Worldcoin Alternatives: Proof of Personhood Without Iris Scanning

The concept of proof of personhood, verifying that an online identity belongs to a unique human being, does not require iris biometric collection. A growing ecosystem of alternatives achieves similar goals with dramatically less invasive data collection. BrightID uses a social graph verification approach where existing verified members vouch for new participants through verification parties. No biometric data is collected. The system relies on social connections and community verification to establish uniqueness. While vulnerable to coordinated sybil attacks, BrightID has demonstrated reasonable effectiveness for its target use cases. Gitcoin Passport aggregates multiple identity signals including social accounts, on-chain activity, and attestations to create a composite personhood score. No single data point is decisive, and users control which signals they provide. The approach is more privacy-preserving than biometric collection while providing statistical confidence in human uniqueness. Proof of Humanity uses video verification and social vouching, requiring new registrants to submit a video and receive vouches from existing members. While video collection has its own privacy implications, it is significantly less sensitive than iris biometric collection and the video can be removed after verification. Idena uses AI-resistant CAPTCHAs administered at synchronized global sessions to verify human uniqueness. The approach requires no biometric or identity data, relying instead on cognitive tasks that are difficult for AI to complete. The tradeoff is lower assurance of uniqueness compared to biometric methods, but the privacy preservation is dramatically superior.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.