In 2018, Tucows launched our Tiered Access Compliance and Operations (TACO) platform to manage registration data disclosure requests. From the start, we’ve tracked the requests we receive and committed to publishing this data to promote transparency around access to registrant information. In this post, we’re not only sharing our most recent TACO statistics, but taking a look back at how request and disclosure rates have changed over the years.

Request rates 2018 – 2025

Total requests by year

Over our eight years of operating TACO, we have seen an overall decline in request rates from just over 2000 requests in 2018 to just under 500 requests in 2025. This includes requests that were submitted through ICANN’s pilot program, RDRS as well as those submitted through TACO directly. It’s important to note, as we did at the time, that the initial influx of requests in the first few months of TACO’s existence came from one particular requestor.

Total requests by year line graph.

Total requests by category

If we look by requestor category, we see that, while Commercial Litigation was at first the primary requestor group, recently law enforcement requests have increased and taken the lead.1

Total requests by category line graph.

Disclosure trends

Our disclosure rate peaked at 77% in 2020, the same year that the total number of requests was at its height. This followed a volatile first couple of years during which we devoted significant resources to educating requestors on how to provide comprehensive packages so that their requests could be reviewed.

With abandoned requests, we saw almost the reverse: the abandonment rate was highest that first year, while, in later years, it evened out. The trend remains that the majority of requests result in disclosure of information, indicating that this system is working: people are getting the information they need, and we are continuing to balance the rights of the requestor against the rights of the data subject.

Disclosure trends bar graph.

Local and foreign law enforcement request trends

LEA request origin (local vs foreign)

In June 2024, we first shared data about where law enforcement requests come from. We divide law enforcement agencies (LEA) into two broad categories: “local” for the countries where we have corporate offices (Canada, Denmark, Germany, and the United States), and “foreign” for LEA from all other countries. This is because the way we respond to local requests is slightly different from the way we manage foreign requests. When requests come from local law enforcement, we want to both maintain good relationships and meet our legal obligations. When requests come from foreign law enforcement, on the other hand, legal requirements may be quite different, and we have an even greater obligation to ensure that due process and data protection are maintained and respected.

The overall requestor breakdown—about 85% foreign and 15% local—remains the same now as it was when we first reported on it. However, as you’ll see in the next chart, we have noticed a recent increase in local LEA requests from one of our local jurisdictions.

Number of requests line graph.

Local LEA request breakdown (overall)

Breaking down local law enforcement disclosure requests by country shows that the United States most frequently submits the highest number of requests, though Germany has led in some years. Canada also ranked first in one reporting period.

Local LEA request breakdown overall bar graph.

Requests by business line

The differences in request rates across our Tucows registrar brands may simply be attributable to the business size—OpenSRS is the largest of our accreditations, so it makes sense that it would receive the most requests. We also record requests that fall into an “Other” bucket—mostly comprised of misdirected requests intended for a registrar that isn’t part of the Tucows family. While the annual volumes of “Other” requests have fluctuated, we’ve seen an overall increase in this category. We consider the “Other” bucket to be a source of pride: we’ve built the most recognizable and accessible previously-public Whois disclosure request system on the Internet, and it shows.

Requests by business line bar graph.

Remember, you can always look back through the Tiered Access blogs to see the stats for each reporting period (there are three per year) and our deep dive into the policy-related topic we found relevant at the time. Our favourites are this 2022 post about due process, this 2023 post about Urgent requests, and our recent review of Whois Privacy services and proxy registrants.

Tiered access statistics: 1 September – 31 December 2025

We received 116 requests in this period, bringing the total since we began tracking to 6640. Denials are the lowest they’ve been since 2018, at only 6% of the total, while disclosures increased to 60%, a rate they haven’t seen since 2022. We see this as a success of education and adoption of the RrSG’s Minimum Required Information for Whois Data Requests document—we are getting higher quality requests that demonstrate a clear need for the data.

Data disclosure request outcomes: new period (September – December 2025)

Data disclosure request outcome new period pie chart.
Disclosure rate bar graph.
Abandon rate bar graph.
Denied rate bar graph.
Privacy-protected request rate bar graph.

Urgent requests

We wrote about Urgent requests earlier this year and intend to continue to track them moving forward.

In the new reporting period, we received 4 requests marked “Urgent.” However, those four requests related to fraud investigations and did not meet the definition of Urgent. We also received one request that was not marked Urgent but related to a situation that did meet the definition; the data was disclosed accordingly.

Urgent requests chart.

Requests by requestor category

Requests by category: new period (September – December 2025)

Law enforcement requests were once again the most frequent requestor category in the reporting period, continuing to outnumber Commercial Litigation. But, given our experience over the last five years, we expect that it will shift again. Outside those two groups, we received only one request in this reporting period; it was a request to contact a domain owner with an unsolicited purchase offer, so we provided instructions on how to do so directly.

Requests by category new period pie chart.

Requests by category since 2018

Requests by category since 2018 bar graph.

Requests by category (total)

Requests by category total pie chart.

Abandoned requests by requestor category (September – December 2025)

We continue to receive requests that are abandoned when we follow up to ask for more information:

Abandoned requests by requestor category bar chart.

LEA request locations

We received our first request from a Turkish law enforcement agency during this period.

LEA request locations world map.

We continue to receive the bulk of our LEA requests from outside our local jurisdictions, both overall and in the new reporting period. However, in the new reporting period, the requests from local law enforcement significantly increased—from 7% last period to 31% this period. This is primarily due to an increased number of requests from German law enforcement. We don’t know whether this indicates a stronger German focus on cybercrime, whether they’re more heavily leveraging registration data, or if something else is contributing. In any case, we’re pleased to be able to help them where we can.

LEA request origin (local vs foreign) – overall

LEA request origin overall pie chart.

LEA request origin (local vs foreign) – new period

LEA request origin new period pie chart.

Local LEA request breakdown (overall)

Local LEA request breakdown overall pie chart.

Total requests over time

Total requests over time line graph.

To read our past Tiered Access blog posts, please see:

1Note that we include this data in every TACO stats post (in “Requests by requestor category,” formatted to focus on which type of request was most common). We have included this line chart to clearly highlight how the rates have changed over time.