Spain's AEPD orders Worldcoin (Tools for Humanity) to halt biometric iris-scanning data processing (2024)

The problem

Worldcoin, operated by Tools for Humanity Corporation, ran a biometric identity operation in Spain built on its “Orb” device, which scans the human iris. Spain’s data-protection regulator, the AEPD, said it “has received several complaints against this company about insufficient information, the collection of data from minors and the fact that consent cannot be withdrawn, among other infringements” source. It found that “the processing of biometric data, which under the General Data Protection Regulation (GDPR) merits special protection, given their sensitive nature, entails high risks to the rights of individuals” source.

What was built

The operation processed iris-biometric data via the Worldcoin “Orb.” The AEPD acted under Article 66.1 of the GDPR, which allows a supervisory authority, in exceptional circumstances, to “adopt provisional measures with legal effects in its territory and with a period of validity that may not exceed three months” source.

The outcome

On 6 March 2024 the AEPD “ordered a precautionary measure against Tools for Humanity Corporation so that it ceases the collection and processing of personal data being carrying out in Spain in the framework of its Worldcoin project, and to block the data already collected” source. TechCrunch independently reported that the regulator “ordered Worldcoin to temporarily stop collecting and processing personal data from the market. It must also stop processing any data it previously collected there,” and that “the order can have a maximum duration of three months” source. A second independent newsroom, Silicon UK, reported that the “AEPD has ordered for Worldcoin to immediately cease collecting personal information, and stop using data it has already gathered, for a period of up to three months” source.

On 11 March 2024, Spain’s National Court refused to suspend the order. The Audiencia Nacional’s own communiqué states that its Contentious-Administrative Chamber “ha rechazado la medida cautelarísima solicitada por Tools for Humanity Corporation GMBH (TFH), de la empresa Worldcoin, en su recurso contra la Orden de la Agencia Española de Protección de Datos (AEPD),” holding that priority went to “la salvaguarda del interés general que consiste en la protección del derecho a la protección de datos personales de los interesados frente al interés particular de la empresa recurrente de contenido fundamentalmente económico” source. TechCrunch independently reported that the court “declined to grant an injunction against the AEPD’s order, saying that the ‘safeguarding of public interest’ must be prioritized” source, and JURIST that “the protection of personal data superseded any commercial interests of a company” source.

No Spain-specific count of Worldcoin users or iris scans is stated in the sources fetched; that figure is deliberately omitted rather than estimated.

A note on sources

The load-bearing facts here rest on independent-origin primaries: the regulator’s own resolution (AEPD, Tier 1) and the court’s own communiqué (Poder Judicial/CGPJ, Tier 1). The weakest load-bearing sources are the secondary newsrooms used to corroborate the halt and the court’s reasoning — TechCrunch and Silicon UK (both Tier 2). They are reputable independent press naming the parties, but they are not the primary documents; where they and the primaries differ, the primaries govern. One conflict is shown, not merged: some outlets (e.g. Catalan News, CryptoSlate) described the window as “six months” or “until year-end”; those are left uncited against the primary’s three-month cap.

How this was verified

Method: Each critical claim was bound to an independent-origin primary — the AEPD’s published resolution and the Audiencia Nacional’s own communiqué — then corroborated by two independent newsrooms per claim (TechCrunch + Silicon UK on the halt; TechCrunch + JURIST on the court refusal). Quotes were matched verbatim against archived captures on file. Green never depends on Worldcoin/Tools for Humanity confirming anything; it rests on the public regulatory and judicial record. Date: 2026-08-10.

Path to green

Human confirmation of the final disposition on the AEPD file after the three-month provisional window — whether the measure was extended, converted into a definitive resolution/sanction, or lapsed — and, if desired, the Spain-specific user/scan count from an independent source. The regulator’s resolution and the National Court decision are public and independent-origin; the badge requires that human confirmation on record.

Sources

1. AEPD (Agencia Española de Protección de Datos) · “The AEPD orders a precautionary measure that prevents Worldcoin from continuing to process personal data in Spain” · 6 Mar 2024 · Tier 1 · https://www.aepd.es/en/press-and-communication/press-releases/agency-orders-precautionary-measure-which-prevents-Worldcoin-from-continuing-toprocess-personal-data-in-spain
2. TechCrunch · “Spain orders Worldcoin to stop scanning eyeballs” · 6 Mar 2024 · Tier 2 · https://techcrunch.com/2024/03/06/worldcoin-spain-ban/
3. Silicon UK · “Spain Temporarily Bans Worldcoin Eyeball Scans Over Privacy” · 7 Mar 2024 · Tier 2 · https://www.silicon.co.uk/e-enterprise/financial-market/spain-temporarily-bans-worldcoin-eyeball-scans-over-privacy-553665
4. Poder Judicial / CGPJ (Audiencia Nacional, Oficina de Comunicación) · “La Audiencia Nacional avala el cese cautelar de la recopilación de datos a través del iris de Worldcoin acordado por la Agencia de Protección de datos” · 11 Mar 2024 · Tier 1 · https://www.poderjudicial.es/cgpj/es/Poder-Judicial/Audiencia-Nacional/Oficina-de-Comunicacion/Notas-de-prensa/La-Audiencia-Nacional-avala-el-cese-cautelar-de-la-recopilacion-de-datos-a-traves-del-iris-de-Worldcoin-acordado-por-la-Agencia-de-Proteccion-de-datos
5. TechCrunch · “Worldcoin fails to get injunction against Spain’s privacy suspension” · 11 Mar 2024 · Tier 2 · https://techcrunch.com/2024/03/11/worldcoin-fails-to-get-injunction-against-spains-privacy-suspension/
6. JURIST · “Spain high court reaffirms data protection agency’s decision to temporarily halt Worldcoin operations” · 11 Mar 2024 · Tier 2 · https://www.jurist.org/news/2024/03/spain-high-court-reaffirms-data-protection-agencys-decision-to-temporarily-halt-worldcoin-operations/

Related case files

• Spain’s AEPD fines Mercadona €2.52M over facial recognition — the same regulator (AEPD) sanctioning another biometric AI deployment, a facial-recognition system.
• a U.S. court bans Rite Aid from AI facial recognition for five years — another enforcement-ordered halt of a live biometric AI operation, here a court-ordered five-year ban after the FTC’s action.
• the ICO orders Serco Leisure to halt biometric attendance checks — a parallel DPA-ordered halt of unlawful biometric processing, this one by the UK’s ICO.
• the Dutch DPA fines Clearview AI €30.5M over an unlawful face database — an EU DPA enforcing GDPR against an unlawful biometric database.