[robertlagrant]

Depends on the data. If you use a primary key in data about a person that shouldn't include their age (e.g. to remove age-based discrimination) then you are leaking an imperfect proxy to their age.

[lwhi]

So the UUID could be used as an imperfect indicator of a records created time?

[benterix]

UUIDv7 but not UUIDv4.

[lwhi]

I suppose timing attacks become an issue too.

[wongarsu]

UUIDv7 still have a lot of random bits. Most attacks around creating lots of ids are foiled by that