Summary: Registering a trademark in India does not guarantee protection against cybersquatters. Businesses must combine trademarks with proactive domain acquisitions, brand monitoring, and dispute resolution mechanisms like UDRP to safeguard their online presence.
In a previous article, we discussed how the Uniform Domain Name Dispute Resolution Policy (UDRP) provides trademark owners with a specialised and cost-effective mechanism for recovering domain names that have been registered and used in bad faith. While the UDRP is a preferred remedy for international domain name disputes, it is a small part of the broader legal framework around cybersquatting.
In India, trademark owners confronted with abusive domain name registrations may either institute a civil suit for remedies for trademark infringement and passing off, or pursue a complaint under the UDRP. Each remedy serves a distinct purpose. Civil courts can grant injunctions, damages and other ancillary reliefs. The UDRP can only determine if a disputed domain name should be transferred or cancelled, but it is cheaper, faster and internationally more easily enforceable, making it a convenient solution for cybersquatting.
At this juncture, it is useful to understand why cybersquatting continues to flourish despite trademark protection, how Indian courts have approached the issue, and the commercial risks posed by such registrations.
The Indian legal position
Unlike jurisdictions such as the United States, where the Anti-Cybersquatting Consumer Protection Act (ACPA) addresses bad-faith domain name registrations, India does not have a dedicated law for cybersquatting. Instead, Indian courts have extended principles of trademark infringement and passing off to domain names, recognising that they are not only an internet address but also a source identifier that can distinguish goods or services of one business from another.
In 1999 [1], the Delhi High Court restrained a party from using the domain name yahooindia.com, holding that it was likely to be associated with Yahoo!. In effect, it recognised that domain names perform functions analogous to trademarks, and are entitled to similar legal protection.
Some years later, the Supreme Court consolidated this position [2], holding that, although there was no law, domain names could acquire goodwill and be protected under common law through passing off.
More recently [3], the Delhi High Court has viewed the misuse of well-known trademarks through deceptive domain names as cyberfraud, issuing directions in this regard to domain name registrars and other intermediaries. This is an acknowledgement that cybersquatting is also a cybersecurity and consumer protection concern.
The modern face of cybersquatting
When the UDRP was introduced in 1999, the value of a domain lay in its resale, and cybersquatting basically meant opportunistic registrations of famous trademarks in the hope that the trademark owner would eventually buy out the domain name for a premium.
Today, things are very different. The domain name is less an end in itself, but a means for monetisation. Cybersquatters now exploit goodwill through phishing campaigns, counterfeit websites, and identity theft. In this manner, cybersquatting increasingly overlaps with cybersecurity, data protection and consumer protection.
Common forms of cybersquatting
The most frequently encountered forms of cybersquatting include:
- Typosquatting: minor typographical variations of a well-known domain name divert internet traffic through user error;
- Combosquatting: the addition of descriptive expressions such as “login”, “support”, “payments” or “care” to a well-known trademark create an appearance of legitimacy;
- Phishing and impersonation: a brand owner’s website is reproduced to deceive users into disclosing confidential information or making payments; and
- Passive holding: confusingly similar but inactive domains (although UDRP panels have recognised this does not preclude a finding of bad faith).
Trademarks are not enough?
A common misconception is that a trademark registration automatically secures the corresponding domain name. The legal position, however, is very different.
Trademark rights and domain name registrations have distinct legal frameworks. Domain names are generally allocated on a “first come, first served” basis, with no requirement to verify whether corresponding trademark rights exist or not. Thus, one business can own a registered trademark, while another unrelated entity controls an identical or confusingly similar domain name.
Trademark registration can provide a legal foundation for challenging such domain name registrations, but does not prevent registrations outright. Therefore, online brand protection requires businesses to strategise beyond the trademark register.
Startups at risk
Prospective targets for cybersquatters include early-stage businesses, well before they become household names. Signals of commercial value include funding announcements, product launches, media coverage, successful television appearances or international expansion. But startups prefer to focus on product development and customer acquisition, at the cost of domain name protection and online monitoring. The result is that deceptive domains might remain undetected until a customer reports phishing or fake emails.
Cybersquatting costs
The cost of cybersquatting on a business can run deep. Customer confusion, phishing, diversion of internet traffic, search engine optimisation (SEO) dilution, can all cause reputational and commercial damage.
Worse still, if customer data is compromised, there may be regulatory concerns around cybersecurity and personal data protection. Digital-first businesses in sectors such as financial services, healthcare, e-commerce and technology are particularly vulnerable in such cases.
Why UDRP?
Cybersquatting disputes are growing in number, as shown by the fact that the World Intellectual Property Organization (WIPO) has administered more than 75,000 UDRP proceedings. Indian businesses, big and small, have also successfully used the UDRP to recover domain names. For instance, in a landmark case [4], the panel recognized “TATA” as a globally famous, well-known mark, ordering the transfer of <tata.org>.
Protecting your brand before a dispute arises
In cybersquatting cases, prevention is consistently more efficient than enforcement. Businesses should consider a comprehensive online brand protection strategy which would include the following measures:
- secure obvious domain name variations,
- register relevant country-code and generic top-level domains,
- monitor newly-registered domains incorporating their trademarks,
- maintain a structured domain name portfolio, and
- educate customers about authorised communication channels.
In a digital world, with online presence being a key feature of business operations, trademark protection without protecting the corresponding domain name is clearly insufficient. Effective brand protection means safeguarding trademark rights and the digital identity through which consumers access it.
Note: For more details on the decisions referred to in this article, please reach out to us at email@obhanmason.com
English
Chinese (Simplified)
Japanese