Zero-knowledge proofs could let KYC checks verify faces without storing them

Biometric KYC without the biometrics on file

Nearly every biometric verification vendor keeps a copy of something — the onboarding selfie or at least the face template extracted from it — because the comparison against an identity document photo needs that data to exist somewhere. A recent explainer on dev.to argues the opposite premise is becoming technically viable: a zero-knowledge proof can let a verifier trust that a face match or liveness check passed without the raw face data ever reaching it.

The post draws a line between the zero-knowledge work most identity teams already know — proving claims about credential fields such as being over 18 without revealing the underlying attribute — and the harder, barely-shipped problem of proving something about biometric data itself.

How the proof would work

According to the dev.to post, the mechanism starts at capture. Instead of transmitting a selfie or its feature vector, the system generates a cryptographic commitment to the template: a one-way binding that can be checked later but not reversed back to the original face. The post cites BioZero, an academic protocol for on-chain biometric authentication, which pairs homomorphic commitments with zero-knowledge proofs so the authentication decision is publicly verifiable while the template stays hidden from every party, including the verifier.

At verification time, a fresh capture runs through a proving circuit — typically a zk-SNARK — that proves the distance between the new capture and the committed template falls under a matching threshold, without revealing either side to the party checking the proof. The post points to concrete tooling: ZKP-Identity, an open-source attribute-verification system, builds this class of circuit with Circom and the Groth16 proving system, while zkBiometric runs the same idea on RISC Zero's zkVM so a service provider can verify an identity claim without ever accessing the biometric data behind it.

The construction extends to liveness as well. A circuit can attest that a capture passed a liveness check — blink detected, head movement validated, texture and depth signals consistent with a real human — as part of the same proof, with the video or image never leaving the device or the verification enclave that generated it.

Not every ZK identity project operates at this layer. The post credits Rarimo's passport-zk-circuits as a real, working open-source implementation, but notes it proves something narrower: that a passport's embedded chip signature is valid and tied to a unique identity, letting holders skip re-scanning a physical document. That is zero-knowledge work over a document signature, not over a face template.

What it prevents

GDPR Article 9 treats biometric data used for unique identification as special category data, and the dev.to post stresses why: a face cannot be rotated after a breach the way a password can. Every vendor holding raw templates or selfies at scale is a concentrated target, and the retention itself — not just weak security around it — is the exposure. A zero-knowledge biometric proof removes that target by design; a leaked one-way commitment reveals nothing about the underlying face.

Stored liveness captures add a second liability, the post argues: each one is another piece of biometric data that could inform a future deepfake targeting the same person, or another record the vendor must defend under the same Article 9 obligations. The author frames zero-knowledge liveness as forward-looking rather than standard practice, and states that no major liveness engine ships it today.

What is actually shipping

The post positions Hypersign as an unusual starting point for closing the gap: its biometric product runs face match, active and passive liveness, deepfake detection and anti-spoofing in production, and its selective disclosure layer already runs zero-knowledge threshold proofs in its KYC widget — but over credential attributes rather than biometric templates. The two are not combined yet. The post's overall assessment is that zero-knowledge proofs over biometric data have barely reached production anywhere in the identity industry.

Why it matters

If this construction holds up at production scale, it changes the economics of KYC breaches: there is no centrally held biometric database to exfiltrate, only commitments and proofs. For vendors carrying GDPR Article 9 obligations, that could shrink both the attack surface and the compliance burden. The caveat matters just as much — this is near-production technique, not deployed practice, and the named projects are academic protocols and open-source circuits rather than shipping liveness engines. The thing to watch is whether a vendor with a live biometric pipeline, such as Hypersign, actually fuses it with the credential-level zero-knowledge layer it already runs.