São Paulo Prosecutors Sue World ID and AWS Over Iris Scans, Seek $240 Million
The Public Prosecutor's Office of São Paulo (MPSP) has filed a public civil lawsuit against Tools for Humanity Corporation, the entity behind the World ID project, and Amazon AWS Serviços Brasil. The lawsuit alleges irregularities in the iris scanning of consumers in São Paulo. This action stems from information gathered by the Iris CPI, established in May 2025 by the São Paulo Municipal Chamber. According to prosecutors, over 400,000 individuals had their irises scanned in exchange for financial rewards ranging from R$300 to R$700.
The MPSP is seeking a court declaration that the companies' practices are abusive, a permanent prohibition on collecting iris biometric data for financial compensation, and the irreversible deletion of all collected data. Additionally, the lawsuit demands a minimum of R$240 million for collective moral damages, alongside compensation for any individual harm suffered by consumers. Prosecutor Patrícia Leitão also requested preliminary measures to preserve data and records related to iris collection, and information on data storage and the specific Amazon entity responsible.
Investigations indicated that data collection was concentrated in peripheral and high-traffic areas, targeting individuals in socioeconomically vulnerable situations. Prosecutors claim consumers were not clearly informed about the project's economic purpose, the risks of biometric data processing, international data transfer, or storage on AWS servers. The MPSP asserts that the companies engaged in misleading advertising, exploited consumer vulnerability, and obtained flawed consent, continuing to offer incentives via the World App even after the National Data Protection Authority (ANPD) ordered a halt to financial compensation for iris scans. The Iris CPI's final report, approved in April 2025, concluded that the company's operational model poses significant legal, social, and technological risks and potential non-compliance with Brazilian laws.
This legal action highlights the complex interplay between emerging biometric technologies, data privacy regulations, and the ethical considerations of incentivizing data collection, particularly from vulnerable populations. The core issue revolves around informed consent and potential exploitation, as the prosecution alleges a lack of transparency regarding data usage, international transfer, and inherent risks. The involvement of a major cloud provider like AWS introduces questions about platform liability and due diligence in safeguarding data processed through their services. Future regulatory frameworks will need to address the balance between technological innovation, individual privacy rights, and the potential for financial incentives to create coercive dynamics, especially in the context of global digital identity initiatives.
AI-generated to prompt reflection — not editorial opinion, not advice, not a statement of fact. How this works.