of the EU27 or EEA Member States.

The registrant may also choose to transfer the domain name to an EU resident.

Between March 30, 2019, at 00:00 CET (March 29, 2019, 19:00 EDT / 21:00 GMT time), when registrants are officially notified, and May 30, 2019, at 00:00 CEST (May 29, 2019, at 18:00 EDT), the registry will lock the impacted domains to prevent the following actions:

• Registrant transfer (Ownership Change) to a non-EU registrant (Only Ownership Changes to an EU registrant will be permitted)
• Explicit renew
• Auto-renew (ineligible domains will automatically enter Withdrawn status)

During this two-month window, UK registrants who wish to keep their domain active must update their contact info to satisfy the eligibility requirements or transfer the domain to an EU resident.

On May 30, 2019, at 00:00 CEST (May 29, 2019, at 18:00 EDT), any registrant who has failed to demonstrate their eligibility will have their domain placed in Withdrawn status — the domain won’t resolve (and any linked services will become inactive), but the registration record will remain on file with the registry.  At this point, the registrant is still able to reactivate their domain by updating their registration data to satisfy the eligibility requirements, thereby removing the Withdrawn status.

On March 30, 2020, at 00:00 CET (March 29, 2020, 19:00 EDT), all ineligible domains in Withdrawn status will be deleted and made available for registration.

We know this is quite a lot to keep in mind, so here is a summary of the “hard Brexit” key dates and events:

Domains belonging to EU citizens living in the UK

There are, no doubt, many EU27 citizens who reside in the UK and own a .EU domain name. These registrants, though still EU citizens post-Brexit, would become ineligible on March 30, 2019, as the current EURid policy determines eligibility based on the physical address of the registrant.

However, the EU Commission has announced policy changes which would allow EU citizens based in the UK  to regain eligibility. The registrants would, therefore, lose their eligibility upon the UK’s withdrawal from the EU on March 30 2019, but would likely become eligible again once the new .EU regulatory framework comes into force later this year. Unfortunately, it’s not yet clear how long of a gap there will be between the UK’s withdrawal from the EU and the implementation of updated .EU policy.

Scenario 2 — In the event of a “soft Brexit”

If the UK were to leave the EU on or after 31st December 2020, following a planned transitional period, EURid’s plan would be similar to the “hard Brexit” plan, but with an extended timeline. Here’s what would happen (summary table below):

In December 2020, EURid will contact existing registrants who have listed a postal address have with a GB or GI country code, giving them “the possibility to demonstrate their compliance with the .eu regulatory framework by updating their contact data.” Once again, for organizations, this would involve indicating a legally established entity in one of the eligible EU27 or EEA Member States. For individuals, this would involve updating their residence to a physical address located in one of the EU27 or EEA Member States.

The registrant could also choose to transfer the domain name to an EU resident.

Between January 1, 2021, at 00:00 CET (December 31, 2020, at 18:00 EST), when registrants receive their final notice, and March 2, 2021, at 00:00 CET (March 1, 2021, at 18:00 EST)the registry will lock the impacted domains to prevent the following actions:

• Registrant transfer (Ownership Change) to a non-EU registrant (Only Ownership Changes to an EU registrant will be permitted)
• Explicit renew
• Auto-renew (ineligible domains will automatically enter Withdrawn status)

During this two-month window, registrants who wish to keep their domain active must update their contact info to satisfy the eligibility requirements or transfer the domain to an EU resident.

On March 2, 2021, at 00:00 CET (March 1, 2021, at 18:00 EST), any registrant who has failed to demonstrate their eligibility will have their domain placed in Withdrawn status — the domain won’t resolve (and any linked services will become inactive), but the registration record will remain on file with the registry. At this point, the registrant is still able to reactivate their domain by updating their registration data to satisfy the eligibility requirements, thereby removing the Withdrawn status.

On 1 January 2022, at 0:00 CET (December 31, 2021, at 18:00 EST), all ineligible domains in Withdrawn status will be deleted and made available for registration.

Here is a summary of the “soft Brexit” key dates and events:

Domains belonging to .EU citizens living in the UK

As mentioned above, an updated .EU regulatory framework that will allow for .EU domains to be registered by EU citizens living in the UK will come into effect in 2019. Therefore, EU citizens living in GB or GI would NOT become ineligible as a result of a “soft Brexit.” Depending on how EURid implements the new policy directive from the EU Commission, EU citizens living outside of the EU could potentially be required to actively validate their eligibility in order to maintain their registration.

Scenario 3 —  If provisions are made for .EU domains

In the event of a “soft Brexit” where the deal includes provisions for .EU domains, EURid would forgo the transition plans outlined in the scenarios above and instead adopt whatever transition plan the provisions call for.  

