Worldcoin’s Indonesian Suspension: Regulatory Clampdown on Biometric ID Projects

Main Points:

• Indonesia’s Ministry of Communication and Digital Affairs temporarily revoked Worldcoin and World ID’s Electronic System Organizer Registration Certificate (TDPSE), citing unlicensed activity and misuse of registration credentials.
• Two local entities—PT Terang Bulan Abadi and PT Sandina Abadi Nusantara—are under investigation for operating without a proper PSE license or lending their certificate improperly.
• The suspension is framed as a preventive measure to protect citizens from potential risks arising from unregistered digital services and suspicious biometric data practices.
• This action adds Indonesia to a growing list of jurisdictions (Germany, Kenya, Brazil, Spain, Hong Kong, Portugal) scrutinizing Worldcoin’s data collection methods.
• Worldcoin’s global expansion, including a recent U.S. rollout in six cities, may face delays as it works to remedy compliance gaps and rebuild trust.

1. Background: Worldcoin’s Ambitious Biometric ID Vision

Worldcoin, co‑founded by OpenAI CEO Sam Altman and backed by Tools for Humanity, launched in July 2023 with a mission to create a “proof‑of‑personhood” identity protocol using iris‑scan hardware called “Orbs” to verify unique human identities. The project rewards participants with WLD tokens in exchange for biometric scans, aiming to address sybil attacks in decentralized networks and democratize access to crypto airdrops.

Since its inception, Worldcoin has sought broad adoption—partnering with companies like Visa, Tinder, and Kalshi—and expanding geographically. However, its data‑intensive model has repeatedly caught the attention of regulators concerned about privacy, consent mechanisms, and the security of biometric databases.

2. Indonesia’s Regulatory Framework for Digital Services

Indonesia’s electronic systems and transactions are governed by Government Regulation No. 71/2019 (the “E‑Govt Regulation”) and Ministerial Regulation No. 10/2021 on Electronic System Operator Certification (TDPSE). Under these rules:

1. PSE Registration: Any entity offering digital services within Indonesia must obtain a PSE license and register with the Ministry of Communication and Digital Affairs.
2. TDPSE Requirement: Operators must hold a valid TDPSE certificate authorizing them to run electronic systems.
3. Prohibition on Credential Lending: Using another company’s registration or operating under a false corporate identity is expressly forbidden and constitutes a serious violation.

Failure to comply can lead to temporary suspension of operations, fines, and potential legal action to safeguard consumer data and national cybersecurity interests.

3. The May 4 Suspension: What Happened?

On May 4, 2025, Indonesia’s Ministry of Communication and Digital Affairs announced that it had temporarily suspended the TDPSE certificates for both Worldcoin and its World ID platform. The ministry’s statement highlighted “suspected suspicious activities and registration violations,” prompting an immediate freeze of all local services.

• PT Terang Bulan Abadi, the nominal operator of Worldcoin services, was flagged for running its platform without holding its own PSE registration.
• PT Sandina Abadi Nusantara, officially licensed, was accused of lending its certificate to cover Worldcoin’s operations, masking the fact that the primary operator lacked authorization.

Both companies have been summoned to appear before the Digital Space Supervision Directorate, headed by Alexander Sabar, to clarify the extent of these infractions and outline corrective measures.

4. Government’s Rationale: Protecting Citizens in the Digital Age

Director General Alexander Sabar framed the suspension as a preventive, consumer‑protection measure:

“We must ensure a fair and secure digital ecosystem for all Indonesians. Unregistered platforms and misused credentials threaten personal data integrity and national cybersecurity. This move is designed to prevent potential harm while we verify compliance.”

The ministry reiterated obligations for all digital service providers to:

• Obtain proper PSE licensing under their own corporate identity.
• Avoid use of another entity’s credentials when delivering services.
• Report any suspicious activities through official complaint channels to help authorities monitor emerging risks.

Sabar also urged the public to remain vigilant and report unauthorized digital platforms, reinforcing collaborative digital governance.

