- Hong Kong officials ordered Worldcoin to stop scanning the irises of volunteers.
- The Sam Altman-backed project has struggled with regulatory action worldwide.
- Hong Kong officials executed the deepest probe into Worldcoin yet.
Hong Kong authorities on Wednesday ordered the eyeball-scanning crypto startup Worldcoin to cease all operations in the region after a months-long investigation.
The Hong Kong Privacy Commissioner’s Office said the images Worldcoin collects of people’s faces and irises are “unnecessary and excessive,” and violated the city’s data protection principles.
“If members of the public notice that Worldcoin is still operating at any premises with the iris scanning devices in Hong Kong, please report the matter immediately to the PCPD,” Privacy Commissioner Ada Chung Lai-ling said in a statement released on May 22. The PCPD stands for the privacy agency.
Latest setback
It’s the latest setback for the crypto project founded by Sam Altman, the Silicon Valley entrepreneur and CEO of OpenAI.
In classic startup fashion, Worldcoin set up eyeball-scanning orbs around the world without getting licenced or approvals from regulators.
The business is predicated on using biometric data to establish the “humanness” of people in a digital world that is increasingly populated by AI bots and other programmes.
So far, it’s scanned more than 5.3 million people, according to its website. In exchange, it provides volunteers with digital tokens called WLD.
More than a half dozen nations — including the UK, France, Portugal and Brazil — have either directed the company to stop violating the privacy of volunteers, including minors in Spain, or opened probes into the platform.
It’s also the latest in a string of public relations fiascoes for Altman.
This week, OpenAI was forced to pause the rollout of the voice for a ChatGPT personal assistant because it sounded too closely like the voice of actor Scarlet Johansson.
Her lawyers demanded the company cease using the voice.
A representative of the Worldcoin Foundation told DL News it was “disappointed” by the views recently released by the regulatory authorities in Hong Kong.
“Worldcoin operates lawfully and is designed to be fully compliant with all laws and regulations governing data collection and use, including the Personal Data (Privacy) Ordinance of Hong Kong,” the representative said.
Proof of personhood
Worldcoin has big backers in its corner.
Tools for Humanity, a venture that acts as the lead developer of the Worldcoin project, has raised $240 million from top shelf venture capitalist firms such as a16z, Tiger Global, and Coinbase Ventures.
In March, Portugal temporarily prohibited the Worldcoin Foundation from collecting biometric data after saying it had received complaints that underage volunteers had been scanned.
Spain has also temporarily banned Worldcoin from operating in the country, citing privacy concerns, while authorities in Germany, the UK, and France are also investigating the project.
Yet Hong Kong’s watchdogs appear to have executed the most comprehensive probe and prohibition of the venture, including the use of covert visits by investigators.
Six violations
Between December and January, they used warrants to raid six premises involved in the operation of the Worldcoin project and found the same number of violations.
Officials argued that because those operating Worldcoin’s iris scanners were already in a position to verify the humanness of volunteers, the collection of biometric data was unnecessary.
“Taking into account biometric data is sensitive personal data, any wrongful disclosure or leakage of such data could lead to grave consequences,” the PCPD said.
‘Worldcoin failed to provide adequate information to participants.’
— Hong Kong privacy officials
The PCPD also considered that Worldcoin had unfairly collected participants’ data.
Officials said device operators did not confirm volunteers’ understanding of a privacy notice and biometric data consent form.
It also did not inform them of potential risks to disclosing biometric data, and did not confirm volunteers were over the age of 18 before scanning their irises.
“Worldcoin failed to provide adequate information to participants to enable them to make an informed choice or give real consent,” the PCPD said.
The PCPD also said Worldcoin was not justified in retaining biometric data for a maximum of 10 years, “merely for the purpose of training AI models for the user verification process.”
A complaint also called into question the legitimacy of Worldcoin’s Proof of Personhood system.
While Worldcoin uses biometric data to prove a volunteer’s uniqueness, the software isn’t perfect.
In 2022, Worldcoin discovered an exploit that operators used to fool the iris scanners into creating multiple signups for the same person, Forbes reported.
Suspected errors
Additionally, Worldcoin’s biometric data consent form said that Worldcoin’s software might mistakenly conclude that someone had already signed up before.
The PCPD said Worldcoin did not have means for volunteers to report suspected errors.
“The PCPD therefore considered that participants did not have the means to exercise their data access and correction rights.”
The PCPD said Worldcoin confirmed that there were 8,302 individuals with their faces and irises scanned for verification during its operation in Hong Kong.
Update, May 23: This article was updated to include a response from the Worldcoin Foundation.
Tim Craig is DL News’ Edinburgh-based DeFi Correspondent. Reach out with tips at tim@dlnews.com.