Preparing for this change

The OpenSRS team is exploring how best to approach this situation and find solutions to minimize the impact on registrants. If you sell .EU domains we strongly encourage you to sign up for our .EU-Brexit Updates, an email series we will use to share developments, recommendations for resellers, and information about our own action plan, including how resellers can identify domains in Withdrawn status via the Control Panel and API.

Have you already given this situation some thought? If you’d like to share your approach, ask questions about this change, or provide feedback, please get in touch.

In the meantime, we have a few recommendations for our affected reseller partners.

1. Consider restricting multi-year renewals and registrations for .EU domains. 
This will help avoid situations where a UK customer pays a sizable renewal fee, only to lose their .EU domain a few months later.

2. Consider displaying a warning to registrants during the registration process
It’s important that before registering a .EU domain, your UK-based customers are made aware of the impending change to the domain’s eligibility requirements. We recommend displaying a warning to customers attempting to register a .EU domain using a GB or GI address.

3. Keep in mind that the registry could contact your customers as early as March 23, 2019.
We recommend preparing to contact your affected customers before March 23, 2019, so that, in the event of a hard Brexit, the notice from the registry doesn’t come as a surprise. Over the next couple of weeks, we’ll provide more information that will help to inform your communications.

3. Advise those registrants who can to update their information to meet the eligibility requirements as soon as possible.
This will ensure their domain(s) does not fall into Withdrawn status and become inactive.

Once again, if you sell .EU domains, we highly encourage you to subscribe to our .EU-Brexit Updates series to stay up-to-date as things develop.

For Data Privacy Day 2019, we wanted to do something a little bit different.

Regular readers will know that we write about things like the GDPR and email security fairly often, as part of our efforts to keep our reseller partners up to date about the state of data privacy and security in the domain name industry.

Today, instead of sharing just one person’s perspective, we’ve opened the floor up to everyone within Tucows (our parent company). Here’s what some of our colleagues said when asked why data privacy is important to them:

“Privacy allows people to be themselves without fear of being judged. That may require anonymity, pseudonymity or sharing significant personal data. What is important is user control.”
– Elliot Noss, CEO

“Privacy on the internet has always been important to me. I started using computers pre-Facebook, when you’d be stupid to use your real name online, and anonymous speech remains an important value to me. Marginalized groups do not always have the luxury of speaking their truths without it. Of course, anonymity can also be taken advantage of by bad actors; there must be a balance and it’s one I struggle with daily. I’m proud that Tucows understands that.”
– Reg, Director of Compliance

“In a world where our personal data has never been more sought after by fraudulent people, I am proud to work for a company that layers its security and protection of its users’ personal data like it would want its own data covered.”
– Kristy, Customer Support

“I believe that protecting people’s privacy is a responsibility that everyone must share, and that people need to be respectful of personal boundaries online the same way we would do so in person. I really do respect the industry leadership that Tucows has taken to respect the privacy of its users, and to make digital privacy a fundamental part of the company’s corporate culture. The most notable example of this, in my opinion, was the forward-thinking decision to use the implementation of the European Union’s GDPR as an opportunity to incorporate the privacy-conscious practices outlined in that legislation throughout the company, rather than only applying them within the scope of the company’s European operations.”
– Jon, Service Desk Analyst

“Privacy protects our reputations from harm. People judge harshly and unfairly, so the more control we as individuals have over what is shared, the more protected we are from being unfairly harmed. Privacy is power, and Tucows gives more power to the people.”
– Sara, Compliance Officer

“In today’s application-driven world, consumers are distracted by the ‘cool’ functionality and ‘overwhelming’ efficiency constantly being marketed to them. You need this app, that product, this Social Media. For right or wrong these very same consumers assume their ‘sign-up’ or ‘registration information’ is protected and used only to ‘process’ the transaction or service. Wouldn’t it be nice to know, up front and in plain language, what you’re actually getting into?”
– Sharlene, VP Domain Sales

“I feel as if the need for information should be balanced with the right to discretion. There is way more to good privacy practices than dodging litigations, complaints, or grievances. Whether privacy is safeguarded by law or contract, it is best to promote companies and employers that respect privacy because it provides assurance and supportive trust.”
– Sumaya, Return Merchandise Agent

“I view privacy as the ability of an individual or group to seclude themselves, or information about themselves, and thereby express themselves selectively. The right not to be subjected to unsanctioned invasions of privacy by the government, corporations or individuals should not only be a right but a standard.”
– Brandon, Senior Product Manager

“In this new digital age that continues to grow and evolve, I find privacy to be very important to me. Information is a powerful tool that can be abused in the wrong hands, so I do my best to keep it safe. You have to trust who you give your personal information to to take care of it as well as you would, which I do here with Tucows.”
– Bryce, Ting Social Media Response Team Member

