What is Anticybersquatting litigation (ACPA)?

Anticybersquatting litigation (ACPA) is a US court-based procedure that allows a trademark owner to sue a registrant who, in bad faith, registered or used a domain name confusingly similar to or dilutive of a distinctive or famous mark – with remedies that include a court-ordered domain transfer and monetary damages.

Unlike the UDRP, which transfers or cancels a domain through arbitration with no monetary award, anticybersquatting litigation (ACPA) puts the dispute before a federal court and places real money on the table. The trademark owner can seek statutory damages and attorney's fees, not just the domain itself. That additional reach is also what makes the route slower and more costly than arbitration for most disputes.

ACPA is, by design, narrower than it sounds. It is a US-specific statute, applying when a US court can assert jurisdiction – over the registrant, or over the domain itself through an in rem action. For disputes outside that reach, the governing rules are the UDRP, a national ccTLD procedure, or the courts of another country. Understanding exactly where ACPA fits – and where it does not – is the first question any domain recovery lawyer should address.

What ACPA is – and what it is not

ACPA is a US anticybersquatting statute that creates a private right of action for trademark owners against registrants who act in bad faith. The statute lists nine non-exhaustive factors a court examines to determine bad faith, including the registrant's intent to divert consumers, an offer to sell the domain to the mark owner, and a pattern of registering others' marks.

What ACPA is NOT is the UDRP. Readers frequently conflate the two because both address cybersquatting and both can result in a domain transfer. The critical differences are jurisdictional reach, remedy, timeline, and cost. The UDRP is a contractual arbitration mechanism applying globally to gTLD domains held by accredited registrars; it produces a transfer or cancellation decision – nothing more. ACPA is litigation in a federal court. It can reach a registrant anywhere in the world if a US court can assert personal jurisdiction, and it can reach the domain directly through an in rem action when the registrant cannot be found or served.

ACPA is also not a substitute for domain theft recovery, though the two sometimes arise together. When a domain is stolen through account compromise or registrar fraud, the primary remedy is a registrar escalation and transfer reversal; ACPA may become relevant later if the wrongdoer is identified and pursued for damages.

How does the ACPA bad-faith test work in practice?

A court assessing bad faith under the applicable anticybersquatting legislation examines the full picture of the registrant's conduct, not a single decisive fact. The nine statutory factors are a checklist, not a formula; courts weigh them collectively. No single factor is automatically dispositive, and a registrant with a plausible legitimate reason for holding the name can defeat a claim even when several factors point against them.

The trademark element works differently from the UDRP. ACPA protects distinctive and famous marks. The famous-mark tier is significant: it triggers a dilution-by-blurring or dilution-by-tarnishment analysis that does not require any confusion between goods or services. A purely descriptive mark with no acquired distinctiveness, by contrast, is unlikely to succeed under ACPA regardless of how opportunistic the registration looks.

The in rem action deserves particular attention. Where the registrant is unknown, located in a jurisdiction that will not permit service, or is simply unreachable, the statute allows the trademark owner to proceed against the domain name itself as the defendant, filing in the judicial district where the registry or registrar is located. In rem relief is limited to transfer or forfeiture of the domain; monetary damages are not available in that mode. It is, in effect, the closest ACPA comes to the UDRP's binary outcome.

Three recognizable fact patterns where ACPA arises

In our practice, anticybersquatting litigation tends to cluster around a handful of recurring situations. Each pattern carries a different risk profile and calls for a different opening move.

The ransom hold is the most common entry point. A registrant who clearly registered a mark-identical domain with no plausible commercial purpose offers to sell it back to the brand owner at a price that implies the brand is worth capturing. The UDRP is usually faster and cheaper for this pattern – but if the registrant is based in the US, has assets worth pursuing, and the asking price is high enough, ACPA's damages provision makes litigation a credible threat that can reset the negotiation.

The defamation-adjacent domain is a harder case for the UDRP and sometimes a better fit for US litigation. A registrant operates a website under a near-identical domain to criticize, embarrass, or harm a brand. UDRP panels apply the legitimate fair-use safe harbor cautiously and sometimes deny transfer where genuine commentary is present. A US federal court has broader equitable tools and, where the conduct crosses into harassment or tortious interference, ancillary claims alongside ACPA can change the economics of defense for the registrant.

The identity-uncertain theft scenario involves a domain that was transferred without the owner's knowledge – a stolen domain, in plain language. By the time the owner discovers the change, WHOIS (or RDAP, which has replaced WHOIS as the standard registration-data protocol as of January 2025) shows a registrant who cannot be identified through a disclosure request to the registrar. The in rem mechanism under US anticybersquatting legislation can reach the domain directly, even in that vacuum, so long as the registry or registrar is in a US jurisdiction.

