Sam Altman’s “Worldcoin” project will not be available in Spain for up to three months, and may face future actions under the General Data Protection Regulation (GDPR). The country’s data protection authority, the AEPD, has ordered the company to stop collecting personal information due to privacy concerns.
Worldcoin must also stop using the personal information it has already gathered. The action was based on “several” complaints to the AEPD about collection of personal data from minors, failure to properly obtain consent, and lack of transparency about use of collected data.
Worldcoin has already run into hot water in other countries over privacy concerns due to its aggressive iris-scanning program, which critics have contended targets developing countries and does not provide participants with sufficient information about what is being done with their biometric information.
Worldcoin sees temporary ban over privacy concerns
Worldcoin has famously taken its “orb” iris scanning device to over 100 countries, including some in the EU, and has scanned about four million people. Spain has been one of those destinations, and the AEPD’s privacy concerns seem to center on the bloc’s special protected status for biometric data.
Worldcoin has issued a statement claiming that it has been trying to engage with the AEPD for months, but has not received a response. It also accused the agency of misleading claims and “circumventing EU law” with its ban. The company said that it has been engaged with Bavaria’s data protection agency for months, having set up its EU headquarters there in the city of Erlangen.
Spain’s ban can only be legally upheld for a maximum of three months, under the GDPR’s Article 66 “urgency procedure” rule. Individual nations can invoke this rule when there is a suspected immediate threat to the rights and freedoms of data subjects. The AEPD confirmed that it has been receiving complaints since at least December.
The project raises a variety of potential privacy concerns. It has never been entirely clear exactly what range of entities will ultimately have access to these iris scans, with Worldcoin already involving a hodgepodge of for-profit and nonprofit partners. Opacity and data subject understanding of how personal data is being stored and used has also been a point of controversy since the project began, as have the company’s security practices.
Growing count of countries expressing privacy concerns about Worldcoin
While Worldcoin’s ban only applies within Spain, a number of other countries both inside and outside of the EU have launched inquiries into the company based on privacy concerns.
Altman has announced nothing but noble intentions for the company, saying that he sees it as a means of verifying human identity in a world of AI and as a force for improving economic opportunity throughout the world. Early adopters have had to be scanned at one of Worldcoin’s events, at which time they receive a “World ID” and up to 25 of the project’s crypto tokens. Each Worldcoin is worth several USD on the open market and there is extremely little that can be done with them, at least for now.
Early participants are thus essentially being sold on the prospect of the coin exploding in value at some point in the future, as with the sudden “mooning” of Bitcoin after nearly a decade of having very little value. One of the governments outside of the EU that has temporarily banned new signups for Worldcoin is that of Kenya, where participants were promised crypto totalling about $50 in value for their iris scans. Some ended up selling tokens off to scalpers for around $1 cash, given lack of other options for immediate use.
France, Germany and Portugal are among the other EU countries that have opened investigations into Worldcoin privacy concerns. These investigations are essentially forced to default to Bavaria’s judgment, however, where the country’s DPA is currently conducting its own investigation into Worldcoin’s GDPR compliance.
Hong Kong has also opened an investigation into Worldcoin over privacy concerns. In January, the Office of the Privacy Commissioner for Personal Data searched six of the company’s offices under suspicion of mishandling biometric information protected under the Personal Data Privacy Ordinance. South Korea’s privacy regulator initiated a similar investigation in early March.
Worldcoin announced a development roadmap in December 2023 that would ultimately decentralize its ecosystem, offering grants of up to $5 million to developers to assist with the effort. This move appeared to be made to address the two central concerns about the project: that personal data is being mishandled or abused, and that it is not a “real” cryptocurrency due to the amount of linkage to identity it requires to participate. The plan calls for diversifying the sources of manufacture of its eye-scanning orbs, and forming a decentralized autonomous organization (DAO) that would handle decision-making in place of current project owner Tools For Humanity. The company is also still seeking a way to launch the project in the US, where fears of backlash from the Securities and Exchange Commission (SEC) have held it back thus far.
