Key Takeaways
- São Paulo sued World and AWS for exploiting vulnerable populations to collect biometric data for crypto.
- The lawsuit seeks to halt crypto payments and demands $47 million to compensate 400,000 affected consumers.
- Prosecutors allege World ignored a 2025 order to halt payments and hid AWS data storage risks from users.
São Paulo Files Lawsuit Against World and Amazon
São Paulo has taken action against Tools for Humanity, the company behind World (formerly known as Worldcoin), for its biometric collection activities, and against Amazon AWS for its role as World’s hosting provider.
In a lawsuit filed on Monday by São Paulo’s Consumer Prosecutor’s Office, the office alleges that these two companies were involved in abusive practices related to the collection of biometric data from consumers in São Paulo, deliberately targeting people with socioeconomic vulnerability, and offering financial compensation for this data.
The lawsuit, which estimates that over 400K people participated in World’s Sao Paolo rollout, petitions for the preservation of all data and metadata linked to the collection of this information, and for suspending any payment or benefit linked to biometric data collection until an assessment is carried out.
The legal action seeks to label these activities as abusive and receive a payment of 240 million reais (nearly $47 million) in compensation for the consumers’ individual losses.
A report by the Iris Parliamentary Commission of Inquiry (CPI) found that several irregularities were committed during the action of World in São Paulo, including the deliberate concentration of their offer in peripheral and high-traffic regions to attract people facing socioeconomic issues to deliver their biometric data for a crypto reward.
In addition, the public prosecution claims that the company continued to deliver these crypto rewards using internal app transactions even after the National Data Protection Authority (ANPD) ordered their termination in February 2025, and that consumers were not informed about the economic purpose of the project or the risks regarding the processing and storage of their data using AWS servers.
On its page, World explains that it “does not collect, store or sell any personal data, including iris data, and verified World ID holders are anonymous.”
World has already faced similar actions in Argentina, where it was hit with a $200K fine for various National Consumer Defense Law violations, including allowing minors to enroll in the initiative due to lax ID checks and failing to disclose its biometric data-processing procedures.
