Exposed Data¶

Storing personally identifiable information (PII) on-chain exposes users to several risks and, from a legal perspective, leads to non-compliance with stringent data protection regulations.

Public Accessibility¶

Data stored on-chain becomes part of an immutable ledger accessible by anyone. Anyone with knowledge of a blockchain explorer can retrieve and analyze this information. This universal access is one of the fundamental characteristics of public blockchains, intended to ensure transparency and trustworthiness. The same transparency becomes a problem when sensitive data is involved.

Storing PII or artifacts tracing back to PII on-chain enables malicious actors to de-pseudonymize users. An attacker can deduce real-world identities by correlating users' Ethereum addresses with their on-chain data. The seemingly anonymous nature of blockchain gives users a false sense of security, while sufficient on-chain data compromises their pseudonymity.

Data Protection Compliance¶

The public nature of on-chain data storage may violate data protection regulations. The General Data Protection Regulation (GDPR) in the European Union requires that personal data be processed securely and protected against unauthorized or unlawful processing. Storing PII on-chain may be interpreted as a breach of such requirements, leading to legal repercussions for projects or organizations.

Technical Data Artifacts¶

Beyond traditional PII like names and addresses, technical artifacts like IP or email addresses pose a significant risk when stored on-chain. This information gives attackers insights into the off-chain infrastructure associated with a project or its users.

Consider a DAO where every participant must run a node, and where signing up requires entering an email address into a smart contract. That exposes the participant's personal email and hints at where and how the system's off-chain components are hosted. Such information is a treasure trove for attackers planning targeted phishing or infrastructure attacks.