The local arm of the digital identity project World said it will file a motion for reconsideration after the National Privacy Commission (NPC) issued a cease and desist order (CDO) against its developer, Tools for Humanity (TFH), over alleged violations of the country’s data privacy law.
TFH – the entity behind the World App and Orb verification system – was ordered to stop collecting and processing biometric data in the Philippines, including iris scans used in its ‘proof of humanity’ authentication technology.
The NPC said the company’s practices violated the Data Privacy Act of 2012, citing concerns over undue influence, lack of transparency, excessive data collection, and grave risks to users.
‘When consent is compromised by the lure of compensation, it ceases to be a genuine expression of choice,’ said Deputy Privacy Commissioner Jose Amelito S. Belarmino II.
‘The integrity of a Filipino citizen’s biometric data is non-negotiable.’
The commission said TFH offered monetary incentives in exchange for iris scans, failed to provide clear and accessible information about data use, and collected biometric data deemed unnecessary for its stated purpose of verifying that users are human.
It added that continued processing could expose individuals to ‘serious and lifelong risks, including identity theft, fraud, and reputational harm.’
World: We complied with law, decision ‘alarming’
World in the Philippines, however, called the NPC’s decision ‘alarming’ and said it came as a surprise after what it described as a year-long compliance process involving multiple government agencies and privacy experts.
‘This sudden change in interpretation undermines the certainty that legitimate investors rely on when working with Philippine regulators,’ said Ryuji Wolf, a local operator representing World in the Philippines.
‘All these steps were done transparently and in accordance with the Data Privacy Act of 2012,’ Wolf added.
World said it had completed formal registration with the NPC, joined the Department of Information and Communications Technology’s (DICT) Sandbox Program, and coordinated with agencies such as the Cybercrime Investigation and Coordinating Center (CICC) to address AI-related risks.
‘The order comes as a surprise given we worked closely with regulators to ensure that our technology not only meets but exceeds the country’s data protection requirements,’ he said.
Wolf emphasized that the system does not identify individuals and does not collect personal information such as names, addresses, birthdays, or phone numbers.
‘Our system does not identify individuals. It simply verifies that they are unique humans, not bots or AI accounts,’ he said. ‘We don’t store, sell, or purchase biometric data.’
He added that all biometric images are processed locally and deleted within seconds.
Filing motion for reconsideration
Wolf said World will formally contest the NPC’s cease order by filing a motion for reconsideration and ‘avail of all remedies available to it.’
Despite the regulatory setback, the company said it remains committed to working with Philippine regulators to clarify how its system works and show that it complies with the law.
‘World remains committed to working transparently with regulators to clarify the system’s design and demonstrate its full adherence to Philippine law,’ Wolf said.
World said millions of Filipinos have joined its network since it launched locally in February, amid growing concerns over AI-enabled identity fraud. The company added that it employs over a thousand Filipinos in operations, technology, and community outreach roles.
The NPC, meanwhile, stood by its decision, stressing that personal data – especially immutable biometric identifiers like iris patterns – must be handled lawfully, fairly, and transparently.
‘The promise of technology must never come at the expense of human dignity and data protection,’ the NPC said. ‘The NPC will not tolerate practices that exploit socioeconomic vulnerabilities or compromise fundamental data privacy rights in pursuit of business objectives.’
The commission reminded the public to be vigilant when asked to share biometric data and to ensure they are fully informed before giving consent.
It also noted that TFH’s operations had previously been halted in other countries – including Kenya and Hong Kong – over privacy concerns. The NPC said the company failed to exercise due diligence before launching its biometric operations in the Philippines.