Privacy technology is the family of techniques that keep data confidential while it is being used rather than only at rest or in transit, and after a decade as a research category it is now shipping first at the identity layer, where the core primitives are being given away free by platforms and regulators.
Summary
Privacy technology, usually called privacy-enhancing technologies (PETs), covers secure multiparty computation (MPC), fully homomorphic encryption (FHE), zero-knowledge proofs (ZKPs), verifiable computing, trusted execution environments (TEEs) and private information retrieval (PIR). The framing that makes the category coherent is simple: in a normal online interaction, data on the device can be encrypted and data moving between device and server is protected by TLS, but data being processed on the server is not protected at all. PETs are the attempts to close that third gap, either cryptographically (MPC, FHE, ZKP) or in hardware (TEEs, marketed as confidential computing) ref ref.
The commercial thesis attached to this stack has been that securing processing unlocks data collaboration between organisations that today cannot legally or commercially share data, creating a new market variously called collaborative computing ref. A related line of argument extends the same primitives into database architecture, where secure enclaves and fast PIR would give a query engine that never sees the query or the data ref.
The parameters that decide it are three. First, performance and engineering integration: as of May 2026 the problem of making cryptographic and hardware PETs interoperable, distributable and cost-optimisable was still the subject of a fresh NSF CAREER award, which tells you the unified stack does not exist yet. Second, demand structure: practitioners interviewed across 2023 consistently located the blocker outside the technology, in culture, incentives, risk asymmetry and the number of internal stakeholders who must agree ref ref ref. Third, value capture: in the one place where PETs have reached consumers, the primitives are being open-sourced by Google and by the European Commission itself, which makes privacy a compliance baseline rather than a product ref.
The practical consequence is that “privacy technology” now needs splitting into two very different things: a shipping, regulator-driven ZK identity layer, and an enterprise secure-analytics market that has been three years away for at least five years.
Evidence base
Open questions
- What are the actual performance overheads of FHE, MPC and TEE-based analytics versus plaintext computation, and does the unified stack under NSF development close them enough for production pipelines?
- Does eIDAS 2.0’s encouragement of ZKPs harden into a requirement, and do member state wallets adopt the open-sourced Google or EU implementations rather than building their own?
- If the privacy primitives are free, where does the revenue sit: cloud infrastructure, governance and workflow software, or verticalised data collaboration networks?
- Has any organisation publicly reported a data collaboration deployment that crossed an organisational boundary and produced measurable revenue, as opposed to a pilot?
Assessment drafted 2026-08-31 from up to 18 KB sources using the technology-scorecard framework; scores are a draft read pending review.