In Just One Month, Worldcoin Successfully Resolves Compliance Challenges
Worldcoin, the crypto project founded by OpenAI co-founder Sam Altman, recently announced that it would open 50 outlets in more than ten cities across Argentina, including two experience stores. However, just one month prior, Worldcoin’s operations in Argentina were mired in controversy, with various parties in Argentina accusing or alleging that Worldcoin’s operational model seriously infringed upon user privacy and violated Argentina’s data privacy laws, thrusting Worldcoin into the spotlight.
*Source: Screenshot from Worldcoin’s official social media
Unlike other crypto projects, Worldcoin’s operations are heavily dependent on its offline outlets. Precisely because of this distinctive feature, Worldcoin has faced significant obstacles in its global operations. Similarly, Worldcoin previously encountered regulatory hurdles in numerous countries and regions worldwide, including Kenya, France, Germany, Spain, and Hong Kong, China, where it faced regulatory challenges in each jurisdiction.
So, did Worldcoin’s sudden turnaround within a mere month signify that it has resolved its regulatory issues in Argentina? Can Worldcoin’s model in Argentina be replicated in other countries? Has Worldcoin, long subject to controversy, truly found its path forward? First, let Mankun Law Firm’s attorneys review the regulatory challenges Worldcoin faced in Argentina and analyze the reasons behind the widespread criticism.
 

Criticism of Worldcoin in Argentina

Worldcoin is a crypto enterprise co-founded by OpenAI CEO Sam Altman, with the vision of “building a comprehensive global financial and identity network.” In Web2, identity verification typically relies on methods such as fingerprint or facial recognition. In contrast, Worldcoin uses iris scans as the medium, aiming to bring digital identity verification into the Web3 world. To achieve this goal, Worldcoin employs its proprietary Orb device: the Orb is a specialized iris-scanning and imaging device developed by Worldcoin. Through this device, Worldcoin has established offline scanning points globally to scan users’ irises and complete identity binding. Users who complete the binding process receive a unique WorldID and are eligible to receive WLD tokens valued at USD 50.
However, Worldcoin’s operations have not been smooth from the outset. Regarding its operations in Argentina, Worldcoin entered the Argentine market as early as last year. Subsequently, an Argentine lawyer filed a complaint alleging that Worldcoin violated data privacy laws, prompting Worldcoin to suspend its operations in Mendoza Province. As late as March 2024, officials in Buenos Aires Province, Argentina, continued to criticize Worldcoin for failing to address specific concerns regarding “abusive clauses” in its terms and conditions. At that time, Worldcoin potentially faced fines of up to 1 billion Argentine pesos (approximately USD 1.075 million). Furthermore, Worldcoin’s scanning of minors’ iris and facial data in Argentina drew substantial criticism and accusations against the project.
At that time, Worldcoin stated that it would “seek opportunities to engage with government agencies, regulators, and third parties, and respond to any questions they may raise.”
 

Worldcoin Faces Global Regulatory Scrutiny

Similar to its situation in Argentina, Worldcoin has encountered varying degrees of regulatory obstacles in multiple countries due to privacy concerns related to its collection of iris data. Even in countries that are generally receptive to crypto assets, Worldcoin has not been exempt from scrutiny. Below, Mankun Law Firm’s attorneys summarize the regulatory controversies surrounding Worldcoin:
  • Kenya: Kenya was among the first countries to launch Worldcoin registration and verification. However, the Kenyan government later issued a ban, suspending Worldcoin’s registration and verification activities. In a statement, the Kenyan Ministry of Interior indicated that it would “immediately suspend Worldcoin activities until relevant government agencies demonstrate that there are no public risks.”
  • France: The French National Commission on Informatics and Liberty (CNIL) has raised concerns regarding Worldcoin’s methods of collecting biometric data and has launched an investigation to ensure that its activities comply with French and European data protection regulations.
  • Germany: The Bavarian State Office for Data Protection Supervision in Germany has expressed concerns about Worldcoin’s large-scale processing of biometric information, stating that these technologies are “neither mature nor sufficiently analyzed with respect to the specific core purpose of processing financial information.”
  • Spain: The Spanish Data Protection Agency (AEPD) ordered Worldcoin to cease the collection and processing of data in Spain and issued a three-month interim ban, citing an ongoing investigation into complaints that Spanish users were unable to withdraw consent and that Worldcoin was allegedly collecting data from minors.
  • Hong Kong: Privacy Commissioner for Personal Data, Ada Chung, issued an enforcement notice to Worldcoin, ordering the immediate cessation of all project operations in Hong Kong involving the scanning and collection of public iris and facial images using iris-scanning devices. The Office of the Privacy Commissioner for Personal Data (PCPD) began investigating the Worldcoin project in January 2024 to determine whether this authentication method poses serious risks to citizens’ personal information privacy and violates the requirements of the Personal Data (Privacy) Ordinance.
In the face of various regulatory challenges, how should Worldcoin respond? Mankun Law Firm believes that its strategy of actively resuming business operations in Argentina offers valuable lessons.
 

