orderConcluded
Bavarian State Office for Data Protection Supervision (BayLDA) — Worldcoin / Tools for Humanity
December 19, 2024 · Germany
The BayLDA found World's processing of biometric iris data for 'World ID' non-compliant with the GDPR and ordered a GDPR-compliant deletion procedure, explicit consent for certain processing, and deletion of iris data collected without a sufficient legal basis.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.