# Spain's AEPD orders Worldcoin (Tools for Humanity) to halt biometric iris-scanning data processing (2024)

> On 6 March 2024 Spain's data-protection regulator ordered Tools for Humanity Corporation to stop collecting and processing personal data in its Worldcoin iris-scanning project and to block data already collected; on 11 March 2024 Spain's National Court refused Worldcoin's bid to suspend the order.

- Verification status: verified
- Case type: deployment
- Provider: Agencia Española de Protección de Datos (AEPD)
- Client: Tools for Humanity Corporation (Worldcoin / World), Biometric identity / crypto (iris-scanning 'Orb') (named)
- Sector: biometrics / ES / ops
- Verified on: 2026-09-07
- Canonical URL: https://theinternetninja.com/stories/spain-aepd-orders-worldcoin-tools-for-humanity-to-halt-biometric-iris-scanning-a/
- Source: The Internet Ninja (theinternetninja.com), independent verified-proof platform

## Outcomes

| Metric | Before | After |
| --- | --- | --- |
| Regulator-ordered halt of a live biometric AI operation (max 3 months, GDPR Art. 66.1) | Worldcoin actively collecting/processing iris-biometric data in Spain | 6 Mar 2024: AEPD precautionary measure — cease collection & processing and block already-collected data |
| Judicial review of the halt | Worldcoin sought an injunction to suspend the AEPD order | 11 Mar 2024: Spain's National Court refused Worldcoin's request to suspend the order |

## Verification method

Regulator's own published resolution (AEPD, Tier 1) + two independent newsrooms on the halt (TechCrunch, Silicon UK); court refusal from the Audiencia Nacional's own communiqué (Poder Judicial/CGPJ, Tier 1) plus independent press (TechCrunch, JURIST). Archived captures on file.

## Full case file

## The problem
Worldcoin, operated by Tools for Humanity Corporation, ran a biometric identity
operation in Spain built on its "Orb" device, which scans the human iris. Spain's
data-protection regulator, the AEPD, said it "has received several complaints against
this company about insufficient information, the collection of data from minors and the
fact that consent cannot be withdrawn, among other infringements" [source](https://www.aepd.es/en/press-and-communication/press-releases/agency-orders-precautionary-measure-which-prevents-Worldcoin-from-continuing-toprocess-personal-data-in-spain).
It found that "the processing of biometric data, which under the General Data Protection
Regulation (GDPR) merits special protection, given their sensitive nature, entails high
risks to the rights of individuals" [source](https://www.aepd.es/en/press-and-communication/press-releases/agency-orders-precautionary-measure-which-prevents-Worldcoin-from-continuing-toprocess-personal-data-in-spain).

## What was built
The operation processed iris-biometric data via the Worldcoin "Orb." The AEPD acted
under Article 66.1 of the GDPR, which allows a supervisory authority, in exceptional
circumstances, to "adopt provisional measures with legal effects in its territory and
with a period of validity that may not exceed three months" [source](https://www.aepd.es/en/press-and-communication/press-releases/agency-orders-precautionary-measure-which-prevents-Worldcoin-from-continuing-toprocess-personal-data-in-spain).

## The outcome
On 6 March 2024 the AEPD "ordered a precautionary measure against Tools for Humanity
Corporation so that it ceases the collection and processing of personal data being
carrying out in Spain in the framework of its Worldcoin project, and to block the data
already collected" [source](https://www.aepd.es/en/press-and-communication/press-releases/agency-orders-precautionary-measure-which-prevents-Worldcoin-from-continuing-toprocess-personal-data-in-spain).
TechCrunch independently reported that the regulator "ordered Worldcoin to temporarily
stop collecting and processing personal data from the market. It must also stop
processing any data it previously collected there," and that "the order can have a
maximum duration of three months" [source](https://techcrunch.com/2024/03/06/worldcoin-spain-ban/).
A second independent newsroom, Silicon UK, reported that the "AEPD has ordered for
Worldcoin to immediately cease collecting personal information, and stop using data it
has already gathered, for a period of up to three months" [source](https://www.silicon.co.uk/e-enterprise/financial-market/spain-temporarily-bans-worldcoin-eyeball-scans-over-privacy-553665).

On 11 March 2024, Spain's National Court refused to suspend the order. The Audiencia
Nacional's own communiqué states that its Contentious-Administrative Chamber "ha
rechazado la medida cautelarísima solicitada por Tools for Humanity Corporation GMBH
(TFH), de la empresa Worldcoin, en su recurso contra la Orden de la Agencia Española de
Protección de Datos (AEPD)," holding that priority went to "la salvaguarda del interés
general que consiste en la protección del derecho a la protección de datos personales de
los interesados frente al interés particular de la empresa recurrente de contenido
fundamentalmente económico" [source](https://www.poderjudicial.es/cgpj/es/Poder-Judicial/Audiencia-Nacional/Oficina-de-Comunicacion/Notas-de-prensa/La-Audiencia-Nacional-avala-el-cese-cautelar-de-la-recopilacion-de-datos-a-traves-del-iris-de-Worldcoin-acordado-por-la-Agencia-de-Proteccion-de-datos).
TechCrunch independently reported that the court "declined to grant an injunction against
the AEPD's order, saying that the 'safeguarding of public interest' must be prioritized"
[source](https://techcrunch.com/2024/03/11/worldcoin-fails-to-get-injunction-against-spains-privacy-suspension/),
and JURIST that "the protection of personal data superseded any commercial interests of a
company" [source](https://www.jurist.org/news/2024/03/spain-high-court-reaffirms-data-protection-agencys-decision-to-temporarily-halt-worldcoin-operations/).

