[roenxi]

I'd imagine there is quite a lot of legal pressure against doing that. Not knowing who your customers are seems like the sort of thing that would eventually involve lawyers.

mullvad.net was interesting to me because I could pay with Monero, meaning that they may actually have no data about me whatsoever except whatever is technically required for a VPN connection. Pretty cool company but it seems like the sort of model that would struggle in most countries with the amount of financial monitoring that tends to be in place.

[nutrie]

You're taking it too far. KYC concerns legal entities, that's a different story. In regards to individuals and their privacy, there are ways to greatly minimize personal information processing in "plain" form while keeping records (or access to records) to fulfill legal obligations.

Having had conversations with people on security and anti-fraud teams, many experts clearly share this view.

[kloop]

Could still be done by re-incorporating companies in countries without kyc laws. And if fines for being breached get high enough, that's probably what would happen.

That would probably be bad for tax receipts though, so it's more realistic that there's an upper bound on infosec related fines