Colombia’s data-protection authority has made final its order shutting down the local iris-scanning operation run by World (formerly Worldcoin) and its developer, Tools for Humanity, closing off any further appeal.

The Superintendencia de Industria y Comercio (Superintendency of Industry and Commerce, or SIC), the country’s consumer-protection and data authority, confirmed the sanction it first imposed in 2025 against World Foundation—previously Worldcoin Foundation—and Tools for Humanity Corporation after resolving the companies’ appeals. The confirmation came through Resolution 45710 of June 18, 2026, which upholds Resolution 78798 of October 3, 2025 in full. Because the decision confirms rather than modifies the original ruling, no further recourse is available, the agency said.

The sanction consists of the immediate and definitive closure of every operation in Colombia that involves the processing of personal data. World Foundation and Tools for Humanity may no longer carry out any data-processing activity in the country, and the SIC ordered them to delete all sensitive personal data—including iris codes—collected since they began operating.

“Consent for the processing of biometric data must be free and cannot be conditioned on economic incentives that affect a person’s will.” — Superintendency of Industry and Commerce (SIC)

The two companies started operating in Colombia in the first half of 2024, gathering biometric images of the iris from thousands of people through devices known as “Orb.” In exchange, participants received economic compensation and could create an account to obtain a World ID, the project’s proof-of-personhood credential. The SIC found that the images were put through various forms of processing, such as biometric templates, but that the purposes of that processing were neither sufficiently clear nor properly disclosed.

Investigators at the agency’s data-protection directorate concluded that the operation breached several duties under Ley 1581 de 2012 (Law 1581 of 2012), Colombia’s personal-data-protection statute: the companies lacked compliant data-treatment policies, had no procedures for handling habeas data requests, failed to adopt adequate security measures for sensitive data, and did not obtain valid authorization from the people whose data they collected.

Consent was central to the ruling. The SIC determined that World conditioned people’s willingness to hand over sensitive information on the offer of an economic incentive, and that it did not provide clear, transparent, and simple information about the specific purposes of the processing.

“Consent for the processing of biometric data must be free and cannot be conditioned on economic incentives that affect a person’s will,” the SIC said. The agency added that biometric data such as the iris image carry special constitutional and legal protection, and that measures like encryption, pseudonymization, or fragmentation are legitimate safeguards but do not turn biometric data into anonymous information when the system can still single out an individual.

The regulator, led by Superintendent Cielo Rusinque, framed the decision as a warning to any company—foreign or domestic—whose business model involves processing the data of people in Colombia. The country’s data-protection regime, it said, binds foreign companies regardless of their domicile, business model, or the complexity of their technical architecture. The SIC also stressed that it does not seek to discourage technological development, innovation, or the economic freedoms recognized in Article 333 of Colombia’s Constitution, but that data-driven businesses must operate responsibly and within the law.

The case is not World’s first regulatory clash in Colombia. Finance Colombia previously reported on allegations that the project targeted vulnerable populations for iris scans as it expanded across the country. The company had promoted World ID verification in Colombia as part of a broader global rollout.

The sanction, detailed in Resolution 78798 of October 3, 2025, concludes a seven-month investigation into the companies’ practice of collecting sensitive biometric data from thousands of Colombians.

The companies began operations in Colombia in the first half of 2024, deploying “Orb” devices to capture biometric images of individuals’ irises. This data was used to create a “World ID” and, according to the SIC, was obtained by offering economic compensation.

President Gustavo Petro commented on the sanction via his account on the social network X: “Excellent. In Colombia, the right to habeas data exists. You own your data. Sensitive data like the iris of the eyes cannot be handed over simply for money, without knowledge of the use that will be given to it. For this practice, the operations of these companies were closed.”

The SIC investigation determined that this quid pro quo—offering money for biometric data—invalidated the legality of the consent obtained. The agency found that the economic incentive “conditioned the will” of data holders, preventing them from making a “free, spontaneous, or voluntary” decision as required by Colombian law.

The agency labeled the resulting consent an “uninformed and premature decision”.

SIC Findings and Legal Basis

The 76-page resolution details multiple, cascading violations of Colombia’s Statutory Law 1581 of 2012, which governs the constitutional right to habeas data, or the right of citizens to control their personal information.

