National Privacy Commission (NPC) — Tools for Humanity (World / Worldcoin)

Decided by

National Privacy Commission

Parties

Complaints and Investigation Division of the National Privacy Commission v. Tools for Humanity

Decision date

September 23, 2025

Remedy

Tools for Humanity and its local operator WCPH Corporation were ordered to immediately cease and desist from processing personal information in the Philippines, including removing World App from app stores, halting Orb identity verifications, and refraining from sharing collected personal data.

Appeal

Appeal status not stated

Key holdings

1. Tools for Humanity processed personal data without valid, freely given, and informed consent under the Data Privacy Act of 2012.

   “the consent relied upon by TFH as its sole legal basis for processing is not specific, freely given and an informed indication of the data subjects’ will.” — page 63

2. The collection of facial and iris biometric data was excessive and unnecessary for verifying human uniqueness.

   “The Commission finds that the processing of the data subject’s facial and iris images is excessive and not necessary for the purpose asserted by TFH.” — page 47

3. Tools for Humanity committed multiple violations of guaranteed statutory rights of data subjects.

   “Aggravating the matter further, the Commission found numerous violations of the guaranteed rights of the data subjects, particularly the rights to be informed, access, and withdrawal of consent and erasure.” — page 64

4. The National Privacy Commission ordered Tools for Humanity and WCPH Corporation to halt all processing of personal data via World App and the Orb in the Philippines.

   “TFH, and its local operator WCPH Corporation, is hereby ORDERED to CEASE and DESIST from the processing of personal information within the Philippines through the Orb and the World App.” — page 64

In plain English

The Complaints and Investigation Division of the National Privacy Commission of the Philippines initiated an investigation into United States company Tools for Humanity and its local operator, WCPH Corporation, regarding data privacy practices associated with the World App and the custom Orb hardware device. The investigation followed reports concerning the collection of personal and biometric information, including facial captures and iris scans, from individuals in exchange for digital identification and financial rewards. On 23 September 2025, the National Privacy Commission issued a Cease and Desist Order against Tools for Humanity. The Commission determined that the company violated the Data Privacy Act of 2012 by processing personal and sensitive personal data without obtaining valid, freely given, and informed consent. It found that user consent was compromised by monetary incentives, referral schemes, complex privacy disclosures, and a lack of clear explanation. Additionally, the Commission held that the collection of immutable biometric data was excessive and failed to adhere to the principles of transparency, legitimate purpose, and proportionality. Tools for Humanity also violated core data subject rights, including the rights to be informed, to access data, and to withdraw consent. Consequently, the Commission ordered Tools for Humanity and WCPH Corporation to immediately cease and desist from processing personal information in the Philippines. This mandate prohibits distributing World App, conducting identity verifications using the Orb device, and sharing previously collected data.