Got it - can’t be forced to provide it, based on their jurisdiction. But were a provider to get hacked (or operate in a different locale), the user’s original IP would be a potential weak point? Just curious