Under Colombian law, biometric data, such as an iris scan, is classified as “sensitive data”. The processing of such data is expressly prohibited by default, with narrow exceptions, such as obtaining explicit, prior, and informed authorization from the user.

The SIC’s Directorate of Personal Data Protection Investigations found that the companies failed to meet this standard on several fronts:

• No Legal Authorization: The investigation concluded that the authorization formats used did not comply with the “principle of liberty” and other legal requirements. For example, several forms and processes presented to users were in English, not in Spanish, Colombia’s official language.
• Inadequate Policies: The companies’ data treatment policies were not adapted to Colombian law. The SIC noted that while Worldcoin’s policies included “adendas” (addendums) with specific, often stricter, rules for regions like the European Union, Japan, Argentina, and Peru, no such addendum was created for Colombia.
• Insufficient Security Measures: The resolution states that the companies failed to demonstrate “appropriate and effective” security measures for the sensitive data collected. The company’s 2021 Information Security Policy did not specifically cover the processing of biometric data.
• Lack of Transparency: The SIC found that Worldcoin failed to inform users about its Secure Multi-Party Computation (SMPC) protocol, a system where iris codes are fragmented and stored by third parties. This protocol was not disclosed in consent forms until December 2024, despite being in use since May 2024. The agency also raised concerns about the security risks and oversight of the third parties (including universities and other companies) storing these data fragments.
• Incomplete Data Deletion: The regulator found that the companies’ consent forms informed users that their “iris code” or “proof of singularity” would not be deleted, even if the user requested the deletion of their images. The SIC argued this proves the data is never fully suppressed, as it must be retained to check for duplicate registrations, a fact not clearly communicated to users.

The foundation and company were founded by tech billionaire Sam Altman, and pay people small amounts of cryptocurrency to scan their eyes and create a unique, identifiable record. Some find this extremely creepy and say it takes advantage of the poor & gullible. Altman is also the CEO of OpenAI, maker of ChatGPT.

The Sanction and Company Response

The SIC’s resolution imposes two primary actions:

Immediate and Definitive Closure: An order for the “immediate and definitive closure” of any operation in Colombia that involves the treatment of personal data.

Data Suppression: An order for World Foundation and Tools for Humanity to “suppress” all sensitive personal data, including all iris codes, from all databases, repositories, or servers where they are stored. This applies to all data collected in Colombia since the beginning of their operations.

The companies are required to submit a report from an external entity certifying the complete elimination of this data within one month of the resolution being executed.

World Foundation Response

In an official statement, World Foundation announced it would pursue legal appeals against the sanction. The company described the resolution as “preliminary and of the first instance” and asserted that its legal appeals “have a suspensive effect,” which it claims allows it to “continue operating in a normal and legal manner.”

The company contended that the SIC’s findings are “incomplete” and “based on outdated policies and technologies.”

World Foundation also clarified its position, stating that it does not store biometric data and that user consent is “confirmed at multiple stages” of the verification process. It further stated that the Worldcoin token is “additional and is completely separate from the verification process.”

The company said it hopes to establish an “open dialogue with the SIC to clarify how this important technology works.”

The SIC’s resolution also noted that the companies’ legal counsel had previously attempted to nullify the administrative proceeding, alleging “improper notification” of the initial investigation. The SIC rejected these motions, ruling that the companies had already responded to official inquiries using the same email addresses, thereby constituting “notification by conclusive conduct”.

Local leaders and merchants have raised alarms, claiming that those recruited are often in dire economic circumstances, which has amplified the controversy surrounding the firm’s activities. Worldcoin justifies its actions by claiming the initiative aims to create a unique global digital identity to prevent online identity fraud. However, the ethical implications of targeting such vulnerable populations have drawn widespread criticism.

If found in violation, Worldcoin may face significant penalties, including the suspension of its operations in Colombia. The case also underscores the need for stringent regulations governing the collection and use of biometric data, particularly from at-risk groups. The controversy has attracted international attention, with similar practices by the company being scrutinized in multiple countries.

This case highlights the broader issue of how emerging technologies can exploit vulnerable populations under the guise of innovation, raising important questions about consent, privacy, and the responsibilities of tech companies operating in global markets.

Image by TechCrunch – https://www.flickr.com/photos/techcrunch/53486715793/, CC BY 2.0, https://commons.wikimedia.org/w/index.php?curid=148326018