Most Australian businesses treat a domain registration as a five-minute admin task. You pick a name, enter a credit card number, and move on. That works fine — right up until it doesn't. A domain that clashes with a registered trade mark, one registered under the wrong name, or one acquired from a third party without a proper agreement can each create costly problems that a small amount of upfront attention would have avoided.
The legal considerations aren't complex once you know what they are. This article walks through them in the order they actually arise: what to check before you register or buy, how to structure a purchase from a third party, how to get ownership right, and what compliance obligations attach to the website you build on the domain.
What the registers don't tell each other
The first thing worth understanding is that Australia's key registers — ASIC's business name register, IP Australia's trade marks register, and the domain name system administered by auDA — do not cross-check each other. A domain name can be technically available, and the same name may already be someone else's registered trade mark in your industry.
This matters because trade mark infringement does not require bad faith or even awareness. If you register and use a domain that is identical or deceptively similar to a registered trade mark covering the same or closely related goods or services, the trade mark owner has grounds to act against you — regardless of whether you registered the domain first, or whether your business name was approved by ASIC.
Before you settle on a domain, it is worth searching IP Australia's trade mark register for identical or similar names in your industry. If someone holds a registered mark that conflicts with your chosen domain, you have a problem that exists independently of whether the domain itself is available to register.
The reverse risk is equally real: if you have built brand equity around a name and have not registered a trade mark, someone else could register a similar domain and use your reputation against you. Aligning your domain strategy with a trade mark application early is cheaper than resolving a dispute later.
Business names are not trade marks
A business name registered with ASIC gives you the right to trade under that name in Australia — nothing more. It does not give you exclusive IP rights in the name, and it does not prevent someone from registering a domain that uses the same words. Treating a business name registration as equivalent to trade mark protection is one of the most common misconceptions in this space.
What .au eligibility actually requires
If you are registering a .com.au, .net.au, or .org.au domain, you must satisfy auDA's eligibility rules before you can hold the licence.
For .com.au (the most common choice for commercial businesses), you need an Australian presence — typically demonstrated by an active Australian Business Number (ABN) or Australian Company Number (ACN). You also need the domain name to have a "close and substantial connection" to your business: ordinarily, this means the domain should correspond closely to your registered business name, company name, or trade mark. The Domain Name Eligibility and Allocation Policy Rules (July 2024) set out the current requirements in detail.
Holding a domain without ongoing eligibility — for example, if your ABN is cancelled after you close a business — means you are no longer entitled to hold the licence. This is worth bearing in mind when you restructure or wind up an entity that holds domain assets.
The newer .au direct namespace (for example, yourbusiness.au) operates differently: it is open to anyone with an Australian presence and does not require a close and substantial connection to the registered name. If you hold a .com.au or .net.au domain, you may have had priority rights to claim the equivalent .au direct domain, depending on when that window applied.
How .au domain disputes work
If someone registers a .au domain that conflicts with your trade mark or name rights, you can challenge it through the .au Dispute Resolution Policy (auDRP), administered by auDA. The auDRP is a faster and generally less expensive alternative to litigation.
To succeed in an auDRP complaint, you need to establish four things: that you own rights to a relevant trade mark or name; that the disputed domain is identical or confusingly similar to that mark or name; that the registrant has no legitimate rights or interest in the domain; and that the domain was registered or used in bad faith. Complainant fees start at around $2,000, depending on the number of domains in dispute and the panel size chosen.
The flip side applies to you as a registrant. If you register a domain that someone else later challenges under the auDRP, bad faith registration is one of the criteria they must establish. Registering a domain that clearly mirrors a competitor's trade mark — even if you think you can make the eligibility rules work — carries real dispute risk.
Buying a domain from a third party
Buying a domain from another person or business is a different transaction from a standard registration. You are acquiring an existing licence, which means you need to document the deal properly and ensure you actually obtain control — not just a promise.