5. Global Context: Part of a Wider Regulatory Wave

Indonesia’s action follows a series of international interventions against Worldcoin:

• Germany & Bavaria: Data watchdogs probed the legality of mass iris‑scan collection.
• Kenya: Enrollment was suspended over security, privacy, and financial concerns.
• Brazil: Operations halted temporarily amid biometric data safety doubts.
• Spain & Portugal: Data protection authorities issued urgency orders to stop biometric data collection.
• Hong Kong: Warrants executed over possible privacy ordinance violations.
• United Kingdom & France: Investigations launched by ICO and CNIL over transparency and consent issues.

These actions underscore global unease about the intersection of blockchain incentives and sensitive biometric identifiers.

6. Impact on Worldcoin’s Expansion Strategy

Despite regulatory headwinds, Worldcoin has pressed ahead:

• U.S. Rollout: Launched in May 2025 across six metropolitan areas—Atlanta, Austin, Los Angeles, Miami, Nashville, and San Francisco—where residents can obtain a World ID via iris scan.
• Corporate Partnerships: Collaborations with Visa for streamlined identity verification, Tinder for user authentication, and Kalshi for secure trading applications.
• Community Engagement: Aggressive marketing pushes and “Orb” deployments at tech events to onboard new users.

However, the Indonesian freeze forces the project to pause operations in a key Southeast Asian market, potentially delaying partnerships with local fintech firms and dampening investor confidence.

7. Remediation Path: What Worldcoin Must Do

To resume Indonesian services, Worldcoin and its partners are expected to:

1. Secure Their Own PSE Registration: PT Terang Bulan Abadi must apply directly for a PSE license rather than relying on a third party.
2. Implement Robust Compliance Protocols: Establish clear data handling, consent documentation, and record‑keeping to satisfy digital system regulations.
3. Engage Local Counsel: Work with Indonesian legal experts to navigate ministerial requirements and preempt future violations.
4. Transparency Report: Publish an audit of local operations, clarifying how biometric data is stored, processed, and deleted post‑verification.

Swift action will be essential to minimize downtime and reassure both regulators and users.

8. Community Reactions: Trust Versus Convenience

Responses among Indonesian and global crypto communities have been mixed:

• Supportive Voices: Reddit users applauded the government: “Finally, someone is holding this sketchy project accountable.”
• Pragmatic Perspectives: Others noted trade‑offs: “If you can trade a few weeks of food for a biometric scan, some might consider it worthwhile.”
• Privacy Advocates: Expressed concern over centralized biometric databases and long‑term risks of identity mining.

This debate reflects the broader tension between innovative identity solutions and data sovereignty.

9. Broader Implications for Biometric Blockchain Projects

Indonesia’s move could set precedents for future biometric‑blockchain ventures:

• Stricter Licensing Requirements: Governments may tighten PSE regimes and impose heavier penalties for misregistered digital services.
• Heightened Data Privacy Scrutiny: Privacy laws like Indonesia’s Personal Data Protection Law will be enforced more rigorously, potentially requiring impact assessments for biometric projects.
• Cross‑Border Coordination: Regulators could share enforcement actions internationally to close jurisdictional loopholes.

Projects embedding sensitive identifiers into public‑blockchain use cases must now design governance frameworks that satisfy both decentralization ethos and state regulatory demands.

10. Conclusion: Navigating the Regulatory Labyrinth

Worldcoin’s temporary suspension in Indonesia on May 4, 2025, underscores the complex interplay between cutting‑edge crypto‑biometric innovations and national digital sovereignty. As the project strives to build a global proof‑of‑personhood network, it must address:

• Corporate Compliance: Obtaining proper PSE registrations and avoiding credential misuse.
• Data Governance: Demonstrating robust privacy safeguards and transparent user consent processes.
• Regulatory Engagement: Proactively collaborating with authorities to adapt business models to local legal contexts.

This episode serves as a cautionary tale for all blockchain ventures seeking to leverage biometric data: innovation cannot outpace the rule of law. By realigning its Indonesian strategy—and learning from global setbacks—Worldcoin can chart a more sustainable path forward, balancing disruptive identity solutions with the imperatives of data protection and regulatory compliance.