GoDaddy is a NYSE-listed (GDDY) domain-registration and web-hosting company. Its own privacy policy discloses that it collects personal data both directly (account setup, service use, support contacts) and automatically via cookies, web beacons, and scripts whenever a person visits its websites, uses its services, or views its advertising, and states it also obtains personal data about people from other sources including social media and third-party data providers. The policy states GoDaddy does not sell, lease, rent, or transfer personal data for monetary consideration, but does disclose data to business partners and to marketers/advertisers for personalized marketing. GoDaddy's FY2025 Form 10-K confirms its Class A common stock trades on the NYSE under ticker GDDY, and separately discloses that GoDaddy entered into a settlement, approved by the FTC on May 21, 2025, requiring compliance with a 20-year data-security order. The FTC's own press release states the order resolved allegations that GoDaddy "failed to implement standard data security tools and practices" — including no multi-factor authentication and no security-threat monitoring — which enabled multiple data breaches, and that GoDaddy separately deceived users about compliance with the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks.
TRACK RECORD
1 ENFORCEMENT ACTION
[2025-05-21]
The FTC's press release states it finalized an order with GoDaddy settling allegations that the web-hosting provider misled consumers by failing to implement data security protections, which led to several data breaches; the FTC alleged GoDaddy failed to use multi-factor authentication, monitor for security threats, and secure connections to consumer data, and separately alleged GoDaddy deceived users about its compliance with the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks.
GoDaddy's privacy policy states it collects personal data when a person sets up an account, uses its services, or contacts it, and separately collects personal data automatically whenever a person visits its websites, uses its services, contacts it, opens its emails, or views its advertising — including device ID, IP address, and information about web pages and other websites visited.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
GoDaddy Inc.'s Form 10-K for fiscal year 2025, filed with the SEC, confirms its Class A common stock, par value $0.001 per share, is registered and trades on the New York Stock Exchange under ticker symbol GDDY.
GoDaddy's privacy policy states under "No Sale of Personal Data" that it does not sell, lease, rent, or transfer personal data to third parties for monetary or other consideration, while the same "Disclosures to Others" section discloses that data is shared with processors, business partners, and "marketers and advertisers, including for the purpose of creating and delivering personalized marketing and advertising messages," plus a standard carve-out to transfer data if GoDaddy sells assets or merges with a third party.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes.
The FTC's press release states it finalized an order with GoDaddy settling allegations that the web-hosting provider misled consumers by failing to implement data security protections, which led to several data breaches; the FTC alleged GoDaddy failed to use multi-factor authentication, monitor for security threats, and secure connections to consumer data, and separately alleged GoDaddy deceived users about its compliance with the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks.
GoDaddy's own FY2025 Form 10-K discloses that it entered into a settlement agreement, approved by the FTC on May 21, 2025, resolving FTC charges related to its security practices and advertising, under which GoDaddy must comply with specific requirements — including hosting-service security requirements — for at least 20 years, and that non-compliance could expose it to further FTC investigation or litigation.
GoDaddy's privacy policy states it uses three main types of online identifiers across its website and services — cookies, web beacons, and scripts — and distinguishes session cookies (which expire) from persistent cookies that remember user preferences and settings across multiple visits.