Eye Scans and Legal Lines: How Worldcoin’s Global Expansion Sparked a Data Privacy Backlash

Worldcoin promised a revolutionary blend of crypto and identity verification: a global digital currency, confirmed via iris scans, tied to proof-of-personhood. But what began as a moonshot aimed at onboarding the masses into Web3 is now facing regulatory turbulence from multiple fronts – and it’s calling the future of biometric crypto into question.

In just the past few months, countries across Europe, Africa, and Southeast Asia have raised red flags over the project’s methods. Indonesia, citing its Electronic Systems and Transactions Law violations, abruptly halted Worldcoin’s operations. Kenya previously suspended the initiative and launched investigations into how the company collected and stored biometric data.

Meanwhile, France, Germany, and the United Kingdom are investigating whether the eye-scanning initiative complies with their stringent data protection laws.

At the heart of the controversy is a paradox: Worldcoin pitches its identity layer as a tool to solve the fake-bot plague and establish trust in the digital age, but its very design demands some of the most sensitive personal data a person can give.

A Borderless Idea Meets National Firewalls

Worldcoin’s core device, the Orb, scans a user’s iris to create a unique identifier, supposedly ensuring the person is human and distinct. In exchange, users receive a World ID and a token reward. The idea is bold – even noble to some – but when that promise crosses borders, it also slams into a complex web of data sovereignty, consent laws, and ethical questions.

Indonesia’s Ministry of Communications and Information Technology noted that Worldcoin failed to register as an official Electronic System Operator, a basic legal requirement for handling user data in the country.

Officials expressed concern over whether users fully understood their consent, especially since the biometric scans were reportedly collected in shopping malls and public spaces.

In Kenya, the Office of the Data Protection Commissioner (ODPC) issued a cease-and-desist letter after Worldcoin began mass registrations. The concern was whether Keyan citizens were giving informed consent and if their data was being stored securely or exposed without proper oversight. That investigation is ongoing.

Europe Raises the Bar

If emerging markets are scrutinizing Worldcoin on basic legal grounds, European regulators are asking deeper questions about the very philosophy behind biometric identity systems. The European Union’s General Data Protection Regulation (GDPR) is among the strictest privacy frameworks in the world.

Under GDPR, biometric data is categorized as special category information, which means it can only be processed under strict conditions, including explicit consent and a legitimate purpose.

France’s CNIL (Commission nationale de l’informatique et des libertès) has already launched an investigation, with Germany’s Bavarian Data Protection Authority doing the same. Both agencies are coordinating efforts to determine if Worldcoin’s practices violate GDPR principles. Questions being raised include:

·      Is the iris scan necessary to provide the service?

·      Can users opt out or delete their biometric data?

·      Is the reward structure coercive, especially in lower-income areas?

Early signs suggest that regulators are not satisfied with the answers. Despite Worldcoin's public documentation and privacy pledges, the transparency of data use and user control remains murky.

The Appeal of the Orb

Worldcoin co-founder Sam Altman, also CEO of OpenAI, has positioned the project as a long-term solution to identity fraud, universal basic income distribution, and the digital divide.

The idea: in a world where AI-generated bots proliferate, proving humanity will be more valuable than ever. By giving people a verified identity that is both secure and anonymous, Worldcoin hopes to build a “proof-of-personhood” standard for the internet.

To onboard users, Worldcoin deployed teams with Orbis in over 35 countries—lines formed in Nairobi, Jakarta, and Buenos Aires. For many, receiving free crypto in exchange for a few seconds of scanning felt like an opportunity, not a risk.

But privacy advocates have warned for months that the rush to enroll users in developing nations raised serious ethical red flags. The combination of economic incentives, opaque consent processes, and lacking local regulatory infrastructure created a perfect storm.

Crypto Meets the Real World

Worldcoin’s regulatory challenges are not happening in a vacuum. Governments around the globe are still wrestling with how to define and regulate cryptocurrency. Add biometric data into the mix, and it becomes even more complex.

Unlike traditional crypto projects, Worldcoin isn’t just offering a token or smart contract – it’s capturing a piece of a person’s biological identity. That inherently shifts it from the realm of finance into a field of bioethics, surveillance, and civil liberties.

Moreover, there are technical concerns. Although Worldcoin states that the iris scans are converted into hash codes and not stored as raw images, critics argue that any biometric system can be vulnerable to leaks or misuse. Once compromised, biometric data can’t be changed like a password.

Worldcoin’s Response

The Worldcoin Foundation has issued statements defending its practices, emphasizing its commitment to privacy, data minimization, and decentralization. According to the team, the iris scans are not tied to any personal identifiers, and data is either deleted or stored with high encryption standards.

In addition, the foundation has emphasized that participation is entirely voluntary, and users are informed of how their data will be used before enrollment. Worldcoin claims that its biometric hashing process ensures no retrievable image of the iris is stored, and that users can verify their World ID without revealing any personal data.

The organization has also committed to open-sourcing its core protocols and releasing independent audit results to foster accountability. Still, these measures have done little to quiet skepticism among regulators and privacy advocates who argue that transparency after deployment is no substitute for prior regulatory alignment.

A Test Case for Crypto Next Era

As the crypto world matures, projects are increasingly colliding with the real-world complexity of national laws, human rights, and social trust. Worldcoin is becoming a high-profile example of what happens when tech idealism meets geopolitical friction.

The outcome of these investigations could set important precedents for future crypto ventures, especially those that rely on personal data. Will regulators require stricter onboarding protocols for biometric projects? Will local partnerships be mandated before deployment? Will crypto finally shed its wild west image?

Worldcoin is not just testing a new kind of currency. It’s testing whether Web3 can responsibly handle identity at scale.

The Road Ahead

With investigations pending and legal pressure mounting, Worldcoin’s ambitions may be forced to adapt. More localized compliance teams, greater transparency, and perhaps a rethinking of the Orb itself could be on the horizon.

Still, the idea behind Worldcoin remains compelling to many. A verified, anonymous identity system could help unlock a fairer internet – but only if the technology respects the people it aims to serve. Without clear ethical frameworks, even the most advanced innovations risk falling into the same traps as the centralized systems they aim to replace.