The city of São Paulo has filed a $47 million lawsuit against World and Amazon Web Services, accusing them of illegally collecting and processing biometric data. The Consumer Prosecutor's Office of São Paulo said World deliberately targeted economically vulnerable individuals, offering crypto rewards in exchange for iris scans. The suit claims the data collection continued even after Brazil's National Data Protection Authority (ANPD) ordered a halt to the practice.
The $47 million lawsuit
Filed this week in São Paulo's civil court, the lawsuit names both World — the iris-scanning crypto project formerly known as Worldcoin — and Amazon AWS, which provides cloud infrastructure for the project. The city is seeking 250 million reais (about $47 million) in collective moral damages. The prosecutor's office argues that the biometric data was collected without proper consent and in violation of Brazil's data protection law.
Targeting the vulnerable
The Consumer Prosecutor's Office stated that World's operations in São Paulo focused on low-income neighborhoods, where people were offered small crypto payments to have their irises scanned. “The company exploited the economic vulnerability of these individuals,” the office said in its filing. The prosecutor's office also noted that many participants did not fully understand what they were consenting to, or how their biometric data would be used.
Defying the regulator
The lawsuit highlights that World continued collecting biometric data even after the ANPD, in March 2026, ordered the company to suspend offering crypto rewards for iris scans. The ANPD's decision came after an investigation found potential risks to data subjects. Despite the order, World kept operating its Orb devices in São Paulo, according to the prosecutor's office. That defiance is a central element of the city's case.
What comes next
The case now moves through São Paulo's court system. A judge will decide whether to accept the lawsuit and set a timeline for hearings. World and Amazon AWS have not yet filed responses. The ANPD's own administrative proceedings against World are ongoing, and the regulator could impose additional fines. For now, São Paulo's lawsuit adds a new legal front for a project that has faced scrutiny from data protection authorities in multiple countries.
