World Faces Fresh Scrutiny Over Data Privacy Concerns in Europe
World, formerly known as Worldcoin and co-founded by OpenAI CEO Sam Altman, is once again under regulatory pressure. German authorities have directed the crypto-based digital identity project to align its practices with the European Union’s stringent General Data Protection Regulation (GDPR).
The Bavarian State Office for Data Protection Supervision (BayLDA) announced an investigation into World’s compliance, specifically focusing on its flagship technology, the World ID, which relies on biometric data. The agency has set a firm deadline of January 19 for the company to implement a GDPR-compliant data deletion protocol.
Regulatory Pressure Intensifies
Michael Will, President of BayLDA, emphasized the importance of protecting personal data, stating, “We are enforcing European fundamental rights standards in favor of the data subjects in a technologically demanding and legally complex case.” He highlighted the right of all users who shared their iris data to have their information erased.
The World ID system uses “Orbs,” specialized devices that scan irises to generate unique digital identifiers, verifying individuals as real humans. However, BayLDA flagged risks associated with processing sensitive biometric data, questioning its compliance with GDPR standards.
Compliance Challenges and Global Criticism
World voluntarily paused some EU operations amid the investigation and introduced updates to its data processing methods. Despite using cryptographic protocols to anonymize data by splitting iris codes into encrypted fragments, the regulator deemed these measures insufficient. Earlier data collection practices, involving centralized storage of iris codes, were also ruled non-compliant, prompting orders to delete improperly collected data.
Although World has expressed plans to appeal the decision, this is not its first encounter with regulatory challenges. The project, which launched in 2023 with its “proof of personhood” concept, has faced bans in Kenya and Portugal due to privacy concerns.
A Shift in Identity
In October 2024, the project rebranded to ‘World’ and introduced an upgraded Orb device to address past criticisms. Despite these changes, the company’s vision of creating a global network of verified human users continues to attract scrutiny over potential risks to personal data and privacy.
As World navigates these legal and ethical challenges, the global conversation around the use of biometric data in digital identity systems remains heated. Whether World can satisfy regulators and regain trust will likely shape the future of decentralized identity solutions.