Data protection authorities in Kenya, Korea, and Bavaria are reviewing Worldcoin.

Worldcoin rewards people with tokens for having their irises scanned. The dystopian-looking project arouses the suspicion of data protection advocates in many countries. A decision has been made in Kenya, while Korea and Bavaria are still reviewing the matter.

Yes, it looks pretty creepy. An „Orb“ is set up in city centers, people queue up, and when it’s their turn, they hold their eyes in front of a camera. Once the Orb completes the iris scan, they receive some Worldcoin tokens (WLC). Crypto can go dystopian, too.

Many people, particularly in developing countries, find this offer appealing. Worldcoin has already scanned the irises of more than 5.8 million people. However, from the beginning, data protection advocates were suspicious, and in many places, Worldcoin has been halted because of this.

In South Korea, the „Personal Information Protection Commission“ launched an investigation on February 29. This was in response to complaints about the collection of personal data in South Korea. Noah Kim, the only Korean employee of Worldcoin, recently responded to the allegations: The Orb verifies only individuality and humanity, and all data is immediately deleted. Iris scans, compared to facial recognition and fingerprints, are the cheapest and most reliable method to generate a „Proof of Humanity.“

Kenia has already gone a step further. There, Worldcoin was banned in August 2023 until privacy concerns were resolved. The investigation is now complete; no violations of laws and privacy regulations were found. Consequently, Worldcoin is allowed again in Kenya.

If Worldcoin operates as its concept states, there would indeed be virtually no valid privacy concerns. When the user scans their iris, the Orb generates a unique hash from it and uploads it to a blockchain. This hash cannot be traced back to the iris itself; it can only be used to determine if this user has previously engaged with an Orb, thereby preventing double registrations. Even during operation, iris data is never revealed since Zero-Knowledge Proofs are used. Worldcoin leverages advanced cryptography to minimize the data collected.

If — if it runs as Worldcoin planned. Because individual Orb operators could indeed have the means to manipulate the process, for instance, by simply not deleting the raw data. Thus, much depends on Worldcoin — or corresponding supervisory authorities — monitoring the iris scans. The Bavarian State Office for Data Protection Supervision (BayLDA) is still not convinced. Since the company behind the technology, Tools for Humanity, is based in Erlangen, Bavaria, it holds jurisdiction. It launched an investigation last year but has not yet concluded it.

The BayLDA recently published its 2023 annual report. It writes that „due to the high sensitivity of the processed biometric data, we are reviewing the company’s procedures.“ This involves „on-site inspections, which are part of the standard procedure for such innovative technologies with a very large user base: One location in Berlin where users could register was inspected, and a team from BayLDA also checked the company headquarters, primarily responsible for the development and testing of the technology.“ The review is not yet complete, but results are expected for 2024.

In Spain, authorities and courts have already reached a verdict and banned Worldcoin.

Almost everywhere Worldcoin appears, a ban looms. Every data protection authority instinctively senses abuse and initiates an investigation, which in the best-case scenario is strenuous and in the worst-case scenario ends in a ban. But amidst all this – why? Why is Worldcoin, a project by OpenAI founder Sam Altman, doing all this?

Worldcoin scans people’s irises to generate a „Proof of Humanity,“ a „proof of being human.“ This can then be used to identify oneself on the internet — simply as a unique human being, no bot, no sock puppet, but a human. This, according to the vision, is necessary to avoid completely losing orientation and sanity in the age of generative AIs.

With the „World ID“ one can already verify oneself on various systems today, such as Discord, Reddit, Shopify, Telegram, and others. There aren’t many, but it’s a start.