Technology firm Tools for Humanity (TFH), developer of the World ID project, is preparing to file a Motion for Reconsideration with the National Privacy Commission (NPC) following the agency’s cease and desist order (CDO) against the company.

In a statement on Thursday, TFH described the NPC order as a setback for digital innovation, noting that it came after the firm completed a year-long compliance process and made major investments in the country.

The company warned that if the decision stands, it could deny millions of Filipinos access to technology meant to protect users from scams, identity theft, and AI-driven fraud.

“We don’t store, sell, or purchase biometric data,” said Ryuji Wolf, a local operator representing World in the Philippines, adding that the company will pursue all remedies available to it.

“World remains committed to working transparently with regulators to clarify the system’s design and demonstrate its full adherence to Philippine law. The order comes as a surprise given we worked closely with regulators to ensure that our technology not only meets but exceeds the country’s data protection requirements,” he added.

In its order, the NPC said it found that TFH violated the Data Privacy Act by obtaining invalid consent through monetary incentives, failing to properly inform users about data processing, and collecting excessive biometric data such as iris scans.

The agency said these practices posed serious and irreversible risks such as identity theft and fraud, noting that TFH also failed to exercise due diligence despite encountering similar privacy issues in other countries.

“When consent is compromised by the lure of compensation, it ceases to be a genuine expression of choice. This CDO sends a clear message that the NPC will not tolerate practices that exploit socioeconomic vulnerabilities or compromise fundamental data privacy rights in pursuit of business objectives,” Deputy Privacy Commissioner Jose Amelito S. Belarmino II said.

TFH maintained that before its launch, it underwent extensive regulatory review, including participation in the Department of Information and Communications Technology’s (DICT) Sandbox Program, formal registration with the NPC, and consultations with leading data privacy experts and government agencies.

It also cited a “sudden shift” in the NPC’s stance following a leadership change, despite its continued coordination with the DICT and the Cybercrime Investigation and Coordinating Center to address AI-related risks.

Wolf explained that the World's proof-of-human system verifies a person’s humanity without collecting personal details such as name, address, birthday, or phone number.

“Our system does not identify individuals. It simply verifies that they are unique humans, not bots or AI accounts,” he said.