Worldcoin’s Proactive Measures

Against the unique favorable premises and background in Argentina, Worldcoin demonstrated its adaptability by successfully resolving the crisis through a series of strategies.

Favorable Premise: Milei’s “Chainsaw Reforms”

At the end of 2023, Argentina welcomed a new president known for his boldness—Javier Milei. Within just six months of taking office, this ambitious leader enacted a series of regulations dubbed “chainsaw reforms” by external observers, including incorporating crypto assets as a significant component of the reforms.
Late last year, Argentine Foreign Minister Diana Mondino pointed out that the Argentine government was preparing a decree that would, under specific conditions, permit the use of Bitcoin and other tokens for lawful payments in the country. This development has been particularly notable in recent years. The continuous depreciation of the peso, severe exchange rate fluctuations, and strict government restrictions on the market have gradually made crypto assets an alternative choice for savings and investment among the Argentine public. Such a policy environment has provided uniquely advantageous conditions for Worldcoin to conduct business locally.

Proactive Reform: Efforts Made by the Worldcoin Project Team

How did Worldcoin’s operations make a “comeback” in Argentina? To clarify this issue, we must first understand the points of contention for which Worldcoin faced criticism in Argentina:
  • Privacy and data protection: Under Argentina’s Personal Data Protection Law No. 25,326 (the “PDPL”) and related provisions, the data controller is obligated to register its databases with the Agency for Access to Public Information (AAIP), provide information on its processing policies, specify the purposes for which it requires sensitive data and the duration of processing, safeguard such information, and set out in detail the security and confidentiality measures implemented to protect personal information;
  • General consumer protection: The Government of the Province of Buenos Aires alleged that Worldcoin incorporated unfair terms into its user agreement, which may have infringed consumer rights. These terms included provisions allowing service interruption without compensation, requiring users to waive their right to participate in class actions, and designating California as the seat of arbitration;
  • User data violations: Worldcoin was also accused of deficiencies in preventing minors from registering, processing users’ iris data in Brazil, and storing private data pertaining to Argentine users. These practices were deemed to violate applicable rules governing the use, protection, and storage of user data.
In the wake of heightened scrutiny of Worldcoin in Argentina, the project team responded promptly by actively aligning with Argentine regulatory requirements and implementing corresponding remedial measures:
  • First, Worldcoin committed to continuing its cooperation with regulators to ensure that its project meets all regulatory requirements and provides safe and transparent services to users. The company emphasized its commitment to privacy and data protection and stated that it would cooperate with government authorities and regulators by providing further information on its privacy and data protection practices.
  • Worldcoin stated that it has been undertaking technical improvements, particularly in the areas of data processing and user privacy protection. These efforts include enhancing data protection measures in its identity verification process and ensuring that sensitive biometric data (such as iris scan data) is deleted after use to avoid storing such highly sensitive personal information.
The specific technical solutions include:
  • Amended privacy terms that allow users to revoke the verification of their World ID by permanently deleting their iris code;
  • The addition of supplementary provisions to its privacy policy establishing a dedicated entity in Argentina to handle complaints and claims from Argentine users;
  • An updated clause expressly stating that services will not be provided to individuals under 18 years of age, and the establishment of a channel for deleting records of minors who had already registered, through which the affected individuals and their guardians may request the deletion of relevant data retained by Worldcoin;
  • In accordance with the requirements of Argentine regulatory authorities, publishing a Spanish-language version of its privacy policy on its official website and making targeted adjustments to certain provisions therein.
Through these reforms, Worldcoin achieved a significant turnaround in Argentina, gaining recognition from the Argentine government and successfully establishing 50 operational sites across more than ten cities. Indeed, such scenarios are common in the crypto assets and Web3 industries; for example, Mankun Law Firm has previously discussed one of the games in the TON ecosystem, “Hamster Kombat has sparked widespread attention and controversy in Iran. So, for Web3 projects and entrepreneurs, how should crypto projects carry out compliance prevention and adjustments in the face of government regulation?
 

