The Identity Stack: Worldcoin's Iris Scan, Aadhaar's Billion Enrollments, and the EU's eIDAS Wallet — Three Visions of Who Controls Your Digital Self

In Nairobi's Westlands district in March 2026, a queue formed outside a converted shipping container housing a Worldcoin "orb" — a chrome sphere roughly the size of a basketball that photographs the iris of anyone willing to stand before it, generating a cryptographic hash stored on a blockchain in exchange for a quantity of WLD tokens. The queue was long. In a city where formal financial infrastructure excludes an estimated 40% of adults, the promise of verified digital identity with an attached cryptocurrency allocation was sufficiently compelling that people waited three hours for a sixty-second scan. The same week, the Spanish Data Protection Agency issued its second enforcement action against Worldcoin within eighteen months, citing ongoing violations of GDPR's prohibitions on processing biometric data for identification purposes without adequate legal basis — and Worldcoin's parent company, Tools for Humanity, announced the opening of orb operations in sixteen new countries across sub-Saharan Africa and Southeast Asia.

The Worldcoin scene encapsulates a tension that runs through all three of the world's most significant digital identity projects: between the genuine utility of reliable digital identity for populations historically excluded from financial and administrative systems, and the structural power asymmetry created when a corporation or state captures the biometric data that makes that identity legible. The behavioral data extraction imperative is nowhere more concretely expressed than in the identity sector: the human body itself, its iris patterns, its fingerprints, its facial geometry, becomes the raw material from which behavioural and commercial intelligence is extracted, once the identity architecture is in place. The question of who controls the identity stack is the question of who controls the terms on which 8 billion people interact with the digital economy.

Worldcoin: Proof of Humanity as Market Capture

Sam Altman's Tools for Humanity launched Worldcoin in 2023 with a proposition that fused technological idealism with unmistakable commercial logic: in a world of increasingly capable AI systems that could impersonate humans at scale, a cryptographic proof of unique human identity would become essential infrastructure — and whoever built that infrastructure first would control a network of extraordinary value. The Worldcoin project's stated mission is "proof of personhood for the AI age"; its unstated commercial logic is the construction of the world's largest biometrically verified identity network, with the WLD token as both the incentive for enrolment and the medium through which network value is eventually monetised.

By April 2026, the project claims 27 million verified users across approximately 50 countries, with the heaviest concentration in markets where formal digital identity is weak and cryptocurrency as an economic hedge is rational — Kenya, Nigeria, Indonesia, Argentina, Chile. The demographic profile of Worldcoin's user base is not incidental to its political economy: the people most willing to exchange their iris biometrics for a cryptocurrency allocation are, overwhelmingly, those in the Global South who have the most to gain from financial inclusion and the least institutional recourse if the system fails or is abused.

Ruha Benjamin's race-after-technology framework is essential here. The orb's deployment pattern — concentrated in the Global South while regulatory obstruction in Europe limits expansion there — is not merely a business strategy responding to market demand. It is a spatial expression of who bears the risk of a new biometric technology. The GDPR's requirement for explicit, informed, freely given consent — a requirement the Spanish and Kenyan data protection authorities have found Worldcoin consistently fails to meet — exists precisely because regulators recognise that the power differential between a technology company and an individual seeking economic access makes "free" consent structurally coercive. The orb queue in Westlands is not a free market transaction. It is a transaction shaped by scarcity, exclusion, and the limited alternatives available to people who lack the formal documentation that would grant access to conventional financial systems.

Aadhaar: The State Identity Stack and Its Discontents

India's Aadhaar system, administered by the Unique Identification Authority of India, represents the largest biometric identity database in human history: 1.38 billion enrolments as of early 2026, covering virtually the entire Indian population. Its twelve-digit unique identifier, linked to fingerprint and iris biometrics, has become the foundational layer of Indian digital governance — required for access to subsidised food, cooking gas, banking, mobile SIM registration, pension disbursement, income tax filing, and an expanding range of both public services and private commercial transactions.

