Thailand Ordered Worldcoin to Delete 1.2 Million Iris Scans It Never Had Legal Basis to Keep
What happened
Thailand's authorities did not shut down Worldcoin quietly. In November 2025, the Personal Data Protection Committee issued a permanent order to cease all iris-scanning operations in the country and mandated deletion of over 1.2 million biometric records. The company, operating under the brand World and developed by Tools for Humanity, had been expanding across Thailand since early 2024, eventually reaching more than 100 scanning locations. The suspension was not a temporary hold pending review. The deletion of every record collected was treated as the only acceptable remedy.
The findings driving the order were specific. Thai law places strict requirements on collecting and processing sensitive personal data, and the disclosures Worldcoin provided to participants about how their iris data would be used and protected did not meet that standard. The Personal Data Protection Committee and the Ministry of Digital Economy and Society concluded the operation had been running in violation of those requirements throughout its expansion. Collecting biometric data at scale without satisfying legal disclosure obligations is not a technicality. Iris scans are permanent identifiers, not passwords that can be reset, and Thai regulators treated the permanence of the data as a reason to apply those rules strictly rather than leniently.
A separate layer of the case involved unauthorized financial activity. In October 2025, the Thai Securities and Exchange Commission and the Cyber Crime Bureau raided a Bangkok scanning site and arrested individuals for operating an unlicensed cryptocurrency exchange. The project's structure, scanning irises in exchange for tokens, placed a data-privacy operation and a financial operation in parallel, without separate regulatory approval for either. By January 2026, the SEC had filed criminal complaints against five individuals for unlicensed trading of WLD tokens. By February, the Department of Special Investigation had elevated the case and opened inquiries into former government officials tied to the project's entry into the country.
Thailand was not acting in isolation. Portugal had banned Worldcoin for ninety days, Spain had suspended operations, Kenya had shut the program down, and Indonesia had acted on similar grounds. Each jurisdiction reached comparable conclusions independently: that combining irreversible biometric collection with opaque downstream use creates a category of risk that general consent language cannot adequately address. The Thai case is notable less for being unique than for being among the most thorough, concluding with a mandatory deletion order rather than a pause and a request to comply.
The deletion order itself reveals the gap. Once the records existed, the only remedy regulators held was to require their destruction, with no reliable mechanism to verify that destruction actually occurred or that copies had not already moved. A provable record of what a system did with biometric data, including where it was transmitted, how it was stored, and under what conditions it was shared, would have made the compliance questions answerable before an enforcement action rather than after. Without that kind of auditable trail, regulators are left ordering deletions they cannot confirm and assessing harms they cannot fully trace.
Reported impact
- Affected parties
- Not publicly disclosed
- Harm type
- Not publicly disclosed
- Scale
- Not publicly disclosed
- Financial impact
- Not publicly disclosed
- Regulatory action
- Not publicly disclosed
Classification
Relevant governance controls
Governance control mapping is not available for this record.
- No controls mapped
Not publicly disclosed
Control mapping is analytical. It does not state that any control would have prevented the incident.
Sources and evidence
This record was researched and written by the Index. The event is also catalogued in the following database, which is listed for cross-reference.