Colombia’s Superintendence of Industry and Commerce (SIC) has formally notified Worldcoin and its parent company, Tools for Humanity, of alleged violations of the country’s personal data protection laws. The decentralized identity project is currently collecting biometric data from individuals using its Orb device in 25 locations across Colombia.
In a statement released Tuesday, the SIC outlined the details of its investigation, marking the first formal notice of potential infractions. The notification is a preliminary step and does not yet constitute a formal accusation. “The purpose of the proceedings is to determine whether the investigated companies have infringed the Colombian personal data protection regime in the collection of sensitive personal data in relation to the implementation of personal data processing policies and privacy notices,” the SIC said.
Worldcoin’s Orb device is being used to collect biometric data in multiple Colombian cities, including Bogotá, Medellín, Cartagena, and Barranquilla. The regulator’s action comes amid rising concerns over how sensitive personal data is being handled by the project, which aims to create a decentralized digital identity network using unique biometric identifiers.
If found guilty of violating Colombian data protection laws, Worldcoin could face severe penalties, including economic sanctions, a temporary suspension of operations for up to six months, or even a permanent shutdown in the country.
This is not the first time Worldcoin has faced scrutiny in Latin America. In August 2023, the Argentine Agency for Access to Public Information (AAIP) initiated an inquiry into the legality of Worldcoin’s data collection practices. Similarly, Ecuador’s central bank issued a warning that “crypto assets are not a currency” shortly after Worldcoin began operations in the country.
The investigation in Colombia reflects growing global concerns about Worldcoin’s data collection methods and the broader implications for personal privacy and data security. As the case unfolds, it could set a precedent for how similar digital identity initiatives are regulated in the region and beyond.
