Hong Kong slams Worldcoin for violating privacy laws with excessive facial recognition scans

The Worldcoin cryptocurrency project, set up by OpenAI chief Sam Altman, breached Hong Kong’s privacy laws by demanding “unnecessary and excessive” scans of users’ eyes and faces, the city’s privacy watchdog said Wednesday.

Worldcoin launched last July and seeks to give users a private digital identity – a “World ID” – after scanning their unique iris patterns, but it has run into trouble in some countries over concerns about the use of users’ personal data.

Hong Kong’s Privacy Commissioner for Personal Data (PCPD) said an enforcement notice had been issued telling the project to stop scanning and collecting iris and face images in the city.

More from World

Nepal's new PM pays homage to people died during the Gen Z protest in her first national address This Week in Explainers: How recovering from Gen-Z protests is a Himalayan task for Nepal

“The collection of face and iris images for (verification) purpose was not necessary, and excessive,” the PCPD said in a statement, adding that data leaks could lead to “grave consequences”.

More than five million people have a “World ID” and 137 million of the project’s crypto tokens have been claimed in more than 160 countries, Worldcoin said last month.

Its operation in Hong Kong had scanned the faces and irises of more than 8,000 people, the PCPD said.

The privacy watchdog said Worldcoin breached multiple Hong Kong rules on the purpose and manner of data collection, and showed insufficient transparency.

Impact Shorts

More Shorts

‘The cries of this widow will echo’: In first public remarks, Erika Kirk warns Charlie’s killers they’ve ‘unleashed a fire’

Trump urges Nato to back sanctions on Russia, calls for 50–100% tariffs on China

Failing to comply with an enforcement notice can be punished with a maximum fine of HK$50,000 ($6,400) and two years in prison.

Users were not given enough information to “make an informed choice or give real consent”, the PCPD said, adding that Worldcoin’s plan to retain data collected for up to 10 years was “prolonged” and “not justified”.

The PCPD said its investigation involved 10 covert visits to six Worldcoin locations in Hong Kong beginning in December, followed by searches with court warrants.

AFP has contacted Worldcoin for comment.

The crypto project has been suspended over privacy concerns in countries such as Spain, Portugal and Kenya but it maintains that the personal data collected is encrypted and safe.