Bogot\u00e1 D.C., July 8, 2026. The Superintendency of Industry and Commerce (SIC) has finalized the sanction ordering the immediate and permanent shutdown of the sensitive data processing operation that WORLD FOUNDATION (formerly Worldcoin Foundation) and TOOLS FOR HUMANITY CORPORATION were carrying out in Colombia, for violating the personal data protection regime set forth in Law 1581 of 2012.<\/p>\n\n\n\n
The Delegate Office for Personal Data Protection, through Resolution 45710 of June 18, 2026, ruled on the companies’ appeal and upheld Resolution No. 78798 of October 3, 2025, in which the Directorate of Investigations had imposed the sanction. No further appeal is available against this decision.<\/p>\n\n\n\n
The sanctioning administrative proceeding focused on examining these companies’ activities related to the collection of personal data and, in particular, the image of the iris (a part of the human eye) of thousands of people in Colombia, through “Orb” devices, in exchange for financial compensation and in order to create an account and obtain a “World ID.” The SIC noted that these activities, insofar as they involved the processing of sensitive personal data under the terms of Article 5 of Law 1581 of 2012, were in principle prohibited, unless backed by legal authorization or by the data subjects’ prior, express, informed, and qualified consent.<\/p>\n\n\n\n
The substantive grounds for the sanction<\/p>\n\n\n\n
The authority concluded that, at the time of collecting sensitive data from individuals residing in Colombia, the companies did not obtain truly free and sufficiently informed consent from the data subjects; failed to provide clear, sufficient, and understandable information about the purposes, operations, and actual conditions of the processing; incentivized the handover of biometric data in exchange for financial compensation; and rolled out their operation in Colombia without, prior to data collection, having data processing policies aligned with the requirements of Colombian law, or clear and effective procedures for exercising habeas data rights, among other findings.<\/p>\n\n\n\n
The technical component: encryption and fragmentation do not exempt compliance<\/p>\n\n\n\n
The core issue of the appeal centered on a technical matter: the companies argued that the “iris code” and the fragments derived through secure multi-party computation (SMPC\/AMPC) would no longer constitute personal data, since they were encrypted, fragmented, and distributed across different nodes. The Delegate Office rejected this argument, clarifying that the adoption of advanced cryptographic mechanisms\u2014applied after collection\u2014does not render the information anonymous. The purpose of the World ID system is to individualize the person by verifying their uniqueness based on biometric patterns; therefore, even if the data is encrypted or fragmented and protected with advanced security measures, it retains a functional link to the identification of the data subject. The fact that an isolated fragment cannot reconstruct the iris image does not eliminate the personal nature of the data. The law only requires a reasonable possibility of associating the information with an identifiable person, and the system’s own capacity to verify and recognize an already-registered user demonstrates that this link persists.<\/p>\n\n\n\n
Accordingly, encryption and fragmentation are adequate security measures, but they do not exempt compliance with the other legal duties. The authority further noted that the companies failed to clearly explain how the deletion of biometric information operates within a distributed fragmentation model with ongoing uniqueness verifications, nor how the data subjects’ right to erasure of their personal data was guaranteed.<\/p>\n\n\n\n
Jurisdiction and due process<\/p>\n\n\n\n
The Delegate Office confirmed the SIC’s jurisdiction to examine the case and rule on the liability of foreign companies that carry out personal data processing within Colombian territory. On this point, it reiterated that Law 1581 of 2012 applies to anyone who processes personal data in Colombia, even partially, and even when they are not established in Colombia, do not have a branch there, or have not formalized local representation. It likewise dismissed the objections raised regarding alleged flaws in notification and procedure. It found that the notification rules under the 1965 Hague Convention, adopted into domestic law through Law 1073 of 2006, did not apply, since this case involved a sanctioning administrative proceeding rather than a “civil or commercial matter”; that the notifications complied with the special rules of the Code of Administrative Procedure and Administrative Litigation; and that the companies were duly informed of the proceeding in a timely manner, accessed the case file, requested evidence, and submitted arguments and appeals, fully exercising their right to a defense.<\/p>\n\n\n\n
With this decision, the SIC reaffirms that:<\/p>\n\n\n\n
Biometric data, such as iris images, are sensitive data subject to special constitutional and legal protection; their processing requires prior, express, informed, and heightened authorization.<\/p>\n\n\n\n
Encryption, pseudonymization, or fragmentation are legitimate security measures, but they do not turn biometric data into anonymous information, nor do they exclude the application of the personal data protection regime when the system retains the capacity to individualize the person.<\/p>\n\n\n\n
Consent for processing biometric data must be free and cannot be conditioned on financial incentives that affect a person’s free will.<\/p>\n\n\n\n
Colombia’s personal data protection regime is binding on foreign companies that carry out personal data processing in Colombia, regardless of their domicile, business model, or the complexity of their technical architecture.<\/p>\n\n\n\n
In conclusion, both the sanction ordering the immediate and permanent shutdown of any operation in Colombia involving the processing of sensitive data, and the order to erase the sensitive personal data\u2014including iris codes\u2014collected since the start of operations, remain final. Compliance with this order must be certified by an external entity, together with the corresponding technical evidence.<\/p>\n\n\n\n
Finally, the Superintendency reaffirms its commitment to protecting the fundamental right to habeas data and notes that innovation and technological development\u2014including identity- and uniqueness-verification systems and the most advanced cryptographic architectures\u2014must be deployed responsibly, ethically, and in strict compliance with Colombian law. No technical solution or business model can justify the violation of data subjects’ fundamental rights, or non-compliance with the Constitution or the laws of the Republic of Colombia.<\/p>\n\n\n\n