CNPD (Portugal) — Worldcoin Foundation
The CNPD issued an urgent corrective measure ordering a 90-day temporary limitation on Worldcoin's collection of biometric data (iris, eye and face) in Portugal, after complaints including collection of minors' data without parental authorisation and deficient information.
Key takeaway — how to prevent this
Algorithmic pricing tools that ingest competitors' data can expose you to price-fixing and antitrust liability — don't delegate pricing to a shared algorithm without competition-law review and genuinely independent decisions.
Case brief
Read from the authority's press release on 2026-09-18. Every holding carries a short verbatim quote from that text (in PT, the document's language).
- Decided by
- Comissão Nacional de Proteção de Dados
- Parties
- Comissão Nacional de Proteção de Dados v. Worldcoin Foundation
- Decision date
- July 9, 2024
- Remedy
- CNPD recognized the Bavarian authority (BayLDA) as the lead supervisory authority for Worldcoin Foundation and decided to forward all relevant documents to BayLDA.
- Appeal
- Appeal status not stated
Key holdings
CNPD recognized the Bavarian Data Protection Authority (BayLDA) as the lead supervisory authority for the processing of personal and biometric data by Worldcoin Foundation.
“identificar a Bayerisches Landesamt für Datenschutz ("BayLDA") como “Autoridade de Controlo Principal” para os tratamentos de dados pessoais e dados biométricos por conta da Worldcoin Foundation;”
CNPD declared itself to be a concerned supervisory authority under Article 4(22) of the GDPR.
“Declarar a CNPD como Autoridade de Controlo Interessada, na aceção da alínea 22) do artigo 4.º do RGPD;”
CNPD ordered the forwarding of all relevant documents and information to the lead supervisory authority pursuant to Article 60(1) of the GDPR.
“Decidir, ao abrigo da parte final do n.º 1 do artigo 60.º do RGPD, a remessa de todos os documentos e informações pertinentes à Autoridade de Controlo Principal.”
In plain English
In March 2024, the Portuguese Data Protection Authority, CNPD, suspended the collection of facial, iris, and eye biometric data conducted by Worldcoin Foundation across Portugal to protect personal data rights, particularly those of minors. Following that decision, Worldcoin Foundation submitted documentation demonstrating that it has an establishment in Germany. Because Worldcoin Foundation operates an establishment in Germany, primary regulatory responsibility shifted under European cooperation rules to the Bavarian authority, BayLDA. On 10/07/2024, CNPD published an update regarding a plenary decision where it formally recognized BayLDA as the main lead supervisory authority for processing personal and biometric data on behalf of Worldcoin Foundation. Consequently, CNPD declared itself an interested supervisory authority and resolved to forward all relevant documents and information to BayLDA. While BayLDA takes over as the lead authority responsible for analyzing and pursuing the proceedings, CNPD stated that it will remain active as an interested authority and stay attentive to all future developments in the case.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.