Why the NPC Ordered World to Stop Iris Scans in PH, and Why the Company Plans to Appeal

Disclaimer: This article is for informational purposes only and does not constitute financial advice. BitPinas has no commercial relationship with any mentioned entity unless otherwise stated.

📬 Get the biggest crypto stories in the Philippines and Southeast Asia every week — subscribe to the BitPinas Newsletter.

The National Privacy Commission (NPC) has issued a Cease and Desist Order (CDO) against Tools for Humanity (TFH), the developer of the Worldcoin project, halting all of its data processing activities in the country.

The 66-page order (available for viewing at the end of the article), dated September 23, 2025, concludes a multi-month investigation which found the company’s practices to be in violation of Republic Act 10173, or the Data Privacy Act of 2012. The project involved scanning the irises of Filipino citizens using a device called the “Orb” in exchange for a digital identity and Worldcoin (WLD) cryptocurrency.

This article contains a summary of the 66 page decision from the NPC and the submitted rebuttal of a World representative to a local publication. Everything stated in this article is lifted from the decision and the comments of the World representative in an online interview.

NPC Findings

NPC Finds Consent Process Legally Invalid

According to the NPC’s findings, the consent obtained from Filipino users was not legally valid for several reasons. The commission ruled that the monetary incentive offered in the form of WLD cryptocurrency created “undue financial pressure,” thereby compromising the requirement that consent be “freely given.”

Advertisement

The order cites sworn affidavits from users, including one who stated, “The only reason that drew me to register was the promise that I would get money or an incentive.” This is viewable in the local language below:

The NPC also determined that the consent was not properly informed. The decision describes a process where users were presented with a lengthy and technical 29-page Privacy Notice immediately before their iris scan, providing inadequate time for comprehension:

Data Collection Deemed Excessive by Commission

The order states that the collection of immutable biometric data, specifically iris scans, was “excessive and not proportional” to the stated goal of “proof of personhood.” The NPC argued that less intrusive methods were available and that TFH had not sufficiently justified the necessity of its chosen method under the Data Privacy Act.

• One proof of personhood that the NPC stated was the fact of the person’s physical presence at the registration could verify that a person is a person and not a bot.

NPC Cites Unproven Deletion Claims and Contradictory Evidence

A central issue in the decision was TFH’s claim that all biometric data is deleted from its Orb device within seconds. The NPC found this claim to be unsubstantiated, noting that TFH failed to provide any technical proof.

The order further cites a security audit report submitted by TFH itself, which stated:

The commission also pointed to a contradiction in TFH’s documents, where a consent form mentioned a potential data retention period of up to ten years for “Image Data,” conflicting with public statements about immediate deletion.

Order Justified by Risk of ‘Grave and Irreparable Injury’

The NPC justified the immediate issuance of the shutdown order by citing the risk of “grave and irreparable injury” to data subjects. The decision explains that unlike a password, a person’s biometric data is permanent, and its compromise could lead to lifelong harm from identity theft and fraud.

The order is immediately executory and commands TFH to stop all Orb scanning, remove the World App from Philippine app stores, and cease transferring any data already collected.

World Local Operator: Order is a Surprising Reversal Following Change in Leadership

In a statement released Thursday, Ryuji Wolf, the local operator representing World described the NPC’s order as a “surprising reversal” and a “setback for responsible digital innovation,” confirming they will file a motion for reconsideration.

The company highlighted its work with other government agencies, such as the Department of Information and Communications Technology (DICT), and suggested the NPC’s decision was an alarming “shift in position” following a change in the commission’s leadership.

World Local Operator: Company is in Full Compliance of the Law

Wolf further asserted that the company acted in full compliance with the law:

“All these steps were done transparently and in accordance with the Data Privacy Act of 2012. The order comes as a surprise given we worked closely with regulators to ensure that our technology not only meets but exceeds the country’s data protection requirements.”

Wolf reiterated the company’s technical claims, stating that the system is designed to protect users from fraud and identity theft:

“Our system does not identify individuals. It simply verifies that they are unique humans, not bots or AI accounts. We don’t store, sell, or purchase biometric data.”

The filing of the Motion for Reconsideration will require the NPC to review its decision in light of the arguments presented by Tools for Humanity.

Full Copy of the NPC Decision

This article is published on BitPinas: Why the NPC Ordered World to Stop Iris Scans in PH, and Why the Company Plans to Appeal

What else is happening in Crypto Philippines and beyond?