Passing off can help protect businesses when someone registers a misleading domain name that could confuse customers or take advantage of their reputation. Our litigation experts explain the key legal principles, examine the landmark Marks & Spencer v One in a Million Ltd case, and outline practical steps businesses can take to protect their brands online.
Imagine discovering that someone has registered a domain name almost identical to your business name and is offering to sell it back to you at a premium. Even if the website isn’t live, the registration alone could damage your brand and confuse customers.
This is where the law of passing off can help. Although traditionally used to protect business goodwill in relation to goods and services, passing off has evolved to protect businesses in the digital age, including against cybersquatting and misleading domain name registrations.
At its core, the tort prevents one trader from misrepresenting their goods, services or business as being connected with another, thereby unfairly benefiting from that trader’s established reputation. There are three key elements which must be established to succeed in passing off:
Goodwill
Goodwill is the attractive force that brings in customers and is generated by a business’s reputation. It is not sufficient to merely prove that the defendant is using the company’s reputation; the claimant must show that the defendant has sought to benefit from that goodwill by attracting the claimant’s customer base.
Misrepresentation
A false representation must be made that led people to believe the defendant’s goods or services were those of the claimant. The key consideration is whether a number of customers are likely to be deceived. Being unaware of this misrepresentation, known as innocent misrepresentation, is not a relevant defence and may still constitute misrepresentation.
Damage
The claimant must show that they suffered or are likely to suffer damage as a result of the misrepresentation.
Marks & Spencer v One in a Million Ltd [1998]
In the late 1990s, before online brand protection was commonplace, a company called One in a Million registered domain names corresponding to famous businesses including Marks & Spencer, Sainsbury’s and Virgin. Rather than using the websites, it intended to sell the domain names back to the businesses at a profit.
The Court had to decide whether simply registering those names could amount to passing off, even though no trading had yet taken place.
The defendants argued that they were not using these domain names “in the course of trade” and as such, didn’t meet the requirements to be categorised as passing off. Contrastingly, the claimants’ position was that registering these domain names exploited their goodwill and caused deception to the public.
What was the Court’s decision?
The Court found in favour of the claimants and granted injunctive relief, restraining the defendants from dealing in the domain names and requiring their transfer to the relevant companies.
The Court held that domain names can function as business identifiers, meaning that registering a domain incorporating a well-known business name may itself amount to a misrepresentation. Although the defendants had not actively used the domain names, the registrations created a real risk of deception and could exploit the claimants’ goodwill by suggesting an association with their businesses.
The Court considered the domain names to be “instruments of fraud”, particularly given the defendants’ intention to sell them at a profit, and found that the registrations threatened reputational damage and public confusion. As a result, it granted injunctive relief to prevent both the immediate and future misuse of the domain names, demonstrating that passing off can provide preventative protection before actual damage has occurred.
What does this mean for my business?
The decision in One in a Million is significant because it confirms that passing off can provide preventative protection in the digital context, even before a misleading domain name is actively used. A domain name may create a misleading association with an established business even before it is used for a live website or trading activity.
For brand owners, the case underlines the importance of monitoring domain name registrations and acting quickly where a registration appears to exploit existing goodwill or create a risk of public confusion.
What should businesses do?
Take a proactive approach to protecting your brand online. Registering a company name at Companies House or even owning a registered trademark does not automatically secure the corresponding domain names, making it important to consider domain name protection.
Regularly monitor domain name registrations incorporating a trading name or brand.
Register the key domain names associated with your brand as early as possible, including common variations and relevant top-level domains, to reduce the risk of third parties acquiring them.
Act quickly if a misleading registration is discovered. Many organisations use domain monitoring services to alert them to suspicious registrations as they arise.
Ensure that your business’ wider intellectual property portfolio is kept under review. Registered trademarks can provide additional protection alongside passing off, particularly where it may be difficult to establish goodwill or where swift enforcement action is required.
A combination of trade mark protection, proactive domain name management and regular monitoring provides the strongest defence against cybersquatting and other forms of online brand misuse.
Ultimately, early legal advice can often prevent more significant disputes and protect valuable goodwill before damage occurs. If your business has discovered a potentially infringing domain name, or you would like guidance on protecting your brand online, please get in touch with our experienced litigation team who would be happy to help.
