Spanish Data Protection Agency (AEPD) — Tools for Humanity (Worldcoin)
AEPD issued a precautionary three-month order halting Worldcoin's iris-scanning operations in Spain after complaints that the project was collecting biometric data with inadequate consent (including from minors) and providing insufficient information about retention and rights. Cited GDPR's special-category data rules — but iris-scan for identity is precisely the kind of biometric categorisation that the EU AI Act prohibits or treats as high-risk under Articles 5 and Annex III §1.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.