AMPC’s MPC pipeline retains raw iris codes on-device, ensuring that biometric images never leave the Orb

Opposing arguments

Prominent technologists warn the Orb scheme could create a dystopian biometric registry

The Bavarian data-protection authority (BayLDA) ordered Worldcoin to delete millions of stored iris hashes for violating the EU’s GDPR, proving that the hashes remain personally identifiable data under European law despite World’s “anonymisation” claims

South Korea’s Personal‑Information Protection Commission fined Worldcoin ₩1.1 billion (≈ US$0.8 m) for illegally collecting 30 000 irises and transferring the data overseas without consent.

Quotes that support claims

we design a solution that allows us to query whether a given Iris Code is similar to one contained in a given database, while all queries and datasets are being protected using secure multiparty computation (MPC)

AMPC incorporates the latest advances in cryptographic multiparty protocols and further improves on state-of-the-art techniques. This ensures that no iris codes ever leave the user's device. Instead, iris data is cryptographically processed directly on the Orb and rendered anonymous. Only anonymous data, which are secret shared and end-to-end encrypted, are transmitted separately to each compute node of the AMPC setup.

Related projects

Related topics

Sources

Introducing AMPC: Another leap in privacy and performance for World ID

Large-Scale MPC: Scaling Private Iris Code Uniqueness Checks to Millions of Users

Supporting arguments

Core Orb firmware and biometric pipeline are open-source, allowing anyone to audit that no personal data is retained

An independent Trail of Bits audit found no path to extract personally-identifiable data from production Orbs

World ID relies on zero-knowledge proofs (ZKPs) that mathematically prevent anyone from linking a person’s World ID across apps.

Tags

Orbs adequately protect user privacy