Spanish Data Protection Agency (AEPD) — Tools for Humanity (Worldcoin)
AEPD issued a precautionary three-month order halting Worldcoin's iris-scanning operations in Spain after complaints that the project was collecting biometric data with inadequate consent (including from minors) and providing insufficient information about retention and rights. Cited GDPR's special-category data rules — but iris-scan for identity is precisely the kind of biometric categorisation that the EU AI Act prohibits or treats as high-risk under Articles 5 and Annex III §1.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the authority's press release on 2026-09-18. Every holding carries a short verbatim quote from that text.
- Decided by
- Spanish Data Protection Agency (AEPD)
- Parties
- Spanish Data Protection Agency (AEPD) v. Tools for Humanity Corporation
- Decision date
- March 6, 2024
- Remedy
- Tools for Humanity Corporation was ordered to immediately cease collecting and processing personal data in Spain and block all data already collected, for a maximum duration of three months.
- Appeal
- Appeal status not stated
Key holdings
The temporary prohibition of Worldcoin's personal data activities in Spain is limited to a maximum period of three months.
“The temporary prohibition of activity in Spain is valid for a maximum period of three months”
The regulator initiated action after receiving complaints alleging insufficient information, collection of minor data, and inability to withdraw consent.
“AEPD has received several complaints denouncing insufficient information, collection of data from minors and preventing the withdrawal of consent, among other infringements”
The urgent action was taken pursuant to Article 66.1 of the GDPR due to exceptional circumstances involving sensitive biometric data.
“This action by the Spanish regulator is conducted under Article 66.1 of the GDPR”
In plain English
The Spanish Data Protection Agency, known as the AEPD, ordered an urgent precautionary measure against Tools for Humanity Corporation to halt its processing of personal data in Spain under its Worldcoin project. The regulator required the company to immediately cease collecting and processing personal data and to block all data previously collected in the country. This action followed multiple complaints received by the agency regarding Worldcoin, which alleged insufficient information provided to users, the collection of data from minors, and difficulties withdrawing consent. Because Worldcoin processes sensitive biometric data that poses high risks to individual rights, the AEPD determined that provisional action was required to prevent potential transfers of data to third parties and avoid irreparable harm. Tools for Humanity Corporation maintains its European establishment in Germany, but the Spanish regulator intervened directly using Article 66.1 of the General Data Protection Regulation. This provision allows a supervisory authority to adopt temporary measures valid for a maximum period of three months in exceptional and urgent circumstances to safeguard personal data rights.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.