What the agreement should cover
Even for a modest purchase price, a written agreement reduces the risk of the sale unravelling later. The key terms to record are:
- Who is selling: The seller's full legal name and ABN or ACN, and confirmation that they are the registrant (or are authorised to sell on the registrant's behalf). If the domain is held by a company, authority to sell should be properly documented on the company's side.
- What is included: The domain name itself, and whether the sale extends to related assets — website files, content, associated email accounts, social media handles, or any intellectual property that has been built around the name. If associated IP is included, a separate written assignment of that IP is usually needed to make the transfer effective.
- Price and payment: The amount, timing, any deposit, and what happens if the transfer does not complete.
- Transfer obligations: The steps each party is responsible for, a timeframe, and what "completion" means — typically, successful transfer of the registrar account or domain licence to your control.
- Seller warranties: Written confirmation that the seller has the right to sell, the domain is not subject to any security interest, dispute, or regulatory hold, and the seller is not aware of any third-party claim to the name.
- Post-sale restraints: If it matters to your business, the seller agrees not to register confusingly similar domains or trade on the brand goodwill you are acquiring.
Protecting payment in a transfer
For anything other than a nominal price, pay attention to the sequencing of payment and transfer. Paying in full before you have confirmed the domain is genuinely transferable — and have initiated the transfer — puts you in a weak position if the seller loses interest or a complication emerges. A common approach is to structure the payment so the transfer is confirmed (or actively in progress and verified at the registrar level) before final payment is released. For higher-value transactions, a formal escrow arrangement achieves this more securely.
Also check the domain's history before you pay. A domain previously used for spam, misleading advertising, or objectionable content may carry email deliverability problems or search penalties. An inherited history of consumer complaints can also create consumer law exposure if customers carry over expectations about the business that used the name before you.
Getting ownership right from the start
How the domain is registered, and in whose name, is a practical ownership question that has legal consequences when the business changes.
Sole traders and companies
If you operate through a company, the company should ordinarily be the registrant, not you personally. A domain registered in your personal name is an asset you personally hold — not a company asset — which creates complications if you bring on investors, sell the business, or if the company is wound up.
If you are a sole trader, personal registration may be appropriate, but keep registrar credentials documented and secure. Losing access to a registrar account is a common and avoidable problem.
Co-founders
If two or more people are founding a business together and one of them registers the domain personally, the domain belongs to that person — not to the business or to the other founders. This can become a significant point of leverage in a dispute if the founding relationship deteriorates.
The cleanest approach is to register the domain under the business entity (or whoever the agreed owner is), and to record expectations about key assets in your shareholders agreement or founders agreement from the start. A provision that requires key IP assets, including domains, to be transferred to the company on departure is a reasonable and common protection.
Developers and agencies
It is common for a web developer or agency to register a domain while setting up a website. That is not inherently a problem, but you need to ensure the registrant details show your business (not the developer), and that you have independent admin access to the registrar account. A developer who holds your domain in their account is holding a business asset of yours — and if the relationship ends badly, recovering it can be difficult and time-consuming.
If a developer or agency needs access to manage DNS or hosting, that access should be scoped appropriately and your agreement with them should address what happens to the domain and related assets when the engagement ends.
What attaches to the website after you buy the domain
Once the domain is live and a website is running on it, a separate layer of legal obligations applies — most of which are not specific to domain names but are often encountered for the first time when a business goes online.
Website terms and conditions
If your website allows customers to request services, make enquiries, or purchase anything, website terms and conditions set out the rules of engagement. They address what you offer, what limitations apply to your liability, and how disputes are handled. For an e-commerce site, the customer-facing terms are more extensive: they need to cover ordering, payment, delivery, returns, and cancellation in a way that is consistent with the Australian Consumer Law guarantees that apply by default.
Privacy obligations
Whether the Privacy Act 1988 (Cth) applies to your business depends primarily on your annual turnover. Under s 6D of the Act, businesses with an annual turnover of $3 million or less are generally exempt from the Act's Australian Privacy Principles. However, the exemption does not apply to all businesses at that scale — health service providers, businesses that trade in personal information, and certain other categories are covered regardless of turnover.
