EFF has a good write-up about zero-knowledge: https://www.eff.org/deeplinks/2025/07/zero-knowledge-proofs-...

> What ZKPs don’t do is mitigate verifier abuse or limit their requests, such as over-asking for information they don’t need or limiting the number of times they request your age over time. They don’t prevent websites or applications from collecting other kinds of observable personally identifiable information like your IP address or other device information while interacting with them.