Spain ordered Worldcoin to halt biometric-data processing

Spain’s data-protection authority ordered Tools for Humanity Corporation GmbH on March 6, 2024 to immediately stop collecting and processing personal data in Spain through scans of irises, eyes and faces for the Worldcoin project. The Spanish Data Protection Agency, known as the AEPD, also ordered the company to block data already collected in the country and confirm implementation within 72 hours of receiving the order.

The measure was temporary, with a maximum validity of three months. It nevertheless represented an immediate operational intervention against a cryptocurrency-linked identity system rather than a warning, consultation or completed enforcement judgment. Worldcoin’s enrollment model depended on a spherical imaging device called the Orb to establish a World ID, making access to biometric collection points a practical bottleneck for expanding verified participation.

A provisional action, not a final infringement finding

The AEPD said it had received complaints alleging inadequate information for participants, collection involving minors, and difficulty withdrawing consent or securing deletion. Those were allegations under investigation on March 6, 2024, not adjudicated violations.

In its five-page provisional-measure order, the regulator said its preliminary assessment found rational indications that the processing could violate several provisions of the General Data Protection Regulation, including rules governing lawfulness, consent, special-category data, transparency and erasure. The order described the Orb process as capturing images of the iris, eyes and face, generating a biometric pattern, and associating the result with the participant’s application and World ID.

The AEPD treated continued processing as an urgent risk because biometric information is sensitive and cannot be replaced in the way a password can. Its order also emphasized the asserted involvement of minors and the possibility of potentially irreparable harm. These findings explained the emergency intervention; they did not establish the ultimate merits of every complaint.

Why Spain could intervene immediately

Tools for Humanity’s European establishment was in Germany, and the AEPD identified Bavaria’s data-protection authority as the lead supervisory authority for the cross-border processing. Ordinarily, the GDPR’s cooperation mechanisms coordinate cases involving multiple European jurisdictions.

Spain instead invoked Article 66(1), an urgency provision allowing a concerned supervisory authority to adopt immediately applicable provisional measures within its own territory in exceptional circumstances. Such measures cannot remain valid for more than three months. That legal route mattered beyond Worldcoin: it showed that a cross-border digital-asset project operating under a lead European regulator could still face a rapid national shutdown when another authority identified an urgent local risk.

The order also required Tools for Humanity to report effective implementation within 72 hours. It warned that failure to comply with a supervisory authority’s order could expose a company to the GDPR’s statutory penalty framework. That warning concerned noncompliance with the order; it was not an announcement that a fine had already been imposed.

Worldcoin disputed the regulator’s approach

In a statement reported on March 6, Worldcoin data-protection officer Jannick Preiwisch argued that the AEPD was bypassing established European procedures and spreading inaccurate claims. He said project contributors had been engaging with the Bavarian authority. Worldcoin also maintained that its operations were designed to preserve privacy.

The competing positions framed the unresolved institutional dispute. The regulator viewed immediate territorial action as necessary to protect people while complaints were examined. Worldcoin viewed Germany’s lead-authority process as the appropriate venue for assessing its compliance.

What the order did—and did not—decide

The March 6 measure directly covered biometric collection and processing in Spain and the blocking of Spanish data already obtained. It did not itself prohibit trading in the WLD token, decide the token’s legal classification, or determine the legality of the underlying blockchain protocol.

No token-price reaction is asserted here because the regulatory record does not establish causation between the announcement and market trading. The event’s significance was operational and institutional: a crypto project combining token incentives, identity infrastructure and highly sensitive personal data had encountered an enforceable national boundary before the underlying European investigation reached a final conclusion.