StarkWare has unveiled a demo of “Private KYC” for Starknet, aiming to let users satisfy know-your-customer requirements without handing over complete identity documents. The privacy-focused system is built around selective disclosures using zero-knowledge proofs, designed to confirm specific facts—such as age or credential validity—while keeping the underlying personal data hidden.
In the announcement, StarkWare said the approach uses STRK20 privacy features alongside zero-knowledge STARK proofs. The goal is to reduce the amount of personal information organizations need to collect and store, addressing a core vulnerability of today’s compliance workflows: once large identity databases exist, they become high-value targets.
Key takeaways
- Starknet Private KYC is designed to verify specific attributes (e.g., “over 18” or “credential is valid”) rather than reveal full passport details.
- The demo relies on zero-knowledge STARK proofs so verifiers can confirm eligibility without viewing the underlying identity data.
- User-side steps include scanning a passport and proving eligibility via encrypted data registered on-chain.
- StarkWare frames the release as proof that compliance and privacy do not have to conflict—particularly by limiting how much identity data institutions store.
- The model is positioned as a contrast to biometric verification approaches that drew criticism for centralized custody concerns.
Selective identity checks on Starknet
Traditional KYC typically requires users to provide full documents, after which institutions must store and safeguard sensitive information. StarkWare argues that this “all-or-nothing” data exchange is unnecessary when regulations often require confirmation of only one or a small set of facts.
Under the proposed flow, users begin by scanning their passport using a smartphone camera and the device’s NFC chip to read and confirm the document is genuine and signed by the issuing authority. After that, users encrypt identity data to their Starknet wallet, register relevant attributes in a public on-chain registry, and submit zero-knowledge proofs for targeted checks.
Crucially, verifiers are able to validate eligibility by consulting the public registry and checking the proofs—without accessing the actual identity data itself. StarkWare described the principle this way: verification should “only confirm the precise fact,” such as meeting an eligibility rule, rather than expose the complete document.
StarkWare also warned that institutions collecting full identity information can create long-lived risk. In its framing, “every identity database becomes a liability the moment it exists,” underscoring why limiting what’s stored matters for both security and compliance.
How the demo’s privacy design works
StarkWare presented Private KYC as a demo rather than a fully deployed feature set, but the workflow outlines a practical mechanism for privacy-preserving verification on a public blockchain environment.
First, passport data is used locally during the scan and authenticity confirmation step. Next, identity data is encrypted and tied to a user’s Starknet wallet, reducing the likelihood that raw documents or complete personal records need to be transmitted to every counterparty.
Then, instead of sharing full documents for each verification request, users register attributes in a public on-chain registry and produce zero-knowledge STARK proofs for the specific statements that need to be checked. Starknet’s team said current identity checks often “ask for your whole document when they only need one fact,” and the architecture is intended to align the system’s disclosure level with the actual compliance requirement.
StarkWare’s core argument is that verification can be structured so institutions confirm what they need without building their own copy of someone’s identity. The company said this approach avoids creating another dataset that organizations would then have to defend.
Why KYC privacy is gaining momentum
The push for privacy-preserving verification comes as cyber risk continues to rise. The article accompanying the announcement cited StationX data suggesting the US reached a record 3,322 data compromises in 2025, representing a 79% increase over five years. It also referenced a global average data breach cost of $4.4 million, as reported by StationX in that same context.
On top of broad data-breach statistics, the wider compliance landscape is increasingly shaped by the reality that sensitive records—especially identity and credential data—attract attackers. StarkWare’s positioning is therefore less about cryptography as an abstract concept and more about changing the practical incentives for collecting and storing identity information.
The company’s approach also reflects an important asymmetry in today’s KYC systems: users often have little control over how many parties repeat collection, how long records are retained, or what security standards are used. Private KYC, as presented, aims to reduce those risks by limiting disclosure to what is necessary for eligibility decisions.
In the crypto ecosystem, there is also an example of the consequences of custody and centralization in privacy-adjacent identity systems. StarkWare compared its direction to Sam Altman’s World ID, which uses zk-proofs to verify humanness via iris scans on hardware orbs. However, World ID drew backlash over centralized biometric custody. StarkWare’s “self-custody” framing is intended to address similar concerns by avoiding the same custody pattern for biometric-style data.
What to watch next for Starknet’s Private KYC
Private KYC on Starknet is positioned as a step toward compliance-ready verification that protects sensitive personal details, but the demo nature of the announcement means implementation details and rollout timing remain unclear. Investors and builders should watch for when and how the proofs, on-chain attribute registries, and verifier tooling are integrated into real-world applications—especially those that need auditable eligibility without repeated exposure of full documents.
