NPC issues cease-and-desist against World App in PH

Insider Spotlight

• NPC orders Tools for Humanity to stop World App biometrics
• Cites “invalid consent,” lack of transparency, excessive data use
• Warns of irreversible risks from biometric processing
  
  

The National Privacy Commission (NPC) on Oct. 8, 2025 issued a cease and desist order against the Sam Altman-led Tools for Humanity, operator of the World App, after finding multiple violations of the Data Privacy Act of 2012 and its implementing rules.  

The order compels Tools for Humanity to immediately halt all data processing activities related to the World App, Orb verification, and associated platforms, including the collection of biometric data like iris scans.

Key violations found

The NPC said Tools for Humanity failed to adhere to principles of data protection, highlighting:

• Invalid consent due to undue influence — Incentivizing iris scans with monetary rewards rendered consent non-voluntary under law.  
• Lack of transparency — The company did not clearly inform users about purpose, scope, duration, or extent of data processing.  
• Excessive collection — Biometric data like iris patterns were deemed disproportional and unnecessary for the stated goal of proving humanness.  
• Risk of grave harm — The NPC asserted that continued processing risks identity theft, fraud, and reputational damage given the permanence of biometric identifiers.

Deputy Privacy Commissioner Jose Amelito S. Belarmino II said, “The integrity of a Filipino citizen’s biometric data is non-negotiable … When consent is compromised by the lure of compensation, it ceases to be a genuine expression of choice.”

Implications & response

The regulator noted that Tools for Humanity had faced suspensions over similar privacy issues abroad and faulted it for launching in the Philippines without ensuring compliance. 

Tools for Humanity’s legal team, led by DivinaLaw senior partner Enrique dela Cruz Jr., responded that the cease and desist order is an “undermining” of innovation and that “no law has been violated.” The company asserted that participation is voluntary, raw iris data is not stored, and all biometric inputs are anonymized and deleted.

World Philippines said it underwent regulatory review under the Department of Information and Communications Technology sandbox, registered with the National Privacy Commission, and engaged privacy experts before launch. The company plans to file a motion for reconsideration.

This enforcement action signals a tougher regulatory stance toward biometric and AI-driven identification systems in the Philippines, raising fresh uncertainty for tech startups relying on sensitive personal data. ---Daxim L. Lucas | Ed: Corrie S. Narisma