I think any PCI or other auditor who doesn't flag "domains registered with GoDaddy" during an audit is doing clients a disservice, given all the bad stuff that's happened. I'm not sure how exactly you could flag it for a client, though.
True, but what other registrar has publicly stated that they won't do what GoDaddy is currently doing? Because until I can find the registrar that makes that promise (all the alternatives I've found are just customers making that claim on behalf of the company), this seems more like a demonstration of the problem of all .com registrars and GoDaddy is just the biggest so they get all the spotlight.
As far as I'm aware, Tucows follows the ICANN dispute policy pretty closely. I've been a reseller with them forever (11-12 years?), and had a bunch of domains registered for clients which almost certainly would have drawn GoDaddy's ire, and never a problem.
http://www.tucowsdomains.com/tucows-domain-promise/
"A thoughtful, “registrant-first” approach to dispute resolution.
Tucows’ approach to any domain name dispute begins with the firm belief that your domain name is your own. We also have a full-time, dedicated Compliance Team to make sure these matters get the attention they deserve. We will not allow your domain name to be used as leverage in a dispute. We will not readily “seize” your domain name under public pressure as other registrars have done."
eNom is the other one where I know some of their management. They have killed some domains in the treasury table of deny orders, rather than going through the full ICANN process, but are nowhere near as arbitrary as GoDaddy.
You could go with a foreign registrar. I used to like gandi.net because it was based in France, so it had to observe EU privacy laws (you'd still be subject to the US with respect to .com domains though). However, Gandi.net now also hosts in the US, so I don't know what that would mean. Plus, hosting in a different country could expose you to their local laws.
It also subjects you to Gandi's personal code of ethics, which they require you to agree to and may take your domain if you violate. It's a little strange and I wouldn't register a domain for an adult site there, at least.
I don't know how many people know of this registrar, but nearlyfreespeech.net is one I really do trust. Stuff like monthly donations to the EFF and detailed technical explanations of patched security flaws give them credability in my eyes.
I think a lot of people feel actions speak louder than words. Nobody says they won't do this, some companies demonstrably do and some demonstrably don't do this.