No Spain-specific count of Worldcoin users or iris scans is stated in the sources
fetched; that figure is deliberately omitted rather than estimated.

## A note on sources
The load-bearing facts here rest on independent-origin primaries: the regulator's own
resolution (AEPD, Tier 1) and the court's own communiqué (Poder Judicial/CGPJ, Tier 1).
The weakest load-bearing sources are the secondary newsrooms used to corroborate the
halt and the court's reasoning — TechCrunch and Silicon UK (both Tier 2). They are
reputable independent press naming the parties, but they are not the primary documents;
where they and the primaries differ, the primaries govern. One conflict is shown, not
merged: some outlets (e.g. Catalan News, CryptoSlate) described the window as "six
months" or "until year-end"; those are left uncited against the primary's three-month
cap.

## How this was verified
**Method:** Each critical claim was bound to an independent-origin primary — the AEPD's
published resolution and the Audiencia Nacional's own communiqué — then corroborated by
two independent newsrooms per claim (TechCrunch + Silicon UK on the halt; TechCrunch +
JURIST on the court refusal). Quotes were matched verbatim against archived captures on
file. Green never depends on Worldcoin/Tools for Humanity confirming anything; it rests
on the public regulatory and judicial record.
**Date:** 2026-08-10.

## Path to green
Human confirmation of the final disposition on the AEPD file after the three-month
provisional window — whether the measure was extended, converted into a definitive
resolution/sanction, or lapsed — and, if desired, the Spain-specific user/scan count
from an independent source. The regulator's resolution and the National Court decision
are public and independent-origin; the badge requires that human confirmation on record.

## Sources
1. **AEPD (Agencia Española de Protección de Datos)** · "The AEPD orders a precautionary measure that prevents Worldcoin from continuing to process personal data in Spain" · 6 Mar 2024 · **Tier 1** · https://www.aepd.es/en/press-and-communication/press-releases/agency-orders-precautionary-measure-which-prevents-Worldcoin-from-continuing-toprocess-personal-data-in-spain
2. **TechCrunch** · "Spain orders Worldcoin to stop scanning eyeballs" · 6 Mar 2024 · **Tier 2** · https://techcrunch.com/2024/03/06/worldcoin-spain-ban/
3. **Silicon UK** · "Spain Temporarily Bans Worldcoin Eyeball Scans Over Privacy" · 7 Mar 2024 · **Tier 2** · https://www.silicon.co.uk/e-enterprise/financial-market/spain-temporarily-bans-worldcoin-eyeball-scans-over-privacy-553665
4. **Poder Judicial / CGPJ (Audiencia Nacional, Oficina de Comunicación)** · "La Audiencia Nacional avala el cese cautelar de la recopilación de datos a través del iris de Worldcoin acordado por la Agencia de Protección de datos" · 11 Mar 2024 · **Tier 1** · https://www.poderjudicial.es/cgpj/es/Poder-Judicial/Audiencia-Nacional/Oficina-de-Comunicacion/Notas-de-prensa/La-Audiencia-Nacional-avala-el-cese-cautelar-de-la-recopilacion-de-datos-a-traves-del-iris-de-Worldcoin-acordado-por-la-Agencia-de-Proteccion-de-datos
5. **TechCrunch** · "Worldcoin fails to get injunction against Spain's privacy suspension" · 11 Mar 2024 · **Tier 2** · https://techcrunch.com/2024/03/11/worldcoin-fails-to-get-injunction-against-spains-privacy-suspension/
6. **JURIST** · "Spain high court reaffirms data protection agency's decision to temporarily halt Worldcoin operations" · 11 Mar 2024 · **Tier 2** · https://www.jurist.org/news/2024/03/spain-high-court-reaffirms-data-protection-agencys-decision-to-temporarily-halt-worldcoin-operations/

## Related case files
- [Spain's AEPD fines Mercadona €2.52M over facial recognition](/stories/spain-aepd-fines-mercadona-2520000-facial-recognition-biometric-ai-gdpr-sanction-2021/) — the same regulator (AEPD) sanctioning another biometric AI deployment, a facial-recognition system.
- [a U.S. court bans Rite Aid from AI facial recognition for five years](/stories/ftc-rite-aid-ai-facial-recognition-five-year-ban-court-ordered-2024/) — another enforcement-ordered halt of a live biometric AI operation, here a court-ordered five-year ban after the FTC's action.
- [the ICO orders Serco Leisure to halt biometric attendance checks](/stories/ico-orders-serco-leisure-to-halt-unlawful-facial-recognition-and-fingerprint-att/) — a parallel DPA-ordered halt of unlawful biometric processing, this one by the UK's ICO.
- [the Dutch DPA fines Clearview AI €30.5M over an unlawful face database](/stories/dutch-dpa-clearview-ai-gdpr-30-5m-fine-illegal-facial-recognition-database-2024/) — an EU DPA enforcing GDPR against an unlawful biometric database.