Worldcoin Iris Data Retention: How Long Your Biometrics Are Really Stored

Worldcoin data retention policies for iris biometric data have undergone multiple revisions, each revealing longer storage periods and broader usage rights than previously disclosed. The current retention framework distinguishes between raw iris images captured by the Orb, processed iris codes used for uniqueness verification, and derived biometric templates used for ongoing authentication. Raw iris images were initially described as deleted immediately after processing. Subsequent disclosures revealed temporary storage periods that extended to weeks, then months. The processed iris codes, which contain sufficient information to identify individuals, are retained indefinitely as part of the core World ID functionality. These codes are necessary to prevent duplicate registrations and are stored in Worldcoin distributed systems with no disclosed expiration. Worldcoin argues that iris codes are not biometric data in the traditional sense because they cannot reconstruct the original iris image. Biometric privacy experts dispute this characterization, noting that iris codes are unique identifiers derived from biometric characteristics and fall squarely within the definition of biometric data under GDPR, BIPA, and most other privacy frameworks. The distinction between raw biometric data and biometric templates is legally irrelevant in most jurisdictions. Users who registered with Worldcoin expecting short-term data retention face the reality that their biometric identifiers may be stored in perpetuity as part of the protocol fundamental architecture. Deletion of the iris code would effectively de-register the user from World ID, but the process for requesting this deletion is not straightforward.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.