Worldcoin may not be legal in Colombia, but that’s not stopping it

On the day Tools for Humanity (TfH) — the company co-founded by Sam Altman to support the biometric cryptocurrency project Worldcoin — launched its operations in Colombia, it hosted two flashy events to give journalists and crypto enthusiasts an exclusive look at its controversial iris-scanning orbs.

The events were part of the team’s lobbying efforts to convince Colombian authorities and the news media that its operations were safe and secure and complied with the country’s laws.

The efforts seemed to work: Within 36 hours of its launch on May 30, 1,000 Colombians got their irises scanned, Martín Mazza, Latin America manager for TfH, told Rest of World. There are now 19 orb locations across four cities: Bogotá, Medellín, Barranquilla, and Cúcuta.

But the authorities are still not convinced.

The day after the orbs launched in Colombia, the Superintendency of Industry and Commerce (SIC), which regulates personal data protection in Colombia, announced that it was launching an investigation into whether Worldcoin adhered to Colombian regulations. The company had not proven that iris scanning “does not entail the collection of sensitive data,” the SIC said. The country’s law defines “sensitive data” as information that can be used to discriminate against a person.

Heidy Balanta, a data protection lawyer in Colombia, is wondering why Worldcoin is still allowed to operate in the country. Meanwhile, TfH told Rest of World that it is planning to grow its network of iris scanning stations across Colombia. According to local authorities, Worldcoin can operate in the country until the SIC’s investigation concludes.

“The SIC was quite a softie,” Balanta told Rest of World . What Colombian authorities have done, she said, “is not the same as what other countries have done,” which is to halt Worldcoin’s operations.

Worldcoin has faced backlash for violating privacy laws in many parts of the world. At least four countries and territories have blocked the company, in some cases only temporarily, after it started operations, and six others have started investigations over its use of personal data. In South America, authorities in Argentina , Chile , and Peru have begun their own inquiries into whether TfH complies with local regulations. In Brazil, where Worldcoin halted operations in 2023, the country’s data protection agency said it would evaluate if an investigation were required.

In Colombia, TfH sought to pave the way for its operation by seeking the services of Orza, a lobbying firm. Orza worked alongside TfH for about two months before the launch date, arranging meetings with authorities and regulators to convince them that the technology was safe and complied with local regulations.

“We proposed the operation should start in Colombia after having a first proactive dialogue with the country’s authorities, so it didn’t take them by surprise,” Gonzalo Araujo, co-founder of Orza, told Rest of World . His team wanted to “demystify the international cases or the supposed prohibitions of operations in some markets, because these things make a lot of noise,” added Araujo.

An early public hint of Orza’s work on behalf of TfH came on May 15. Mauricio Lizcano, Colombia’s Information and Communication Technologies minister, posted a photo on X alongside Araujo and two TfH employees, writing that the technology behind Worldcoin aims to “protect data and avoid digital fraud.”

TfH’s team also met with the SIC before the launch date. “They just wanted to introduce themselves and tell us what they wanted to do,” Grenfieth Sierra, the SIC’s data protection delegate, told Rest of World . “There’s nothing odd about that. It was not part of an investigation.”

These meetings sought to “explain how this technology works and what we do in privacy and security” to data protection authorities, said Mazza.

Araujo, who attended these meetings, said he believed that the authorities listened to TfH with some degree of skepticism but seemed to appreciate the company’s effort to explain its plans.

Others frowned upon TfH’s lobbying efforts. “I think someone’s judgment was clouded … [They said,] let’s do it, without a clue of what they were accepting,” Pilar Sáenz, a researcher from Fundación Karisma, a digital rights organization in Bogotá, told Rest of World.

In mid-June, a few weeks after Worldcoin opened its doors for orb scans in Colombia, the SIC sent a questionnaire and made a visit to Worldcoin as part of its investigation, according to Araujo. The SIC declined to reveal specifics about it, saying it is part of an ongoing legal procedure, and TfH did not respond to questions from Rest of World about the official inquiry.

Colombian law requires companies that process sensitive and personal data to ask for explicit authorization, explain what it will be used for, and not use it for anything else. Data protection experts doubt that Worldcoin’s process, which involves iris scanning for users and an app to validate each person’s identity, complies with these requirements.

“You don’t know how this data will be handed over and what security protocols [are being used],” Germán Realpe, a privacy lawyer, told Rest of World.

Worldcoin says it promptly deletes iris images “without ever leaving the [orb] device” and does not require users to provide their names — but users may hand them over. “Security and privacy are a priority, and I believe ... that we are developing a technology precisely to have a more private and safe internet,” Mazza told Rest of World .

Another concern among experts is whether TfH will have a local branch in the country or if it will run the operation from its headquarters in Germany and the U.S. “You have to look into whether they will be operating in Colombia from ‘a shell,’ and if this will … make it impossible for authorities to, in practice, enforce any measures [against them],” Juan David Gutiérrez, a technology regulation expert and professor at the University of the Andes in Bogotá, told Rest of World .

TfH did not respond to questions from Rest of World about where its Colombian operation will be run from.

One of Araujo’s main concerns is that regulators perhaps don’t understand Worldcoin’s technology yet. “When you don’t have a specific use case, when you can’t tell authorities ‘this is our business model, and this is what we do,’ this sparks fear” in them, he said.

If the SIC inquiry finds TfH responsible for data protection breaches, the company could be fined or ordered to suspend its operation in the country.

People should avoid engaging in anything if they are not sure about what will happen to their data, Sierra said. “Every piece of data collected in Colombia must comply with Colombian law.”

Despite these concerns, long queues have formed at iris-scanning centers in Bogotá.

On a recent Tuesday morning, Worldcoin staff greeted people at one of its registration booths in a mall in Bogotá. “A friend told me it was a way to make bank without investing or paying a deposit,” Camilo Herrán, a college student, told Rest of World . “I wanted to try it out, see what it was like.”

Guillermo Rodríguez, another Worldcoin user who got his iris scanned, had some concerns about his privacy, though they were hardly top of mind for him: He told Rest of World he planned on telling his friends and family to sign up. “They also need the money.” ▰

José Luis Peñarredonda is a technology reporter and editor based in Bogotá, Colombia.