Worldcoin ordered to delete iris data and enable user deletion under GDPR
Germany's Bavarian data protection authority (BayLDA) ordered Worldcoin to delete iris biometric data collected from users and implement a compliant user deletion mechanism within 30 days, citing GDPR violations. Spain's data protection agency subsequently endorsed the decision, which is binding across the EU.
What happened
The Bavarian Regional Office for Data Protection (BayLDA) concluded that Worldcoin must allow users to delete their biometric iris data and implement a compliant deletion method within 30 days, following an investigation opened in April 2023.
The decision found that Worldcoin's data handling practices violated GDPR requirements and that users were not properly granted their right to withdraw consent for biometric data storage.
Spain's data protection agency endorsed the BayLDA decision on 19 December 2024, citing it as binding across the EU, and stated that Worldcoin must delete all iris data collected since the project began.
Reported impact
All users who provided iris data to Worldcoin will have the unlimited right to implement data deletion going forward.
The decision requires Worldcoin to implement corrective measures and seek user approval for certain data processing steps, and to delete data stored without sufficient legal basis.
Index analysis
The investigation centered on Worldcoin's data protection standards and user rights, with particular attention to the right to withdraw consent for biometric data storage and the lack of a compliant deletion mechanism.
BayLDA found that despite improvements made by the company, adjustments were still necessary for data processing to comply with EU regulations.
Governance controls
Worldcoin was instructed to implement a deletion procedure compliant with GDPR within 30 days of the decision's publication.
The BayLDA decision is binding EU-wide because it was adopted in coordination with all European data protection authorities involved, given Worldcoin's activities span the entire European Union.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.