> Please read up on GDPR "purpose limitation".
I am reasonably familiar with the contents of GDPR, having looked into it more after attending a lecture on the subject [0].
> We cannot use IP address except for antifraud, so it is not legally viable for us to try to link zero-knowledge proofs into a profile based on IP address.
If your users must rely on you obeying a policy, then please just say that. Right now, it seems to me that you claim to use technical means to prevent Brave from learning browsing histories [1].
> my home AT&T IP address wanders often, so do many others; mobile even more variable.
IP addresses can be so identifying that they have been ruled as personally-identifiable information by the European Court of Justice [2].
> I think you are mistrusting prematurely. But as noted in my item 1, we are talking to PIA about using an IP relay (not full VPN). This got delayed by their work on handshake.org but we're restarting it.
Thank you for stating clearly that you aren't using PIA (aka "IP masking") at the moment for Brave Payments. You might consider your users who are worried about data breaches and compromised servers as much as they are worried about Brave's intentions. Please don't take my criticisms personally.
> Putting these through separate Tor circuits is possible, as we also randomly space them out in time.
Oh, you do randomly delay ballot submissions? I have not been able to find any such logic in the code but would be happy to be pointed to it. The specific way in which you choose delays is, of course, crucial to it providing security.
[0] <https://petsymposium.org/2018/program.php>
[1] <https://brave.com/faq-payments/#anonymous-contributions>
[2] <https://www.irishtimes.com/business/technology/european-cour....
