The privacy principle
Privacy is part of the protocol, not a setting. Every attestation should prove the specific claim a service needs, such as "unique real human" or "authorised to spend up to $500", without revealing the identity or data behind it.
In practice
What a service needs, and what it does not
A forum
May need
Unique real human.
May not need
Full name, date of birth and passport number.
A merchant interacting with an AI agent
May need
Agent is authorised to spend up to $500.
May not need
The principal's home address.
A hiring platform
May need
Same verified candidate remained present during the assessment.
May not need
Government identity data permanently stored.
Commitments
Privacy commitments in the architecture
Identity is optional
Personhood and identity are separate layers. "Verified human, identity undisclosed" is a first-class result.
Claims, not raw data
Applications are designed to receive attestations describing what was established, not the underlying signals.
Minimum collection
Each verification is designed to collect the minimum information required for the claim requested, and no more.
Purpose limitation
Evidence gathered to answer a trust question should be used for that question, not repurposed for profiling or advertising.
Lawful and appropriate signals
Signals such as face presence are only appropriate where legally permitted and proportionate to the context.
Not surveillance
Proof of Actor is designed to make agency explicit, not to watch people. A system people experience as surveillance has failed.
Build privacy into trust from the start.
Design partners help decide which claims attestations should carry. Help us keep them minimal.