Colombia Confirms the Permanent Shutdown of Worldcoin’s Iris-Scanning Operation

Ruling binds any foreign firm that processes Colombians’ data, SIC warns

Colombia’s data-protection authority has made final its order shutting down the local iris-scanning operation run by World (formerly Worldcoin) and its developer, Tools for Humanity, closing off any further appeal.

The Superintendencia de Industria y Comercio (Superintendency of Industry and Commerce, or SIC), the country’s consumer-protection and data authority, confirmed the sanction it first imposed in 2025 against World Foundation—previously Worldcoin Foundation—and Tools for Humanity Corporation after resolving the companies’ appeals. The confirmation came through Resolution 45710 of June 18, 2026, which upholds Resolution 78798 of October 3, 2025 in full. Because the decision confirms rather than modifies the original ruling, no further recourse is available, the agency said.

The sanction consists of the immediate and definitive closure of every operation in Colombia that involves the processing of personal data. World Foundation and Tools for Humanity may no longer carry out any data-processing activity in the country, and the SIC ordered them to delete all sensitive personal data—including iris codes—collected since they began operating.

“Consent for the processing of biometric data must be free and cannot be conditioned on economic incentives that affect a person’s will.” — Superintendency of Industry and Commerce (SIC)

The two companies started operating in Colombia in the first half of 2024, gathering biometric images of the iris from thousands of people through devices known as “Orb.” In exchange, participants received economic compensation and could create an account to obtain a World ID, the project’s proof-of-personhood credential. The SIC found that the images were put through various forms of processing, such as biometric templates, but that the purposes of that processing were neither sufficiently clear nor properly disclosed.

Investigators at the agency’s data-protection directorate concluded that the operation breached several duties under Ley 1581 de 2012 (Law 1581 of 2012), Colombia’s personal-data-protection statute: the companies lacked compliant data-treatment policies, had no procedures for handling habeas data requests, failed to adopt adequate security measures for sensitive data, and did not obtain valid authorization from the people whose data they collected.

Consent was central to the ruling. The SIC determined that World conditioned people’s willingness to hand over sensitive information on the offer of an economic incentive, and that it did not provide clear, transparent, and simple information about the specific purposes of the processing.

“Consent for the processing of biometric data must be free and cannot be conditioned on economic incentives that affect a person’s will,” the SIC said. The agency added that biometric data such as the iris image carry special constitutional and legal protection, and that measures like encryption, pseudonymization, or fragmentation are legitimate safeguards but do not turn biometric data into anonymous information when the system can still single out an individual.

The regulator, led by Superintendent Cielo Rusinque, framed the decision as a warning to any company—foreign or domestic—whose business model involves processing the data of people in Colombia. The country’s data-protection regime, it said, binds foreign companies regardless of their domicile, business model, or the complexity of their technical architecture. The SIC also stressed that it does not seek to discourage technological development, innovation, or the economic freedoms recognized in Article 333 of Colombia’s Constitution, but that data-driven businesses must operate responsibly and within the law.

The case is not World’s first regulatory clash in Colombia. Finance Colombia previously reported on allegations that the project targeted vulnerable populations for iris scans as it expanded across the country. The company had promoted World ID verification in Colombia as part of a broader global rollout.