Why ACPA matters to a domain dispute that started elsewhere

A dispute rarely arrives labeled as "an ACPA matter." It arrives as a domain that is missing, parked, or weaponized. The path to US litigation may open only after other routes close. Consider three trajectories.

If the domain is a .com and the registrant responds to a UDRP complaint with a credible legitimate-interest defense, transfer through arbitration may fail. A failed UDRP complaint does not bar a subsequent ACPA action; the Policy is explicit that it does not preclude court proceedings. In a matter we handled (a .com held by a registrant in a US state, autumn 2025), the client moved to federal court following a close UDRP outcome, and the in rem posture against the domain itself preserved leverage while personal jurisdiction was disputed.

If the domain is a ccTLD for which there is no UDRP equivalent – .de being the leading example, where there is no UDRP and disputes go to the German courts – ACPA cannot substitute for the foreign national procedure. The right approach is local litigation counsel in the relevant jurisdiction. ACPA applies only where a US court can properly assert jurisdiction; it does not extend American trademark law to every domain in every country.

If the domain was stolen rather than squatted, the sequence is usually: registrar lock escalation first, then, if the registrar fails to act or the transfer has already cleared, consider the in rem path. Registrar lock – a status code that prevents unauthorized transfers – is the first line of defense; litigation is the remedy when the lock failed or was bypassed.

Is ACPA always slower than a UDRP? For most disputes involving a single domain and a locatable registrant, the UDRP delivers a decision in roughly two months. US litigation routinely runs longer. The exception arises when a US federal court grants a temporary restraining order to freeze the domain pending trial – a measure the UDRP cannot replicate.

How ACPA compares to the UDRP and other routes

The decision between ACPA and the UDRP is not simply about speed. It turns on what outcome you need, what jurisdiction you can reach, and what evidence you hold. A quick comparison clarifies the choice.

The UDRP delivers a decision in roughly two months, costs USD 1,500 at WIPO for a single-member panel on one to five domains, and produces only a transfer or cancellation. It is the standard path for a .com cybersquatting complaint where the registrant is not in a position to sue back credibly.

ACPA offers damages – up to USD 100,000 per domain in statutory damages under the applicable anticybersquatting legislation where willful conduct is found – attorney's fees in exceptional cases, and the in rem mechanism when personal jurisdiction is unavailable. It applies to US registrars and registries. It is slower and more expensive; describe the timeline qualitatively as substantially longer than arbitration, because it depends on the court, the docket, and whether motions practice is needed.

For a .uk domain, neither applies: the Nominet DRS – administered by the WIPO Arbitration and Mediation Center since 7 July 2026 – governs. For .eu, the ADR.eu procedure at the Czech Arbitration Court applies. For .de, German court proceedings are the only route, with a DENIC DISPUTE entry to block transfer while the claim is in progress. Matching the procedure to the zone is the first practical decision in any domain dispute.

Why does this matter if my domain stopped resolving without my consent?

Your domain stopped resolving and the registration record changed without your authorization – that is the audience_pain this page addresses directly. The first question is not "which court?" but "what happened?" Account compromise, registrar fraud, and social-engineering attacks on support channels are distinct events with distinct responses.

If the registration was hijacked, the immediate priority is a registrar escalation to trigger a registrar lock and, where the registrar participates, an ICANN Registration Data Request Service (RDRS) inquiry to begin identifying the party who caused the transfer. ICANN announced in November 2025 that the RDRS pilot had been extended while next steps are decided; participation by registrars is not universal and disclosure is not guaranteed. That uncertainty makes the in rem ACPA path relevant: where the registrant cannot be identified, the domain itself becomes the defendant.

If the registration was not hijacked but was simply registered by a third party while your mark existed, you are in cybersquatting territory rather than theft territory. The UDRP is almost always the faster and more proportionate first move. ACPA becomes the right conversation when the UDRP fails, when the registrant is US-based with assets worth pursuing, or when the facts support injunctive relief a federal court can impose but an arbitral panel cannot.

COGNOMEN handles court action and domain theft recovery exclusively. To discuss whether US anticybersquatting litigation or another route fits your situation, contact info@cognomenlaw.com.

Related at COGNOMEN

• court recovery – court-based domain recovery and anticybersquatting action
• What is Abusive registration (Nominet DRS)? – defining abusive registration under the Nominet DRS test
• faq court action cybersquatting ae – common questions on court-based cybersquatting claims

Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.