Portugal Orders Sam Altman-Backed Worldcoin To Stop Collecting Biometric Data For 3 Months

Portugal's data regulator Comissão Nacional de Proteção de Dados (CNPD) has ordered iris-scanning for cryptocurrency project Worldcoin to halt its biometric data collection activities for 90 days, citing privacy concerns, "especially for minors."

Worldcoin has been asked to stop collecting the biometric data of Portugal citizens for three months "until the CNPD completes its investigation and issues a final decision," the regulator said in a press release Tuesday, as per a Google translation.

"The adoption of this urgent provisional measure follows dozens of reports received by the CNPD in the last month, reporting the collection of data from minors without the authorization of their parents or other legal representatives, as well as deficiencies in the information provided to data subjects," the regulator added.

It also raised concerns about the "impossibility of deleting data or revoking consent," thus pushing the CNPD to take action. It cited news reports that over 300,000 people in Portugal have provided their biometric data to Worldcoin.

European laws, including the General Data Protection Regulation (GDPR), protect the data privacy of minors, whom the CNPD recognized as "especially vulnerable people" and have less awareness about the risks of having their biometric information collected, the regulator noted.

CNPD President Paula Meira Lourenço said the order on Worldcoin was an "indispensable and justified measure" to ensure that the fundamental rights of the Portuguese public are protected. The regulator also argued that its intervention was done "to prevent serious or irreparable damage."

The project, which is backed by OpenAI founder Sam Altman, encourages people to have their irises scanned on the Worldcoin Orb in exchange for cryptocurrency and a digital ID. "The Orb uses multispectral sensors to verify humanness and uniqueness to issue an Orb-verified World ID, with all images being promptly deleted on-device per default," the Worldcoin whitepaper states.

Portugal's decision just weeks after the Spanish Data Protection Agency (AEPD) made a similar move, ordering the project to stop processing the personal data of Spain residents for three months. Spain's data regulator said its action was necessary to ensure that the Spanish public is not deprived of the data privacy protection they are entitled to.

Other data regulators in Europe, including Germany and the United Kingdom, have also expressed their intent to investigate how exactly Worldcoin makes use of the biometric information it collects.

Kenya leads the way in blocking Worldcoin activities as it suspended the project's activities in the country until experts ensure that the risks to Kenyan users do not outstrip its benefits.