The Aadhaar system's achievements are genuinely significant: the Direct Benefit Transfer programme, which routes government subsidies directly to Aadhaar-linked bank accounts, is estimated to have prevented ghost-beneficiary fraud worth hundreds of billions of rupees annually, and has extended access to financial services to populations historically excluded by the cost and documentation requirements of formal banking. These are not trivial gains. But the architecture that produces these gains is one of total state legibility: the UIDAI holds the biometric master record, and every Aadhaar authentication transaction — every time a beneficiary scans their fingerprint to collect a food ration or a patient verifies identity at a hospital — is logged and potentially retained.

The critical observation that AI and biometric systems transform citizens into "data objects" subject to administrative classification is borne out in the Aadhaar record. A 2021 Supreme Court judgment upheld the system's constitutional validity while finding that mandatory linkage of Aadhaar to private commercial services (bank accounts, mobile SIMs) exceeded the state's legitimate interest — a distinction that has not significantly constrained the system's de facto universalisation of biometric authentication. The system's exclusion failures — cases where beneficiaries were denied food rations or pension payments because their fingerprints were worn, wet, or algorithmically mismatched — have been documented extensively by civil society organisations and represent a form of algorithmic disenfranchisement that falls disproportionately on agricultural labourers, the elderly, and manual workers.

The eIDAS Wallet: Democratic Identity or Surveillance Infrastructure?

The European Union's revised eIDAS regulation, which entered its implementation phase in 2025, mandates that EU member states provide every citizen with access to a digital identity wallet — a smartphone application containing a cryptographic representation of their government-issued identity credentials, capable of use for both public services and private commercial authentication. The wallet is designed to be "selective disclosure" capable: a user presenting proof of age to an online retailer need only reveal that they are above the threshold age, not their full date of birth or national identity number.

The architecture's privacy design is sophisticated, and the civil liberties community's engagement in shaping the eIDAS 2.0 standard produced meaningful improvements over the initial Commission proposal. But the implementation reality is generating concern on several fronts. The eIDAS wallet's reliance on the "national root of trust" — each member state's identity authority as the cryptographic anchor — creates a technical mechanism for government access to authentication logs that the wallet's privacy-by-design claims do not definitively foreclose. The proposed "trust anchor" model for private sector relying parties, which would require major platforms to accept the eIDAS wallet for user authentication, effectively mandates interoperability with a government-issued credential system — a requirement that privacy advocates have characterised as creating state-accessible identity infrastructure through the backdoor of convenience.

The black box critique applies to the wallet's algorithmic underpinnings: the selective disclosure protocols, the revocation mechanisms, the logging architecture — these are technical decisions with profound civil liberties implications that are being made by standards bodies and implementation consortia operating with minimal democratic oversight. The Brussels Effect dynamic cuts both ways here: an eIDAS wallet standard that encodes surveillance-compatible design choices, once adopted as a global model by countries seeking to align their digital identity frameworks with European standards, exports those design choices globally.

Stakes: The Body as Infrastructure

The convergence of Worldcoin, Aadhaar, and eIDAS illuminates a structural shift in the nature of identity itself: from a claim that an individual makes about themselves, corroborated by social networks and institutional records, to a biometric fact stored in a database controlled by a corporation or state. This shift is not neutral. It changes the power relationship between the person and the entity that controls the identity record — making the person's access to services, benefits, and markets contingent on the continued operation of and their standing in systems they did not design and cannot audit.

A mission-economy framework suggests what a genuinely public alternative might look like: identity infrastructure designed as a public utility, with democratic governance, independent audit rights, technical architecture mandating cryptographic unlinkability of authentication events, and a genuine opt-out mechanism that does not result in exclusion from essential services. None of the three systems examined here fully meets that standard. Worldcoin is venture-capital-funded infrastructure with a commercial endgame that has not been disclosed. Aadhaar is state infrastructure with legitimate efficiency achievements and documented exclusion failures, operating without independent judicial oversight of its data retention practices. eIDAS is a regulatory mandate built on member-state implementation that varies widely in its privacy commitments.

The iris in the orb, the fingerprint on the food ration scanner, the cryptographic certificate in the digital wallet — these are three ways of answering the same question: who are you, and who gets to know? The answer, in each case, is being determined not by the individual whose body is scanned but by the political economy of the system that processes the scan.

The Monexus tech desk covers digital identity through the lens of structural power and biometric risk, rather than the "financial inclusion" framing that platform corporations and state agencies deploy to foreclose scrutiny.