Even if the Act does not strictly apply to your business, collecting personal information through a website — contact forms, newsletter signups, booking tools, analytics with user identifiers — creates expectations on the part of visitors that you will handle that data responsibly. Publishing a clear, accurate privacy policy is standard practice and increasingly expected by customers, payment providers, and platforms your business connects with.
The Office of the Australian Information Commissioner (OAIC) provides guidance specifically for small businesses navigating their obligations.
Australian Consumer Law and your online representations
Everything on your website is a representation — pricing, product claims, service guarantees, turnaround promises, testimonials. Under s 18 of Schedule 2 to the Competition and Consumer Act 2010 (Cth), a person must not, in trade or commerce, engage in conduct that is misleading or deceptive, or likely to mislead or deceive. This applies to your website content in full.
The practical implication is that your website claims need to be accurate, substantiated, and consistent with what you actually deliver. A "best price guarantee" you cannot back up, a "free trial" with conditions buried in fine print, or a stated refund policy that does not match your actual practice can each generate ACCC attention or consumer complaints. Reviewing your website content against your actual operating terms before launch — and when they change — is a straightforward way to reduce that risk.
Security and access controls
Domain hijacking and email account compromise are genuine risks with real business consequences — customer data exposure, reputational harm, and the cost of recovery. Once your domain is live:
- Use strong, unique passwords and enable multi-factor authentication on your registrar account, email platform, and hosting accounts.
- Limit admin access, particularly for contractors and former staff — access that is not removed when someone leaves the business is a recurring source of incidents.
- Keep a record of who holds access to which systems, so you can audit and revoke it when circumstances change.
These are operational disciplines rather than legal requirements in most cases, but the consequences of failing to apply them can create both legal exposure (particularly under privacy law, if customer data is compromised) and commercial harm that is difficult to reverse.
Where Artificer Legal can help
The legal work connected to a domain acquisition tends to cluster around a few points: due diligence before a purchase, drafting or reviewing the sale agreement, IP assignment if brand assets are included, and setting up the governance documents (shareholders agreement, founders agreement, development agreements) that prevent ownership disputes from arising later.
An Artificer Legal practitioner can:
- Review the proposed domain purchase and flag any trade mark, eligibility, or title concerns before you commit.
- Draft a domain sale agreement that covers the deal terms, seller warranties, transfer obligations, and post-sale restraints appropriate to the transaction.
- Prepare an IP assignment where brand assets, content, or a logo are included in the sale.
- Advise on how to document domain ownership within your co-founder or shareholder arrangements.
- Review your website terms, privacy policy, and key marketing claims for ACL compliance before the site goes live.
For straightforward registrations or lower-value purchases, a short consultation is often enough to confirm you have the key risks covered. For acquisitions where the domain represents a significant brand asset, a more structured review of title, history, and related IP is warranted.
The step most commonly skipped
The single most consequential oversight in this area is not the domain purchase itself — it is the failure to check for trade mark conflicts before building around a name. Businesses invest months of effort and real money into a brand before discovering that another party holds a registered mark that makes their chosen name unviable. That discovery is far more disruptive and expensive when it comes after the website is live, the business cards are printed, and customers know you by the name.
A trade mark search against IP Australia's register before you commit to a domain takes a matter of minutes. It does not replace legal advice about whether a conflict is legally material, but it surfaces obvious problems before they become expensive ones.
To summarise the key points: domain registration is a legal act with commercial consequences, not a technical formality. Check for trade mark conflicts before you commit to a name. For .com.au domains, confirm you meet auDA's eligibility requirements and understand the close and substantial connection rules. If you are buying from a third party, document the deal and structure the payment to follow transfer — not precede it. Register the domain under your operating entity, and address domain ownership in your co-founder or shareholder documents from the outset. Once the site is live, your website content, privacy practices, and customer terms need to align with your actual operations and with the obligations the ACL imposes.