World App's Massive Iris Scan Raises Safety Questions

In the past two months, residents of Bekasi, West Java, have been swept up in a frenzy over iris scans offered through the cryptocurrency application World App. Tools for Humanity (TFH), the developer behind the app, has been offering cash incentives ranging from IDR 200,000 to IDR 800,000 to anyone willing to have their eyes scanned.

World App is the official digital wallet of the Worldcoin crypto ecosystem. The application was developed by TFH, a company founded by Sam Altman, Alex Blania, and Max Novendstern. The overarching vision of this platform is to build a global digital economy network based on verified human identity.

According to World App, participants receive tokens that can be converted into Indonesian rupiah after undergoing the iris scan. However, TFH asserts that the tokens are not compensation for identity verification via Worldcoin, and claiming the tokens is entirely optional.

“These tokens are incentives for users to explore and engage with the World network, which offers various useful services,” the company stated, as quoted by Tempo on Tuesday (20/5/2025)

TFH insists the tokens distributed through the World App are merely incentives for users to explore and utilize the World network, which, they claim, offers a variety of beneficial services.

The issue has caught the attention of Indonesia’s Ministry of Communication and Digital Affairs (Kemkomdigi). Alexander Sabar, Director General of Digital Space Oversight at the ministry, confirmed that the collection of iris and retina data by World App or Worldcoin has been taking place since 2021.

“We received information that they have been collecting data in Indonesia since 2021,” Alexander said, as quoted by Antara on Tuesday (20/5/2025).

World App has reportedly gathered biometric retina data from over 500,000 users in Indonesia. Alexander stated that the platform’s operators are registered under the Electronic System Provider List (Tanda Daftar Penyelenggara Sistem Elektronik – PSE). He emphasized that the government has been monitoring World App since it began operations in the country.

“Supervision and analysis of the platform’s activities have actually been ongoing, which is why we proceeded with summoning the relevant parties recently,” he added, referring to the government’s regulatory oversight of World App.

Alex further explained that the Ministry continues to investigate the findings and is committed to safeguarding the personal data of Indonesian citizens. When asked about the possibility of permanent data deletion, he confirmed that his office is prepared to take decisive action if World App is proven to have violated regulations.

“If there’s a risk of data leaks or any other breaches, we will certainly take firm steps to protect the personal data that has already been recorded,” he stated.

To mitigate potential risks, the Ministry of Communication and Digital Affairs (Komdigi) has suspended the company’s license. As a result, World App has ceased all iris and retina scanning operations, which had previously been conducted by six operators across Indonesia.

A biometric data expert from Universitas Muhammadiyah Surakarta (UMS) Gunawan Ariyanto, S.T., M.Comp.Sc., Ph.D., noted that iris and retina scans are among the most reliable biometric authentication methods, as these parts of the body remain relatively stable over time.

“The retina, from birth to adulthood, doesn’t change much. It remains stable, unlike facial features or fingerprints,” said Gunawan on Tuesday (20/5/2025).

Biometric data is used to identify individuals by recognizing unique physical traits such as fingerprints, facial features, voice, iris, and retina. 

This type of data stands out for its high accuracy, unique identifiers, and quick yet practical use in verification. It is widely employed in everyday activities, including work attendance systems, security authentication, and population identification.

India is among the countries that have built a large-scale biometric database of its citizens. According to ABC Australia (20/5/2025), the system, called Aadhaar, was launched in 2010.

Today, more than one billion Indian citizens have submitted their iris and fingerprint data. The Indian government uses this data to distribute social assistance. Those who do not submit their data are ineligible to receive government aid.

Despite its advantages, Gunawan cautions the public against carelessly sharing personal biometric data. Once stolen, biometric data is difficult to reset or recover.

“Biometric data represents what you are, it’s part of your physical self. If a password is compromised, you can change it. But biometric data can't be replaced,” said the Informatics Engineering lecturer.

Stolen biometric data can be exploited in dangerous ways. At worst, it may be used by criminals to impersonate others while committing crimes.

Gunawan also addressed concerns about the potential use of biometric data to access social welfare programs in Indonesia. Without strict oversight, or if the data falls into the wrong hands, it could easily be misused.

“If a criminal has access to biometric data, they could sell it to others. The buyer might then repeatedly claim social aid, as the data is easy to reproduce,” Gunawan explained.

To reduce the risk of biometric data theft, Gunawan recommended adopting multi-factor authentication, such as combining iris scans with voice recognition, passwords, or fingerprints.

Regarding the recent case in Bekasi, where residents were enticed to scan their irises for cash via the World App, Gunawan believed economic desperation played a major role. Many people were therefore willing to trade their personal data for money to meet their basic needs.

“For them, feeding themselves comes first. They urgently needed the money,” he said.

He also urged companies and institutions collecting personal data to comply with all relevant regulations. Data collection, he emphasized, must be guided by ethical research practices.

Companies must clearly explain the purpose of collecting biometric data and provide guarantees for data protection. “However, research involving personal data should be limited in scope. It shouldn’t be as massive as what happened in Bekasi,” he stressed.

Gunawan called on the government to take firm action by strictly enforcing the Personal Data Protection Law. He pointed to the European Union’s General Data Protection Regulation (GDPR) as a model.

GDPR applies globally to companies that handle the data of EU citizens. In contrast, Indonesia’s Personal Data Protection Law currently only covers data within its national jurisdiction.

Writer: Gede Arga Adrian

Translator: Farizal Luqman Majid

Editor: Al Habiib Josy Asheva