Correlation via frequency of claim issuance about vc-data-model

[David-Chadwick]

I dont think you can infer that. The issuer might infer that the holder is rapidly consuming something that requires you to be over 21, but cannot have any idea of whether it is a bar, brother, drug den or whatever else. And certainly cannot infer it was a particular bar.

[msporny]

I dont think you can infer that.

Consider the following use case: You get 4 requests for over the age of 21 credentials all coming from IP addresses in a particular area of Washington DC loaded with bars between 10pm-1am.

More likely than not, that person is bar hopping.

[David-Chadwick]

As a holder, I would question why
a) 'over 21' should be a short lived credential in the first place, and
b) object strongly to it being a one-time-use credential.
This is certainly an example of finding a more privacy friendly issuer.