Key Points
- Bavaria’s data protection authority (BayLDA) has ordered Worldcoin to implement stronger data deletion procedures and explicit consent mechanisms for processing biometric iris data, giving users more control over their personal information.
- The decision, which affects Worldcoin’s operations across Europe, comes after an investigation that began in April 2023, though the company plans to appeal the ruling.
Regulatory Crackdown on Biometric Data Handling
The Bavarian State Office for Data Protection Supervision (BayLDA) has issued its first enforcement action against Worldcoin, the controversial digital identity and cryptocurrency project backed by OpenAI CEO Sam Altman. The decision, announced on December 19, 2024, requires the company to overhaul its handling of sensitive biometric data and strengthen user privacy rights across its European operations.
Mandatory Changes to Data Processing
Under the new order, Worldcoin must implement a GDPR-compliant deletion procedure within one month of the decision taking effect. The company will also need to obtain explicit user consent for specific data processing steps, particularly concerning its iris-scanning technology used to verify unique human identities. Additionally, the regulator has mandated the deletion of certain data records that were previously collected without adequate legal basis.
European-Wide Implications
The ruling marks a significant development for Worldcoin’s ambitious “World Network” project, which aims to create a universal identity and financial network using blockchain technology. While the company had voluntarily suspended operations in some EU countries during the investigation, this decision sets a precedent for how biometric data must be handled across the European Economic Area (EEA).
Ongoing Regulatory Scrutiny
The BayLDA’s decision represents only the first phase of regulatory oversight, with separate proceedings still pending regarding administrative offenses and user complaints about specific issues, including minor protection. The investigation, coordinated with other European data protection authorities, highlights the growing regulatory focus on projects that combine cryptocurrency with biometric data collection. Despite Worldcoin’s announced intention to appeal, the decision underscores the increasing importance of data protection compliance in the blockchain and digital identity space.
