German regulator orders Worldcoin to enhance privacy measures after biometric data probe
The Bavarian State Office for Data Protection Supervision (BayLDA) has mandated Worldcoin to enhance privacy measures following an investigation into its biometric data practices. Worldcoin must establish a GDPR-compliant data deletion process within one month and obtain explicit user consent for specific data processing activities. Data collected without a legal basis must be deleted. The investigation, initiated in April 2023, focused on Worldcoin's use of iris-derived biometric data for its World ID system, which authenticates individuals to prevent duplicate registrations. While Worldcoin paused operations in some EU countries during the investigation, additional compliance issues were identified. Users can now demand the erasure of their iris data. Regulatory challenges persist globally, with scrutiny in regions like Hong Kong and Singapore, despite the closure of an investigation in Kenya after compliance assurances.