Insights from Worldcoin’s Counterattack

Mankun Law Firm believes that the experience brought by Worldcoin has served as an extremely important reference for many project parties in the Web3 sector, especially entrepreneurs in the DID and DePIN tracks. We believe that the following two types of risks are issues that entrepreneurs and project parties in these two fields should jointly pay attention to:
  • Privacy protection issues.One of the main issues Worldcoin faces in Argentina and other countries is the protection of personal information. For decentralized identity (DID) and decentralized physical infrastructure networks (DePIN) projects in the Web3 sector, privacy protection is also a crucial challenge.
  • Cross-border data transfer issues.For Web3 projects, especially in the DID and DePIN sectors, the issue of cross-border data transfer is particularly prominent. Different countries have different regulatory requirements for cross-border data transfer, and project parties need to fully understand and comply with relevant laws.
Regarding the above two issues, Mankun Law Firm advises project parties to make sufficient compliance preparations and emergency measures in both ex ante and ex post aspects to protect business operations:

Processing and Storage of Sensitive Data

DID projects involve legal issues in the field of digital identity authentication, and project parties will inevitably come into contact with users’ highly sensitive personal information, such as personal identity, residential address, bank account details, and even identity data such as fingerprints and iris scans. The collection, storage, and processing of such data require a high level of security and transparency. Project parties must ensure that data is not abused during the collection and use process, and must clarify users’ right to know and right to consent. Similarly, in DePIN projects, some DePIN devices may collect relatively sensitive sensor data or user behavior data; in such cases, strict privacy protection standards must also be followed. Regarding the processing and storage of sensitive data, Mankun Law Firm believes that compliance risks can be reduced through the following business arrangements:
  • Transparency in Data Collection.Project operators must clearly disclose to users the purposes of data processing, retention periods, and handling methods. This not only helps enhance user trust but also complies with data protection regulations in various jurisdictions.
  • Principle of data minimization.Collect only the minimum data necessary to provide the service, avoiding excessive collection of personal information. DePIN projects should pay particular attention to collecting only data directly related to IoT services.
  • Security measures.Adopt state-of-the-art encryption technologies and data protection measures to ensure the security of sensitive data during transmission and storage. For DePIN projects, this includes ensuring that sensor data is not stolen or tampered with during collection and transmission.
  • User consent mechanism.Clearly inform users of the purposes of data processing before data collection and obtain their explicit consent. For DID and DePIN projects, this means ensuring that users fully understand how their data will be used before such data is collected and processed.
  • Data access and deletion.Provide users with means to access their data and allow them to delete their data when necessary, ensuring that users can control the data collected by their devices.

Compliance with cross-border data transfer

Project operators must ensure that cross-border data transfers comply with the laws and regulations of all relevant jurisdictions. For example, the European Union’s General Data Protection Regulation (GDPR) imposes strict requirements on cross-border data transfer. China has also enacted the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, the Personal Information Protection Law of the People’s Republic of China, the Measures for the Security Assessment of Cross-Border Data Transfer, and other relevant laws and regulations to establish the legal framework for cross-border data transfer. For DID and DePIN projects, which involve highly sensitive identity data and sensor data, greater caution is required in cross-border transfers, and strict compliance with local regulations is essential. Mankun Law Firm offers the following recommendations:
  • Localized data storage.Where feasible, consider establishing localized data storage facilities in the user’s country of residence to reduce the complexity and risks associated with cross-border data transfer. For DID projects, this can effectively mitigate compliance risks arising from cross-border data transfers.
  • Transparent user agreements.Clearly set forth provisions relating to cross-border data transfer in the user agreement to ensure that users understand and consent to the potential transfer of their data to other countries. DePIN projects may provide detailed descriptions in the agreement of the processes for cross-border data transfer and processing.

