China Warns Foreign Crypto Project Over Iris Data Security Risks

China has issued a warning against a foreign cryptocurrency project it alleges collects users’ iris scans in exchange for tokens, citing concerns over privacy violations and national security risks. According to the advisory from the China’s Ministry of State Security, the practice involves transferring sensitive biometric data overseas, which could enable potential threats such as identity theft and espionage [1]. While the advisory does not name the firm, the described model aligns with that of the project known as World (formerly Worldcoin), which launched in 2023 to verify human users through iris scanning and issue WLD tokens in return [1].

Iris scans are considered uniquely sensitive as the data is permanent and can be traced back to individuals indefinitely. Chinese officials emphasized that the misuse of such data by intelligence or unauthorized entities could pose long-term risks to individuals and the nation’s security [1]. This concern is shared by regulators in other countries, where similar projects have faced legal scrutiny. In Europe, Spain and Germany enforced strict data protection laws under the GDPR. Spain’s data authority ordered the deletion of iris records from approximately 400,000 individuals, while Germany mandated that the project erase all stored data by early 2025 and improve user consent mechanisms [1].

In Africa and Asia, regulatory actions have also been taken. Kenya’s High Court paused new registrations and ordered the deletion of iris data until a data protection assessment is completed, while also banning crypto incentives tied to biometric scanning. Indonesia halted operations in May 2025 over compliance and user consent issues. Brazil has banned the project entirely since January 2025 due to consent violations [1]. These moves reflect a growing global consensus that biometric data linked to cryptocurrency must be subject to strict legal oversight.

World, the project at the center of the controversy, has responded by stating it deletes raw iris images immediately after scanning, retaining only an encrypted identifier. The company claims it allows users to control or delete their data, and has open-sourced its code and conducted third-party audits. Project co-founder Sam Altman emphasized at a recent event that no biometric data is stored centrally and that the system could be used for digital identity, universal basic income (UBI) delivery, and fraud prevention in AI platforms [1].

Despite these assurances, critics argue that even encrypted identifiers can be traced back to individuals if metadata or operator data leaks. Additionally, consent systems in lower-income regions may be compromised, as users might accept crypto rewards without fully understanding the implications of data sharing [1]. European data regulators have reinforced this point, stating that iris data must be erasable upon user request and that consent must be clear and verifiable [1].

China’s timing of the warning is also significant. The country has been tightening its stance on cryptocurrency, having already banned mining, trading, and holding. In May 2025, it extended the ban to private ownership of major cryptocurrencies including Bitcoin and Ethereum, promoting instead its state-backed digital yuan [1]. The new warning suggests a broader regulatory strategy to manage identity-linked crypto projects and prevent the spread of systems that could undermine national security.

Privacy advocates have highlighted the centralization risks and data leak potential in systems like Worldcoin. One German data regulator stated, “We enforce European fundamental rights standards… All iris data must be erasable upon withdrawal of consent” [1]. These statements underscore that regulators view such projects not merely as technological innovations, but as legal and ethical flashpoints requiring careful scrutiny.

Users are advised to critically assess any biometric data collection projects by asking key questions: who collects the data, where is it stored, can it be deleted, and was the consent informed and verifiable [1]. As global regulations continue to evolve, transparency, user control, and compliance will become essential factors for the legitimacy and future viability of such initiatives.

Source: [1] China Accuses Foreign Crypto Project of Surveillance via Iris Scanning (https://thebitjournal.com/china-crypto-surveillance-iris-scan-crackdown/)