In section 3.1.1 it says that it recommends that the ID property is a dereferenceable IRI. If this IRI is dereferenceable then it could be used to track the usage of the credential when the schema get's dereferenced and the IRI contains a unique identifier in IRI to detect when the schema is being dereferenced to correlate it to an IP address. Further information should be added to this section or to a separate privacy section to deter the inclusion of unique tracking identifiers in the IRIs.
From https://github.com/w3cping/privacy-request/issues/119
This issue is to track.