Ongoing Compliance and Post-Incident Response

As an emerging industry, Web3 has attracted many idealistic, innovative, and passionate entrepreneurs over the past decade who have undertaken substantial innovation and bold experiments. However, due to the rapid development of the industry, laws and regulations have often lagged behind, resulting in numerous conflicts. At the commencement of operations for many projects, the relevant legal frameworks were either incomplete or entirely absent, and regulatory challenges frequently arose only after a period of operation. In such circumstances, how should project operators respond? Mankun Law Firm advises as follows:
  • Proactively maintain communication with local regulatory authorities.After encountering regulatory risks in Argentina, the Worldcoin project team engaged in repeated communications with regulatory authorities, striving to maintain dialogue, adjusting its privacy policy and user agreement, and prohibiting minors from undergoing iris scans at operational sites. Coupled with the Argentine government’s relatively positive stance toward the crypto world, these measures enabled the project to resume operations. Notably, prior to the completion of this article, the Kenyan government also eased its regulatory restrictions on Worldcoin.
  • Conduct regular compliance reviews.During business operations, conduct regular compliance reviews to ensure ongoing adherence to the latest legal requirements. In the face of an ever-changing regulatory environment, maintaining flexibility and foresight, and timely adjusting operational strategies, constitute important strategies for Web3 project operators.
  • Promptly respond to regulatory requirements and prepare remedial measures.When confronted with new regulatory requirements or sudden compliance issues, project operators should take prompt action to make adjustments. Examples include amending user agreement terms, enhancing data protection measures, or suspending certain business activities to comply with new regulations. Where compliance issues result in impairment of user rights and interests, project operators should promptly implement remedial measures and provide appropriate compensation to preserve user trust and the company’s reputation.
  • Seek professional legal advice and compliance guidance.Legal advice provided by qualified lawyers can help project sponsors make sound decisions on legal and regulatory matters, thereby mitigating risks. Mankun Law Firm hereby reminds Web3 startup teams to promptly consult qualified lawyers for legal advice and compliance guidance when encountering compliance issues during their operations.

References

1.https://whitepaper.Worldcoin.org/#a-new-identity-and-financial-network

2.https://finance.eastmoney.com/a/202405283089356552.html

3.https://medium.com/@shixiangyyds/%E4%B8%96%E7%95%8C%E5%B8%81-wld-

%E5%8A%A0%E5%AF%86%E8%B4%A7%E5%B8%81-f9a47625d937

4.https://www.coinlive.com/zh/news-flash/490891

5.https://restofworld.org/2024/Worldcoin-argentina/zh/

6.https://www.thepaper.cn/newsDetail_forward_26730945

7. https://www.voachinese.com/a/7593022.html

8.https://www.bbc.com/zhongwen/simp/science-66298854

9.https://cnad.gob.sv/the-national-commission-of-digital-assets-cnad-of-el-salvador-and-the-national-securities-commission-cnv-of-argentina-strengthen-collaboration-in-digital-assets-2/https://cn.cryptonews.com/news/argentina-lawmaker-unveils-draft-Worldcoin-regulation-bill.htm

10.https://www.panewslab.com/zh/sqarticledetails/fi9ku5qw.html

11.https://vault.pactsafe.io/s/8a18d792-fd76-44db-9b92-b0bb7981c248/legal.html#contract-byutjvtyt

Special Disclaimer:

This article is an original work of Mankun Law Firm. It reflects only the personal views of the author(s) and does not constitute legal consultation or legal advice on any specific matter.

 

Recommended Reading

Web3 Lawyer: Recommends that the Government Adjust the Ban on Virtual Currency Mining in a Timely Manner

Web3 Paid Knowledge Services and Education-and-Training Startups: How to Ensure Legal Compliance?

Current Status and Prospects of OTC Crypto Asset Trading Regulation in Hong Kong (China), Singapore, and the United States

{loadmoduleid 245}