Privacy by Design and Data Protection in Public DNS Resolvers: A Look at DNS4EU

Europe’s “Internet Phonebook” in the Age of Digital Sovereignty 

Every time someone types a web address into their browser, the Domain Name System (DNS) quietly converts that name into the numerical address computers use to connect, making this “internet phonebook” an essential yet largely unnoticed part of how we access the online world. A crucial component of the DNS is the resolvers that take a person’s request and perform a series of queries to find the corresponding IP address. Typically, this process involves several steps, like checking its own cache, querying root servers, top-level domain servers, and authoritative name servers until it retrieves the correct IP address. Thus, DNS resolution services are essential to the digital infrastructure market and to the functioning of the Internet as a whole. 

In response to escalating cybersecurity threats, increased surveillance, and ongoing debate over Europe’s digital sovereignty, the EU Cybersecurity Strategy was introduced to strengthen the digital ecosystem across Europe. Further, the EU Cybersecurity Strategy highlights that most EU businesses rely on a few public DNS resolvers operated by non-EU entities. If one of these resolver services is disrupted, it becomes much harder for the authorities to address potential malicious cyberattacks and major geopolitical and technical incidents. Therefore, DNS4EU, a co-funded Digital Europe project, aims to provide the EU with its own secure, privacy-friendly public DNS resolver that protects its users, strengthens resilience, and keeps critical internet infrastructure under EU control. 

Timelex leads the legal and ethics work package in this project and provides legal analysis and guidance to ensure that the public DNS resolver’s technical design, data governance, and operational model meet EU compliance requirements. 

DNS Queries and the GDPR 

From a data protection perspective, the General Data Protection Regulation (GDPR) remains the foundation of the EU’s legal framework. The GDPR adopts a broad definition of personal data that covers any information relating to an identified or identifiable natural person. This includes obvious details such as a person’s name, address, or ID number, as well as less intuitive elements such as IP addresses, cookie identifiers, device fingerprints, location data, or patterns of online behaviour. This definition ensures that fragments of technical data may also fall within the scope of GDPR whenever they can be linked, directly or indirectly, to a specific person. This was observed by the Court of Justice of the European Union (CJEU) in the Nowak judgment.

The CJEU affirmed the broad definition in the Breyer judgment, which held that dynamic IP addresses can constitute personal data when there are reasonable and lawful means to identify an individual, a principle directly relevant to public DNS services. The DNS4EU project has focused on the establishment and the operation of public DNS resolvers, which process substantial volumes of data, including potentially identifiable information such as some categories of IP addresses, individualised query logs and timestamps. As a result, the DNS4EU project needs to comply with the data protection principles enshrined in the GDPR, including lawful, fair, and transparent processing, the data minimisation principle and secure processing.

Privacy by Design in Practice 

Public resolvers, including those of the DNS4EU project, can be used by public administrations, businesses, and end-users across the EU, providing secure and compliant DNS resolution while protecting against threats such as phishing, malware, and other region-specific cyber risks. 

Therefore, it is necessary to build an infrastructure grounded in a privacy-by-design philosophy, i.e., minimising data collection, processing personal data within the EU, and embedding safeguards through technical and organisational measures. 

As a part of this work, the role of the operator of the public resolver services (Whalebone) as a controller or processor was assessed in relation to the different use-cases envisaged in the DNS4EU project. The potential risks and mitigation measures had to be defined to ensure that appropriate safeguards were put in place. For instance, in DNS4EU, IP addresses along with timestamps and content descriptions are retained only in the context of: 

(i) Resolving DNS requests: for milliseconds in up to seconds order to return a response, and then immediately discarded; 

(ii) Cybersecurity threat research: for approximately six months; 

(iii) Troubleshooting: for approximately three months.; 

(iv) If a user chooses to access a potentially malicious domain after receiving a warning page: for approximately up to 24 hours. 

In all other cases, IP addresses are immediately processed using privacy-preserving techniques such as cryptographic hashing, so that the resulting dataset is no longer reasonably linkable to a data subject.

In addition to such policies, DNS4EU’s architecture incorporates multiple other legal and ethical safeguards: 

• EU-Based Data Processing and Sovereignty: All DNS resolution data is processed within EU-based data centres, ensuring full application of EU privacy protections and avoiding unnecessary exposure to non-EU jurisdictions. 

• Data Anonymisation and Minimisation: Support for DNS over TLS (DoT) and DNS over HTTPS (DoH) ensures DNS traffic is encrypted in transit, protecting it from interception or manipulation. 

• Optional Protective Layers: Users may choose to select additional filtering modes (malware/phishing blocking, child protection, or advertisement blocking) according to preference. 

• Neutrality: Content blocking occurs only where required by applicable law, by enforceable decision of a competent authority, or when selected by the user. The plain DNS resolution mode offers unfiltered access within the confines of applicable law. 

Full details are available in the DNS4EU Public Resolver Terms of Use, which provides general information about the service, and in DNS4EU’s Public Resolver Policy, which sets out the scope, purposes, and retention limits of processing in transparent terms. 

Commitments in Operation: Compliance as an Enabler 

At the heart of DNS4EU’s design is a simple idea: users should be able to trust that their internet activity is handled securely, fairly, and in line with European values. These principles shape both how the service operates and how it is governed. Privacy, security, and transparency are not features added at the end but are part of the project’s foundation from the start. 

The aim is not only to meet EU data protection and cybersecurity standards but also to show that strong compliance can actually enable innovation and strengthen trust. In a global internet environment, DNS4EU offers a European alternative that reinforces the EU’s broader goals of digital sovereignty and respect for fundamental rights. 

If you’d like to learn more about the launch of the DNS4EU public service, please refer to the DNS4EU website via this link. 

The DNS4EU project is co-funded by the European Union, under Project number: 101095329 21-EU-DIG-EU-DNS. The content of this article reflects the opinion of its authors and does not in any way represent opinions of the European Union or the European Commission. Neither the European Union nor the granting authority can be held responsible for them.