São Paulo sues World and Amazon AWS for $47M

The Consumer Prosecutor’s Office of São Paulo filed a lawsuit on Monday against Tools for Humanity, the company behind World, and Amazon Web Services, seeking 240 million reais (about $47 million). The office alleges the companies collected biometric data from economically vulnerable residents in exchange for crypto payments and asks a court to suspend those payments and preserve related data and metadata.

The complaint says World concentrated recruitment in peripheral, high-traffic neighborhoods to attract people in socioeconomic vulnerability and offered crypto incentives for biometric scans. Prosecutors estimate more than 400,000 people participated in World’s São Paulo rollout. The filing requests that any payment or benefit tied to biometric data collection be suspended until authorities complete an assessment and asks the court to declare the activities abusive and award compensation totaling 240 million reais for individual losses.

Investigators cite findings from an Iris Parliamentary Commission of Inquiry (CPI) that documented irregularities in World’s operations in the city. The CPI report says World focused its presence in vulnerable neighborhoods and did not clearly inform participants about the project’s economic purpose or the risks of how biometric data would be processed and stored.

The prosecutor’s office says World continued to deliver crypto rewards through internal app transactions even after Brazil’s National Data Protection Authority (ANPD) ordered those payments halted in February 2025. Amazon AWS is named in the suit as World’s hosting provider; prosecutors contend World failed to disclose risks tied to storing biometric information on AWS servers and hid the extent of AWS’s role from users during enrollment and transactions.

On its website, World wrote that the project “does not collect, store or sell any personal data, including iris data, and verified World ID holders are anonymous.” The company has faced regulatory action in Argentina, where authorities fined World about $200,000 for breaches of consumer protection rules, including allowing minors to enroll and failing to disclose biometric data-processing practices.

The São Paulo action asks the court to order preservation of all information tied to biometric enrollments, halt ongoing crypto payments or in-app benefits linked to data collection, and award monetary damages to affected consumers. The prosecutor’s office framed the complaint as a consumer-protection and data-privacy case and requested judicial measures to ensure residents’ data is available for review while authorities investigate the collection, storage and disclosure practices described in the suit.