World Network, the digital identity and crypto project of Sam Altman's OpenAI, has alarmed privacy activists ahead of its United States launch

World, the digital identity and crypto project by Sam Altman’s OpenAI, is rolling out its iris-scanning technology and crypto token payout scheme in the United States.

However, ahead of the launch, privacy activists have sounded the alarm over the project’s data collection and protection practices.

While the project claims to be protecting user privacy in the age of proliferating AI, it’s faced a slew of regulatory concerns across the globe.

World’s latest foray into the US could prove to be CEO Sam Altman’s biggest challenge yet, where privacy concerns are heightened by a patchwork of enforcement that differs state by state.

World’s US expansion brings varied privacy laws and potential for discrimination

On April 30, Altman announced that World would be setting up in “key innovation hubs” in five states in the US: Atlanta, Austin, Los Angeles, Miami, Nashville and San Francisco.

Would-be verified humans can scan their irises at these hubs, giving World unique biomedical markers. These markers, in turn, can be used to interact with others on digital platforms in a way that is verifiable and human-led.

But as World expands into the US, an uncertain regulatory landscape could put people off and make it difficult for the platform to build user trust.

Andrew Rossow, a cyber and public affairs attorney at Rossow Law, told Cointelegraph that there is no comprehensive federal law specifically regulating biometric data (such as iris scans) in the US.

Instead, laws differ state by state. Two states in which World will operate, Texas and California, have some form of legal protections in place for biometric data.

World users in the remaining three states, Georgia, Tennessee and Florida, must rely on federal law, which requires that companies must be transparent and fair, but there are no special state rules for iris scans.

However, even the existence of state law is no guarantee of protection. In Texas, there is no private right of action for biometric data — only the state attorney general (AG) can enforce the state’s Capture or Use of Biometric Identifier law.

“The effectiveness of user data protections, as it pertains to World, hinges almost entirely on the Texas AG’s priorities, resources and willingness to act,” said Rossow. A more aggressive AG could mean more robust protections, while “a less aggressive administration could deprioritize enforcement, which leaves consumers open and vulnerable to exploitation.”

The potential for exploitation is one of the key factors driving activist efforts against systems like World’s.

Privacy International, a privacy protection group that supported legal action in Kenya against World, notes that in “the absence of strong legal frameworks and strict safeguards, biometric technologies pose grave threats to privacy and personal security, as their application can be broadened to facilitate discrimination, profiling and mass surveillance.”

As far back as 2021, Amnesty International had raised concerns over discrimination and biometric systems’ applications of dubious methodologies. Such systems, they said, can “make inferences and predictions about things such as people’s gender, emotions, or other personal attributes, suffer from serious, fundamental flaws in their scientific underpinnings.”

World faces mounting bans and legal action

OpenAI may be doubling down on an American strategy, but other jurisdictions around the world are increasingly investigating, limiting or banning the firm’s activities.

In 2023, regulators in India, South Korea, Kenya, Germany and Brazil began investigating the firm’s data collection practices. Spain became the first country to place a complete ban on World in March 2024.

The Spanish Data Protection Agency previously told Cointelegraph that its course of action was based on reports from Spanish citizens. It claimed that Orb operators provided insufficient information, collected data from minors and even failed to allow withdrawal of consent.

Following the move, World stated that it operates lawfully in all of the locations in which it is available.

However, global regulators disagreed. Hong Kong followed suit in May 2024 and ordered World to cease operations as it was allegedly breaching the city-state’s Personal Data Privacy Ordinance.

Further accusations of improper data collection practices followed, and a number of countries like Germany and, more recently, Kenya, have ordered World to delete the data of thousands of users, while Colombia and Argentina have issued hefty fines.

In January 2025, Brazil’s National Data Protection Authority banned World outright, citing concern over the irreversible nature of data collection and the potential for World to economically influence disadvantaged people with the promise of crypto for their data.

World is now rolling out its iris-scanning orbs for collecting user data and distributing crypto tokens in the United States.

The move comes amid a slew of legal and regulatory issues that the firm has faced in recent months.

Earlier this year, a group of privacy activists sued the crypto project in California to try to block it from launching in the U.S.