Philippines National Privacy Commission Halts Tools for Humanity Iris Scanning
The Philippines National Privacy Commission issued a cease and desist order against Tools for Humanity, halting its World App iris-scanning operations, citing violations of the Data Privacy Act including offering monetary incentives for biometric data collection and failing to inform users of data processing purposes. The regulator found that the practices exposed Filipino citizens to risks of identity theft, fraud, and reputation harm.
What happened
The National Privacy Commission of the Philippines issued a cease and desist order against Tools for Humanity on October 7, 2025, mandating the company to stop collecting and processing biometric data through its Orb iris-scanning devices and World App.
The NPC found that Tools for Humanity offered monetary incentives in exchange for iris scanning, which constituted undue influence and was deemed excessive and unnecessary for proof of humanity verification. The company failed to inform data subjects of the purpose, scope, extent, and duration of data processing.
Reported impact
The NPC stated that continued data processing exposed Filipinos to serious and lifelong risks including identity theft, fraud, and reputation harm. Deputy Commissioner Jose Amelito Belarmino II said the integrity of Filipino citizens' biometric data is non-negotiable as it is a unique and permanent identifier.
Index analysis
The cease and desist order reflects a disconnect within Philippine government, as the Department of Information and Communications Technology expressed plans on the same day to adopt the iris-scanning technology for banking and government systems. Tools for Humanity stated it would file a motion for reconsideration, characterizing the decision as surprising and a setback after completing a year-long compliance process including participation in the DICT Sandbox Program.
Governance controls
Tools for Humanity stated it underwent extensive regulatory review and participated in the DICT Sandbox Program before formal registration with the NPC, claiming all steps were done transparently and in accordance with the Data Privacy Act of 2012. The company asserted that World does not record or store personal data.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.