“Privacy means freedom, control, and choice. The ability to choose what to share and what to keep private is a fundamental part of being a free person, and that’s very important to me. I love working in a role where I help protect people’s privacy, making sure that all Tucows users have the same control that I value so much, at least for the services that we provide.”
– Sarah, Domains Product Team

“In the age of Big Brother Smartphones, targeted advertising, and scandals like Cambridge Analytica, I feel it’s important to retain as much privacy and control over my data as possible. Because the potential for disaster if there’s a leak or abuse is enormous and wide-reaching — things like identity theft and cyber-terrorism come up often when people discuss their concerns over e-privacy and data handling”.
– Seann, Customer Support Advisor

“Privacy to me means total anonymity. It means I came without a trace and left without a trace. Transparency is key, and Tucows does an amazing job in that regard, collecting data only when necessary and never selling data to other companies for profit.”
– John, Customer Support Advisor

“To me, privacy is something we shouldn’t need to be concerned about. There’s so much that can go on in day-to-day life, the last thing you want to worry about is whether or not your information is safe. That’s why I’m proud to work where privacy is a top priority!”
– Chantal, Customer Support Advisor

“All humans have two sides, public and private. But with social media and other online platforms, the two are blurring into one. Tucows believes in respecting and honoring both public and private selves.”
– Diandra, Ting Customer Support Advisor

“I see privacy and respect for the individual as fundamental to creating free and trusting communities. We all know corporations wield a lot of power, but it’s easy to forget how important our choice of whom to buy from and whom to work for really is. The fact that I so value privacy and transparency is part of the reason I work for Tucows and buy my domains through Hover.”
– Haley, Wholesale Domains Marketing

How can you promote data privacy?

If you’ve found these perspectives on the importance of privacy compelling, here are just a few ideas to get you started on your own data privacy journey.

• Make sure your clients understand why you collect and how you use their data, and protect their data by implementing technical and organizational security measures
• Use strong and unique passwords, especially for services that hold customer information, sensitive personal data, or financial information
• Join a privacy-focused organization like the EFF and read up about Data Privacy Day at StaySafeOnline.org
• Check out this list of information security policies for businesses from IT Governance

Happy Data Privacy Day, from everyone here at Tucows!

For the past two decades, Comodo CA has provided digital identity solutions to both enterprises and small businesses, issuing more than 100 million SSL certificates across 200 countries. Now, Comodo CA has rebranded as Sectigo.

By rebranding, Sectigo is establishing itself as a separate entity from its predecessor, the Comodo Group, and emphasizing its expansion beyond SSL. The change marks a renewed commitment to innovation, digital transformation, and service.

Sectigo’s mission is “to be the world’s most trusted, innovative, and customer-centric partner for protecting organizations’ identities, web presence and connected devices – from the biggest brands to the smallest websites – so they can secure today and seize their tomorrow.”

Watch their journey from Comodo CA to Sectigo:

If you’re an Enom retail customer who has purchased a Comodo SSL certificate(s) through Enom, there’s nothing you need to do. Your Comodo certificate(s) will remain trusted and valid until they expire.

If you resell SSL certificates through Enom, you’ll find everything you need to know below.

Here’s what resellers need to know

This rebrand will not affect existing products and Comodo Authority roots will remain trusted. You’ll soon start seeing certificates issued by Sectigo instead of Comodo CA, however, the rebrand is happening gradually— you might still see specific certificates issued by Comodo CA during the transition.

The specs for all certificates will remain the same, however the certificate names will change to reflect the new Sectigo brand instead of Comodo. We’ve created a Product Name Changes Chart to clarify the old and new product names.

You might also find Sectigo’s FAQ to provide a helpful overview.

What changes is Enom making?

We will be making a few minor changes as a result of this rebrand:

1. We are updating enom.com and our UI to display the new Sectigo brand and product names, removing mention of Comodo.
2. In early 2019, we will update the API, and other integration platforms and tools to reflect the new certificate names.

For API users – any future API changes will be backwards compatible. You can continue to use the same “comodo” services parameter values you do today — the Sectigo equivalent will be provisioned.

Do Enom resellers need to take action?

As mentioned, this rebrand will not impact how you register and manage Comodo/Sectigo SSL certificates through Enom. However, we recommend making a few front-end  adjustments as you see fit:

1. Update any references to the Comodo brand on your website to Sectigo.
2. If you market specific Comodo certificates to your customers, please ensure you update the product names.

To help you with this, Sectigo has put together a partner resource page with their new logo, brand guidelines, and other marketing assets.

Have additional questions?

You can visit sectigo.com to find more information about this rebrand or chat with one of their representatives.

If you have any questions or concerns about Enom’s’ implementation of this rebrand, please don’t hesitate to reach out to us directly at help@enom.com.