As AI-generated text, images and voices become more convincing, a new question is moving from academic papers into product design: how can a website tell whether it is dealing with a real, unique person? Projects like World, associated with Sam Altman and formerly known as Worldcoin, answer with a bold approach: take iris scans with a special device to issue a digital credential. It is controversial. Let us look at the problem, the proposed fix and the arguments around it.
The problem: bots and duplicates
Online, anyone can create many accounts. That enables spam, fake reviews, vote manipulation and fraud. The old defence was CAPTCHA, those puzzles asking you to pick traffic lights, but modern software solves many of them well. Meanwhile, deepfakes make it harder to trust video calls and voice messages.
The idea behind “proof of personhood” is to establish two facts without necessarily revealing who you are: that you are a real human, and that you are only registered once.
How iris scans work in outline
In the general design, a person visits a device that captures a high-resolution image of their eyes. Software converts the iris pattern into a numerical code, which is compared against existing codes to check that the person is unique. If they pass, they receive a digital credential stored in an app. The promise is that you can later prove you are a verified human to a service without handing over your name or documents.
Why use iris scans? Their patterns are detailed and, under good conditions, distinctive enough to tell large numbers of people apart, which is difficult for simpler biometrics such as faces.
The case for iris scans
Supporters make several points: it could deter bots and mass fake accounts; credentials might work across many services, reducing repeated verification; cryptographic techniques could let you prove you are human without revealing who you are; and it might become a foundation for fair distribution of digital benefits.
If it works as described, that is attractive in a world flooded with synthetic content.
The concerns about iris scans
Identity checks are spreading well beyond this one idea. For a look at a more everyday method, see our guide to using your phone number as proof of identity.
Critics raise serious questions, and they deserve weight.
Biometrics are permanent. You can change a leaked password but not your iris. If a database is compromised or misused, the damage lasts. That is why regulators treat biometric data as especially sensitive and many privacy laws impose strict rules on collecting it.
Consent and fairness are also issues for iris scans. Reports from journalists and regulators in several countries have questioned how clearly participants were informed, particularly when incentives were offered to people who might have limited alternatives. Some authorities have investigated or restricted such operations.
Centralisation is a third worry. A single credential system, controlled by one organisation, could become a gatekeeper. If your access to services depends on it, power concentrates.
Finally, there is the technical question of whether the approach can really stop determined fraud. Credentials can be sold, coerced or farmed. No identity system is immune.
Alternatives to iris scans
Proof of personhood does not have to involve eyes. Other approaches include government-issued digital IDs with privacy-preserving checks; web of trust models, where verified people vouch for each other; device-based attestation that shows a real device is in use; behavioural signals and risk scoring, with their own limits; and selective checks for high-risk actions only.
Each has trade-offs between convenience, privacy, cost and inclusion. There is no consensus on a single winner.
If someone asks for your iris scans
Treat it like any request for sensitive data. Ask what is collected, whether raw images are stored or deleted, who can access the data, how long it is kept and how you can have it erased. Read local rules about biometric data. Consider whether the benefit offered is worth the permanent nature of what you are giving up.
It is perfectly reasonable to say no.
Why the debate matters
Companies that verify customers remotely face the same trade-offs, as we explain in how companies verify customer identity over messaging apps. The pattern is consistent: the more certain a check, the more personal data it needs.
Iris scans also raise a practical question about people who cannot or will not use them. Any system that becomes a gateway has to offer a fair alternative for those with eye conditions, disabilities or simple objections.
Whatever happens to any single project, the underlying issue is real. Online spaces need ways to separate people from automated accounts, and the solutions will shape privacy, access and trust. A good system should minimise data, allow people to participate without surrendering more than necessary, be open to scrutiny and avoid single points of control.
The takeaway
Proving you are human online is becoming a genuine infrastructure challenge. Iris scans are one ambitious answer, powerful in theory and fraught in practice. Before embracing any biometric identity scheme, weigh the permanence of what you hand over against what you get back, and favour approaches that keep data minimal, consent clear and control distributed.
