At the outset of 2024, long lines formed at the Avenida de América interchange in Madrid and approximately thirty shopping centers across Spain. The focus of the crowds was a series of metal orbs equipped with cameras and sensors. These devices, known as orbs, photographed the faces and irises of individuals, offering participants virtual currency called worldcoin as a reward, approximately €80 for their scan.
However, the Spanish Data Protection Agency (AEPD) swiftly halted this initiative, citing concerns over the improper handling of biometric data, particularly the iris, which is subject to stricter legal protections compared to other personal information.
Nearly two years later, the company behind the technology, now rebranded as World, has re-entered the Spanish market following its expansions into Germany, Austria, Italy, Poland, Portugal, and the United Kingdom. On this occasion, World has opened a new location in Barcelona, inviting potential clients to experience its technology firsthand. The service they provide is termed a “proof of humanity,” which verifies that the user is indeed a human based on their facial and iris scans. This verification is touted as beneficial for dating apps like Tinder, where it aims to reduce the prevalence of fake profiles, as well as for video game developers seeking to address the increasing impact of bots on player engagement.
Why Was World Banned?
The initial offering of monetary compensation for biometric data raised immediate alerts among authorities. The AEPD received numerous complaints within days, highlighting issues such as inadequate user information regarding iris scanning, capturing biometric data from minors, and not providing users the option to withdraw their consent, which includes deleting their data upon request.
Given that the iris is one of the most reliable biometric identifiers—unique to each individual and unchanging over time—the AEPD took action. Approximately 400,000 individuals had already utilized the orbs for iris scans when the Agency decided to prohibit World from continuing its operations in Spain in March 2024. This marked the first instance where the Agency imposed precautionary measures. “We acted urgently due to the situation's severity,” stated the then director of the AEPD, Mar España.
What Happened Next?
Initially, Tools for Humanity, the company responsible for collecting iris data for World, paused its operations following the AEPD's order. Subsequent attempts to appeal the decision were unsuccessful in court. The future of World's activities across Europe relied on the Bavarian data protection authority, BayLDA, under which Tools for Humanity was registered. In December 2024, BayLDA ruled that all iris data collected in Europe, including the 400,000 records from Spain, had to be deleted.
Despite this setback, the company continued to register iris scans in other regions of the world, reporting approximately 40 million records collected globally.
Why Is World Operating Again?
World now claims to have revised its operational model, adopting technology that reportedly complies with the General Data Protection Regulation (GDPR). According to Tiago Sada, a product manager at Tools for Humanity, the previous system storing users' iris data has been eliminated. Instead, they now utilize an Anonymized Multi-Party Computing (AMPC) cryptography system.
This new system divides the biometric data generated from iris scans into “unrecognizable pieces” and disperses them across different nodes worldwide, ensuring that no single entity retains complete access, even to the encrypted data. Sensor data processing occurs locally on the device itself. “The orb is equipped with over ten AI models that validate the user's identity instantaneously. Once confirmed, a certificate is generated, sent to the user's mobile device, and the original data is erased,” Sada elaborates. Therefore, all pertinent information remains on the user's phone.
When a user wishes to validate their humanity, the system can produce disposable World IDs. This feature allows users to confirm their status as real, unique individuals without disclosing personal identification details.
AEPD's Response to World's Return
World has officially informed the AEPD about its revival of operations. “The Agency is aware of the company's return to Spain based on the information provided and is currently analyzing various components of the new operations,” stated a representative.
Is This Technology Safe?
Experts express caution regarding the technology's implications. “The premise of the ‘humanity test' appears misleading; it states that it doesn't capture identifiers such as names or phone numbers, yet it records iris data, extracts a biometric template, and transmits it to the user's mobile device,” noted Jorge García Herrero, a data protection delegate. “At a minimum, this process involves biometric handling, which inevitably ties back to commercial identifiers linked to our mobile phones, exposing users to numerous third parties.”
Critics emphasize the potential risks inherent in such a system. “Even if privacy controls conform to the highest standards, this tool can be exploited by less democratic or authoritarian regimes,” warns Carissa Véliz, a professor of ethics at the University of Oxford. “Even if data remains on the mobile device, vulnerabilities can arise through hacking or unauthorized access. We must ensure that we do not pave the way for authoritarianism in the future.”
World's Role in Sam Altman's Vision
Rumors have circulated concerning Sam Altman, CEO of OpenAI, and his intentions to launch a new social network aimed at eradicating bot issues. The proposed platform would mandate a “proof of humanity” from users during registration, making World's technology integral to this vision.
