Zero-knowledge proof in action: Current and potential applications

As digital services take on a larger role in our daily lives, many routine tasks increasingly require users to provide extensive personal information, often through lengthy forms or ID uploads. For users, this can feel cumbersome; for organisations, it creates operational inefficiencies and adds the complexity of managing sensitive data.

In retail, e-commerce, peer-to-peer marketplaces, mobility services, and media platforms, full identity verification is often more than necessary. Collecting and storing user information places a strain on internal processes. It also comes with strict regulatory obligations under GDPR and the Digital Services Act.

The combination of operational burden, compliance pressures and limited added value is driving companies to embrace data minimisation to collect only what they truly need. This is bringing zero-knowledge proof (ZKP) and proportional identity verification into the spotlight. Once niche cryptographic tools that were mostly used in blockchain technology, they are gaining traction as practical solutions for product teams looking to verify exactly what is required (such as age, residency, or eligibility) without collecting or storing full identity data.  

This blog explores how different sectors are replacing full identity verification with lightweight checks to confirm whether a user meets the necessary criteria. It also highlights potential implementations across various industries.

Traditional identity verification attempts to answer the question: “Who is this user?” It collects full names, birthdates, addresses, or government IDs, even when only a single piece of information is relevant.  

Qualifying a customer, on the other hand, answers: “Does this user meet the specific requirement that matters right now?” To answer this question, a simple yes/no answer is sufficient.  

Using zero-knowledge proof principles, qualifying a user confirms attributes such as age, residency, student status, or eligibility for a discount without collecting full identity data. The process does not store any personal information, not even the verification outcome. This eliminates retention obligations and reduces the scope of GDPR compliance.

For product teams, qualifying a user means more streamlined onboarding, lower operational overhead, and stronger user trust, all while safeguarding privacy and anonymity.  

Platforms like digital identity platform itsme^® embed ZKP functionality directly into the user experience, allowing businesses to verify what exactly matters at the point of interaction. 

Learn more: Why is minimum disclosure becoming more top of mind for businesses?

Currently, the most common applications of ZKP focus on verifying if a user is within the acceptable age limit to access a certain service or product, as we explore below:

• Retail & E-commerce: In Germany, public cigarette vending machines must legally prevent underage purchases. Payment terminals for vending machines known as KarL4 integrate age verification directly into the payment process using the girocard, Germany’s national debit card system. When a customer taps their card, the terminal confirms that they are at least 18 without storing personal data. By confirming eligibility without collecting full identity information, this example illustrates how privacy-preserving verification can be applied at scale. 

• Streaming & media platforms: In France, the government has introduced a new age verification standard to protect minors from harmful online content. This standard goes beyond simple self-declarations, requiring rigorous checks such as digital ID verification, while ensuring double anonymity. This means that age verification providers and the sites themselves cannot identify users or track their activity. Similarly, adult content platform BlissFlix allows content creators to verify that they are above 18 years old using zero-knowledge proof, ensuring that only a yes/no value indicating age verification status is stored. In both examples, age is simply confirmed without exposing personal data, aligning with privacy-first and data minimisation principles. 

• Peer-to-Peer Marketplaces: Dating application Bumble is among the first consumer platforms to adopt ZKP technology for age verification, confirming users' eligibility without ever seeing the underlying data. Instead of asking users to submit full ID documents or disclose exact birthdates, Bumble leverages ZKPs via Google Wallet. This allows users to prove they meet the platform’s age requirements without revealing any additional personal information.  

• Crypto and digital assets: One of the first and most known applications of zero-knowledge proof technology emerged in the cryptocurrency sector around 2016. Since then, ZKPs have become central to blockchain innovation, allowing exchanges and wallets to comply with strict anti-money laundering and KYC requirements without overburdening users or storing sensitive identity data. For example, the blockchain-based solution from Concordium uses ZKPs to verify age without exposing personal data.

Qualify clients safely while minimising data collection with itsme^®

Besides age verification, ZKP-based solutions can enable users to prove specific eligibility criteria, such as residing in an allowed jurisdiction, being an actual human, not appearing on a sanctions list, etc. while protecting full identity details. For example:  

• Ride-sharing and mobility apps could confirm with ZKP that a driver meets license requirements without requiring full KYC checks or storing identity documents. Shared mobility platforms, such as e-scooter rentals across Europe, could confirm a user’s eligibility at account creation without storing sensitive documents like passports or birthdates.

• Public transportation providers could check eligibility for student, senior, or disability benefits using a simple cryptographic yes/no proof, ensuring minimal data collection.

• eLearning providers could verify student enrolment to grant discounted access without exposing full academic records or institutional details, checking only for the relevant attribute, i.e. “currently enrolled”. 

• Social platforms could reduce fake accounts and prevent bots by using ZKP-based proof of humanity checks without requesting ID uploads. This form of verification ensures real people are behind accounts, which helps protect community integrity and reduces the risk of spam, scams, and misinformation.  

• Peer-to-peer marketplaces could apply proof of humanity to reduce fraudulent activity. For instance, sellers could prove they are real individuals without having to disclose personal details, making the platform safer while keeping onboarding smooth. 

• Streaming and digital content providers can confirm a user’s country of residence to comply with licensing restrictions. For example, a film made available only in a certain country could be unlocked by proving “residence in X country” without sharing an address or national ID number. 

• Events and venues could allow attendees to prove they are over 18 when purchasing tickets for R-rated movies or alcohol-serving concerts without sharing full birthdates, improving privacy and efficiency.

While implementing ZKPs can be technically challenging, platforms can integrate the technology easily through trusted services like itsme^® Qualify, enabling seamless, privacy-preserving verification at scale.

Continue reading: How can your organisation move to ZKP? An expert answers

Minimum disclosure is increasingly becoming a regulatory requirement, a commercial advantage, and a foundation for digital trust. With GDPR enforcement tightening and the European Digital Identity framework on the horizon, Europe is clearly moving towards a future where less is more in identity verification. 

Zero-knowledge proof shows that compliance and customer experience can go hand in hand. Companies that adopt minimum disclosure early will not only be ready for upcoming EU digital identity standards but will also gain a competitive edge. In this way, data minimisation becomes more than a regulatory obligation, and turns into a strategic advantage that signals to customers their privacy is valued.

Solutions like itsme^® Qualify make it easier to incorporate zero-knowledge proofs into existing operations, helping businesses build trust, reduce fraud risks, and explore privacy-first business models. 

Simplify verification while keeping users’ data safe with itsme^® Qualify