São Paulo challenges World ID’s biometric data collection practices

São Paulo’s consumer protection authorities are taking legal action against Tools for Humanity, the company behind World ID, and Amazon AWS Brasil, accusing them of abusive biometric data collection practices targeting vulnerable residents.

The lawsuit alleges that World ID operators scanned the irises of more than 400,000 people in São Paulo in exchange for payments of R$300–R$700 (US$59–$138), concentrating operations in high traffic, low‑income areas near metro stations and Poupatempo units.

Prosecutor Patrícia Leitão argues the scheme exploited socioeconomic vulnerability and failed to provide clear information about how biometric data would be used, transferred abroad or stored on Amazon Web Services infrastructure.

Filed by the Consumer Justice Prosecutor’s Office, the action seeks an injunction that requires the preservation of all data and metadata, disclosure of storage contracts and technical reports, identification of the Amazon entity hosting the information, and an immediate halt to any iris collection involving payments or benefits until a court‑appointed expert review is completed.

Prosecutors want the practice declared abusive and a permanent ban on compensated iris collection, irreversible deletion of all previously gathered data, at least R$240 million in collective compensation, and individual redress for affected consumers.

The case comes from the São Paulo City Council’s Iris CPI, which found that World ID continued offering rewards through its app even after Brazil’s National Data Protection Authority ordered a suspension of financial incentives. Iris CPI in April unanimously approved a report that found Tools for Humanity’s business model had allegedly “operated in serious non-compliance.”

Investigators also concluded that consumers were not adequately informed about the project’s economic model or the risks of biometric processing. Leitão says the conduct amounts to misleading advertising, exploitation of vulnerable consumers and compromised consent.

Amazon Web Services said it requires customers to comply with local laws and disables prohibited content when violations are detected. Tools for Humanity has not commented so far.

Brazil is not the only country where Tools for Humanity has faced punitive action. At the beginning of this year, Thailand’s Department of Special Investigations (DSI) executed search warrants at five locations linked to TIDC, which reportedly represents Tools for Humanity. In November 2005, the National Health Security Office (NHSO) ordered TIDC Worldverse, which represents Tools of Humanity in Thailand, to suspend the collection of iris biometrics and delete biometric data already collected from 1.2 million Thai citizens.

​Tools of Humanity is facing regulatory pushback for collecting biometrics in exchange for crypto in many other jurisdictions, including Indonesia, Spain, Germany, Brazil, Hong Kong, Portugal, Kenya, and South Korea.

Article Topics

biometrics  |  Brazil  |  data collection  |  iris biometrics  |  lawsuits  |  Tools for Humanity  |  World  |  World ID