Ethereum co-founder Vitalik Buterin has urged developers to treat personal data as a liability rather than an asset to collect, warning that excessive data collection creates unnecessary privacy and security risks.

Speaking at Devcon Mumbai on November 3, Buterin advocated for open-source technology, verifiable systems and zero-knowledge proofs as ways to protect user privacy and reduce dependence on trust in corporations and technology providers.

“We really need to treat data as toxic waste by default. If you can, don’t collect it at all,” Buterin said.

His message challenges a common approach in digital services, where platforms collect user information to personalise products, improve services or support business operations. Buterin’s position is that data which is never collected cannot later be exposed through a breach or misused by the organisation holding it.

Why Buterin wants less data collection

Every organisation that stores personal information takes on the responsibility of protecting it. The larger the volume of data collected, the greater the potential consequences if that information is exposed, accessed without permission or used beyond its original purpose.

Buterin’s recommendation is to reduce that risk at the design stage. Instead of gathering as much information as possible and attempting to secure it afterwards, developers should ask whether they need the data in the first place.

He also cautioned against relying on remote AI services for sensitive tasks without considering what information is being sent to third-party servers. Where possible, he encouraged using AI models locally. When remote models are necessary, he suggested removing private information from prompts before sending them and checking responses before acting on them.

The principle extends beyond AI to crypto platforms, digital identity services and other applications that handle user information.

How zero-knowledge proofs can protect privacy

Buterin also pointed to zero-knowledge proofs, a cryptographic technique that allows someone to prove a statement is true without revealing all the information behind it.

For example, a person could prove they meet an age requirement without disclosing their full date of birth. A digital service could verify a particular claim without requiring the user to share an entire identity document.

In blockchain applications, this approach can help developers build systems that verify information while limiting how much personal data users must disclose.

Open-source technology complements this approach by allowing developers and independent researchers to inspect code, identify weaknesses and verify how systems work. Together, open code and cryptographic proofs can reduce the need to trust an organisation simply because it claims its systems are secure.

However, these tools do not eliminate every privacy risk. Their effectiveness depends on how they are implemented and whether other parts of a system still collect or expose sensitive information.

A broader push for open and verifiable technology

Buterin’s remarks reflect a wider argument for building digital infrastructure that users can inspect and verify, rather than relying solely on assurances from companies or influential individuals.

He applied the same principle to hardware wallets, which crypto users rely on to protect their private keys. He argued that users should be able to verify the devices and software they depend on, rather than having to trust systems whose internal workings cannot be independently examined.

The argument is relevant to the wider crypto ecosystem, where users often depend on exchanges, wallet providers, decentralised applications and other services to safeguard assets and information.

Devcon 8 is taking place in Mumbai from November 3 to 6, bringing together Ethereum developers and the wider open-source community. Privacy, security, applied cryptography and verifiable systems are among the event’s focus areas.

Buterin’s message is, privacy should not be an afterthought. Developers can reduce the risks associated with personal information by collecting less of it, making their technology more transparent and using cryptographic tools to verify claims without exposing unnecessary data.

Read also: Mercado Bitcoin halts transfers after suspected $40M hack