South Korea’s Personal‑Information Protection Commission fined Worldcoin ₩1.1 billion (≈ US$0.8 m) for illegally collecting 30 000 irises and transferring the data overseas without consent.

Claim

Opposing arguments

Core Orb firmware and biometric pipeline are open-source, allowing anyone to audit that no personal data is retained
AMPC’s MPC pipeline retains raw iris codes on-device, ensuring that biometric images never leave the Orb
An independent Trail of Bits audit found no path to extract personally-identifiable data from production Orbs
World ID relies on zero-knowledge proofs (ZKPs) that mathematically prevent anyone from linking a person’s World ID across apps.

Quotes that support claims

South Korea’s personal information watchdog imposed a fine of 1.1 billion Korean won ($829,000) on the Worldcoin Foundation and its affiliate Tools For Humanity (TFH) for violating the country’s laws on personal information protection.
The regulator explained that when the Worldcoin Foundation collected the biometric data, it did not inform users of the purpose of the collection and retention period, as required by law. The privacy watchdog also stressed that the company did not inform users that their data would be transferred to foreign countries. According to the PIPC, the law requires companies to declare where personal information is transferred and the name and contact information of the entities receiving the information. Furthermore, the PIPC also highlighted that the company has not established a procedure for requesting and processing the deletion of sensitive data. Additionally, the privacy watchdog noted that TFH did not have adequate procedures in place for age verification, which would prevent children under the age of 14 from registering on the application.
After the investigation, the privacy watchdog confirmed that the Worldcoin Foundation and TFH collected information such as iris scans of South Koreans without a legal basis for processing, according to the announcement. PIPC said that almost 100,000 South Koreans downloaded Worldcoin’s application, with almost 30,000 using iris authentication. However, the privacy watchdog said the company failed to comply with the requirements of the PIPA.

Related projects

World

Related topics

Privacy

Sources

South Korea fines Worldcoin for violating personal protection laws

Supporting arguments

Prominent technologists warn the Orb scheme could create a dystopian biometric registry
The Bavarian data-protection authority (BayLDA) ordered Worldcoin to delete millions of stored iris hashes for violating the EU’s GDPR, proving that the hashes remain personally identifiable data under European law despite World’s “anonymisation” claims

Tags

Orbs present a risk to user privacy