Sao Paulo consumer protection officials highlighted that World targeted financially vulnerable individuals. They continued this practice despite a directive from Brazil’s data protection authority, the ANPD, to stop offering cryptocurrency in exchange for biometric information.
Key Takeaways
- São Paulo sued World and AWS for exploiting vulnerable populations to collect biometric data for crypto.
- The lawsuit seeks to halt crypto payments and demands $47 million to compensate 400,000 affected consumers.
- Prosecutors allege World ignored a 2025 order to halt payments and hid AWS data storage risks from users.
São Paulo Files Lawsuit Against World and Amazon
The city of São Paulo is challenging Tools for Humanity, the creators of Worldcoin, regarding how they collect people’s biometric data. They are also taking action against Amazon Web Services (AWS), which provides hosting services for Worldcoin.
In a lawsuit filed on Monday by São Paulo’s Consumer Prosecutor’s Office, the office alleges that these two companies were involved in abusive practices related to the collection of biometric data from consumers in São Paulo, deliberately targeting people with socioeconomic vulnerability, and offering financial compensation for this data.
The lawsuit concerns the recent launch of Worldcoin in São Paulo, which is estimated to have involved over 400,000 people. It asks the court to protect all data and information gathered during the sign-up process, and to temporarily halt any payments or rewards connected to the collection of biometric data until a thorough review can be completed.
In this lawsuit, we’re aiming to legally define these practices as abusive to consumers. We’re also seeking 240 million reais – which is close to $47 million – as compensation to cover the losses individuals have experienced.
A report by the Iris Parliamentary Commission of Inquiry (CPI) found that several irregularities were committed during the action of World in São Paulo, including the deliberate concentration of their offer in peripheral and high-traffic regions to attract people facing socioeconomic issues to deliver their biometric data for a crypto reward.
In addition, the public prosecution claims that the company continued to deliver these crypto rewards using internal app transactions even after the National Data Protection Authority (ANPD) ordered their termination in February 2025, and that consumers were not informed about the economic purpose of the project or the risks regarding the processing and storage of their data using AWS servers.
World states that it doesn’t gather, save, or share any personal information, even iris scans, and people who verify their identity with World ID remain anonymous.
Similar issues have occurred before, such as in Argentina, where the company was fined $200,000 for breaking consumer protection laws. These violations included letting children sign up without proper ID verification and not clearly explaining how it collects and uses biometric data.
2026-07-24 02:27