On March 6, 2024, the Spanish Data Protection Agency (AEPD) ordered Tools for Humanity, the company behind Worldcoin, to stop collecting and processing personal data in Spain and to block the data it had already gathered. It was one of the first formal regulatory suspensions of Worldcoin’s iris-scanning operations in Europe.
The AEPD said it had received complaints about insufficient information given to users, the collection of data from minors, and the fact that consent, once given, could not be withdrawn. It stressed that biometric data such as iris scans “merits special protection, given their sensitive nature” and “entails high risks to the rights of individuals.” The agency acted under the urgency procedure in Article 66 of the EU’s General Data Protection Regulation, which allows a provisional ban of up to three months to prevent potentially irreparable harm. Spain’s National Court later upheld the order.
The Spanish action was part of a wider regulatory pushback. Authorities in Kenya had already suspended Worldcoin’s local operations in 2023, and regulators elsewhere opened their own inquiries. Together these orders made Worldcoin a leading test case for how data-protection law applies when a private company collects biometric identifiers from large numbers of people - and a reminder that, for sensitive biometrics, regulators can halt a deployment far faster than they can litigate it.