Networks

Blockchain privacy

Overview

Blockchain privacy describes how blockchain systems handle the confidentiality of transaction and record data. Many public blockchains can provide pseudonymity, while ledger transparency can allow transaction tracing through analysis of on-chain activity and related information. The persistence of ledger data can also create data-protection challenges in some applications, including questions about erasure and rectification rights where personal data are involved, and privacy characteristics vary depending on system design and use case. Many blockchain systems represent participants using cryptographic addresses rather than real-world identities, which can provide pseudonymity. However, transaction histories associated with addresses are typically visible to participants, which can enable linkage and tracing of activity under some conditions.

Public blockchains

Public (permissionless) blockchains allow anyone to participate in maintaining and verifying the ledger. They typically use cryptographic addresses rather than real-world identities, providing pseudonymity while making transaction data and histories visible to all participants. This transparency enables tracing and linkage of activity through on-chain analysis and related off-chain information.

Private blockchains

Private (permissioned) blockchains restrict who can join the network and who can participate in consensus or view transactions. Because access is limited to approved participants, these systems can be configured to provide stronger privacy controls than public blockchains in some contexts. The specific privacy properties depend on access policies and governance rather than on inherent transparency.

Hybrid blockchains

Hybrid blockchains combine elements of public and permissioned systems, allowing some data to remain publicly auditable while restricting access to other information. Privacy and data-protection outcomes depend heavily on system design and use case, and that some implementations store personal data off-chain while recording only cryptographic commitments, such as hashes, on-chain.

Zero-knowledge proofs

A zero-knowledge proof (ZKP) is a cryptographic method by which one party (the prover) can prove to another party (the verifier) that a given statement is true, without conveying any information apart from the fact that the statement is indeed true. The prover does not reveal any information about the transaction. Such proofs are typically introduced into blockchain systems using ZK-SNARKs in order to increase privacy in blockchains. In typical non-private public blockchain systems such as Bitcoin, a block contains information about a transaction, such as the sender and receiver's addresses and the amount sent. This public information can be used in conjunction with clustering algorithms to link these pseudo-anonymous addresses to users or real-world identities. Since zero-knowledge proofs reveal nothing about a transaction except that it is valid, the effectiveness of such techniques is drastically reduced. A prominent example of a cryptocurrency using zero-knowledge proofs is Zcash.

Ring signatures

Another method of obfuscating the flow of transactions on public blockchains is the use of ring signatures, a method employed by Monero.

Mixing

Cryptocurrency tumblers can be used as a method to increase privacy in pseudo-anonymous cryptocurrencies. In addition to third-party services, mixing can also be implemented directly within blockchain protocols, as in Dash. The popular mixing service Tornado Cash was sanctioned by the U.S. Department of the Treasury in August 2022, which accused it of laundering $455 million in stolen cryptocurrency by the Lazarus Group. The sanctions made it illegal for U.S. citizens, residents, and companies to use the service. In April 2024, Keonne Rodriguez and William Lonergan Hill, the founders of Samourai Wallet, a privacy-focused CoinJoin tool that mixes Bitcoin transactions, were charged by the U.S. Department of Justice, which alleged that the application enabled money laundering.

Financial transactions

Public blockchains used for financial transactions typically represent participants using cryptographic addresses rather than real-world identities. However, transaction data are often publicly visible, enabling transaction tracing and linkage through analysis of on-chain activity and related off-chain information. Privacy risks can also arise at system endpoints: compromise of wallets, user devices, or custodial services may expose transaction histories associated with affected addresses and enable unauthorized spending.

Health care records

A 2018 study published in Sustainable Cities and Society proposed Ancile, a blockchain-based framework for access control and interoperability in electronic health records. A 2021 systematic review published in JMIR Medical Informatics concluded that although research interest in blockchain-based personal health records is increasing, the technology remains largely conceptual and has seen limited real-world deployment.

GDPR

Following the adoption of the General Data Protection Regulation (GDPR) in the European Union in April 2016, questions have arisen regarding blockchain's compatibility with EU data-protection law. GDPR applies both to entities processing data within the EU and to entities outside the EU that process personal data relating to individuals in the EU. Personal data is defined as any information relating to an identified or identifiable natural person. Because blockchain systems associate activity with cryptographic public keys, which may be linkable to individuals under certain conditions, such data may fall within the scope of personal data under GDPR even when direct identification is not explicit. A central challenge arises from the GDPR right to erasure, often referred to as the right to be forgotten. Due to blockchain's immutability, deleting or modifying recorded data after validation may be technically infeasible. In April 2025, the European Data Protection Board issued Guidelines 02/2025 on the processing of personal data through blockchain technologies. The guidance highlights tensions between blockchain immutability and GDPR rights such as erasure and rectification, and it outlines recommendations including role clarification for data controllers, data minimisation, and privacy-by-design measures.

Transparency

Although blockchain technology allows users to transact without relying on centralized intermediaries, its transparency can raise privacy concerns. Public blockchains allow any participant to view transaction data, which can be analyzed using block explorers and combined with open-source intelligence techniques to trace financial activity and build user profiles.

Data minimization

A central principle in many privacy frameworks is data minimization, which holds that systems should collect and process only the minimum amount of personal data necessary for a given purpose. In blockchain systems, design choices such as recording transaction metadata on-chain or encoding identifiers in publicly verifiable ledgers can raise data-minimization concerns where such data are linkable to identifiable individuals. Guidance on blockchain and data protection emphasizes avoiding the storage of personal data on-chain where possible and using techniques such as off-chain storage or cryptographic commitments to limit on-chain exposure.

Wikipedia contributors · Blockchain privacy · revision 1336434531 · CC BY-SA 4.0 · Plain text extracted and formatting adapted; tags derived from linked topics.