Our Legal 500-rated litigation & dispute resolution team help private and commercial clients to resolve a wide range of disputes, including matters that can be resolved through mediation.
Disclaimer: All legal information is correct at the time of publication but please be aware that laws may change over time. This article contains general legal information but should not be relied upon as legal advice. Please seek professional legal advice about your specific situation - contact us; we’d be delighted to help.
Understanding the role of due diligence when buying commercial property is crucial for investors, developers and business owners alike. In this video, our experts suggest what can happen when issues emerge…
Willans is excited to have received a number of new and improved recommendations in the latest editions of independent national legal guides, Chambers UK and The Legal 500, with recognition…
The new Property Information Form (TA6) sixth edition became mandatory from 30 March 2026. Our property disputes experts share their guidance on property misrepresentation and the new TA6 form. If…
By clicking Accept you are agreeing to the use of all cookies which will allow us to provide you with the most relevant experience when visiting or re-visiting this website. This means that your personal preferences will be remembered when you use this website. You can change your consent or choose specific settings by clicking "Cookie Settings". By clicking "Reject All" we will not use any non-essential cookies. Essential cookies will still be used for the website to function properly. Please see our cookie policy and privacy notice for more information about how we process your personal data.
Our website uses cookies to improve your experience while you navigate through our website. Out of these cookies, the cookies that are categorised as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyse and understand how you use our website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies but it may affect your browsing experience on our website. You can find our cookie policy here.
Necessary cookies are absolutely essential for our website to function and enable core functionality such as security and accessibility. These cookies do not store any personal information. You can block these cookies by changing your browser settings, but this may affect how the website functions.
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Cookie
Duration
Description
__cf_bm
30 minutes
This cookie, set by Cloudflare, is used to support Cloudflare Bot Management.
mgref
1 year
This cookie is set by Eventbrite to deliver content tailored to the end user's interests and improve content creation. It is also used for event-booking purposes.
yt-player-headers-readable
never
The yt-player-headers-readable cookie is used by YouTube to store user preferences related to video playback and interface, enhancing the user's viewing experience.
yt-remote-cast-installed
session
The yt-remote-cast-installed cookie is used to store the user's video player preferences using embedded YouTube video.
yt-remote-connected-devices
never
YouTube sets this cookie to store the user's video preferences using embedded YouTube videos.
yt-remote-device-id
never
YouTube sets this cookie to store the user's video preferences using embedded YouTube videos.
yt-remote-fast-check-period
session
The yt-remote-fast-check-period cookie is used by YouTube to store the user's video player preferences for embedded YouTube videos.
yt-remote-session-app
session
The yt-remote-session-app cookie is used by YouTube to store user preferences and information about the interface of the embedded YouTube video player.
yt-remote-session-name
session
The yt-remote-session-name cookie is used by YouTube to store the user's video player preferences using embedded YouTube video.
ytidb::LAST_RESULT_ENTRY_KEY
never
The cookie ytidb::LAST_RESULT_ENTRY_KEY is used by YouTube to store the last search result entry that was clicked by the user. This information is used to improve the user experience by providing more relevant search results in the future.
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Cookie
Duration
Description
_ga
2 years
The _ga cookie, installed by Google Analytics, calculates visitor, session and campaign data and also keeps track of site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognize unique visitors.
_gat
1 minute
This cookie is installed by Google Universal Analytics to restrain request rate and thus limit the collection of data on high traffic sites.
_gid
1 day
Installed by Google Analytics, _gid cookie stores information on how visitors use a website, while also creating an analytics report of the website's performance. Some of the data that are collected include the number of visitors, their source, and the pages they visit anonymously.
_s
1 year
This cookie is associated with Shopify's analytics suite.
G
1 year
Cookie used to facilitate the translation into the preferred language of the visitor.
vuid
2 years
Vimeo installs this cookie to collect tracking information by setting a unique ID to embed videos to the website.
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
Cookie
Duration
Description
VISITOR_INFO1_LIVE
6 months
YouTube sets this cookie to measure bandwidth, determining whether the user gets the new or old player interface.
VISITOR_PRIVACY_METADATA
6 months
YouTube sets this cookie to store the user's cookie consent state for the current domain.
YSC
session
Youtube sets this cookie to track the views of embedded videos on Youtube pages.