World Orb Operations Temporarily Paused in Germany Following GDPR Compliance Order

The controversial identity verification project World, co-founded by Sam Altman, has suspended its iris-scanning operations, known as “Orbs,” in Germany effective immediately.

Existing Orb stations across the country now display a message indicating services are down.

Orbs are basketball-sized, silver scanning devices deployed in locations like malls, convenience stores, and galleries. They register users’ identities by scanning irises, converting the information into a unique iris code that forms the basis of a WorldID credential. This digital identity then connects users to the World ecosystem, including their crypto wallet (WorldApp) and decentralized finance applications on the World Chain protocol.

According to World’s website, users are informed that “Orbs will return soon.” The company declined comment on an estimated timeframe for resuming operations.

The WorldID Vision and its Funding

The project, founded in 2019, aims to create a biometric-based digital identity system. Its premise is that distinguishing humans from sophisticated bots—potentially including AI systems like ChatGPT—will become increasingly difficult, making verifiable identity crucial online.

This ambitious project has secured backing from prominent venture capital firms, including a16z crypto and Bain Capital Crypto.

Earlier this year, in May 2024, World raised $135 million in a token sale primarily benefiting early investors. Current data from DefiLlama shows the platform’s World Chain maintains a Total Value Locked (TVL) exceeding $53 million.

World emphasizes user incentives, allowing participants to earn cryptocurrency rewards (WLD tokens) both for scanning their irises and for referring others to do so. Operators of third-party Orb stations earn shares of this bounty.

GDPR Enforcement and Data Privacy Issues

The suspension follows a lengthy legal challenge with Germany’s Bavarian State Office for Data Protection (BayLDA). This office began investigating World in 2022 over its collection and handling of sensitive biometric data, explicitly citing concerns under Europe’s General Data Protection Regulation (GDPR).

In December 2024, BayLDA rendered a decision criticizing the project, citing non-compliant handling of biometric data. A detailed 132-page enforcement order found that World had violated GDPR and ordered the deletion of all collected iris codes.

The data protection authority specifically identified that World stored “plain-text” iris codes in an unencrypted database from July 24, 2023, until May 14, 2024.

International Repercussions

Similar privacy concerns led data authorities in Spain and Portugal to suspend World’s operations in their jurisdictions during 2024, citing complaints that minors were being scanned.

Notably, World quietly relaunched operations in Portugal this year, amidst ongoing regulatory discussions.

World’s Response and Mitigation Tries

World has disputed BayLDA’s findings and lodged an appeal with the District Court of Ansbach in December 2024. Importantly, the company’s appeal process does not necessitate immediate cessation of operations, unlike the data authority’s enforcement order.

To comply partially with the data protection concerns raised during the investigation, World announced the implementation of encryption earlier this year. The company began storing iris scans across multiple encrypted servers operated by academic institutions (UC Berkeley and University of Erlangen-Nuremberg) and blockchain providers (Nethermind). The stated objective is to prevent the reconstruction of individual identities from the stored data.

A spokesperson explained the technical modifications allow “for the iriscodes to be used in a distributed manner without revealing personally identifiable information.” An evaluation by external scientists is requested to assess the effectiveness of this approach.

Ongoing Legal Battle and Uncertain Future

Despite these technical adjustments, the company faces a significant regulatory hurdle. Representation notes that the first court hearing in the appeal process is expected within around one year. Resolution remains contingent on the Bavarian court’s review of the BayLDA’s findings.

The company’s inability to immediately delete the controversial biometric data and the duration of the legal process create significant uncertainty.