Spanish data protection authority AEPD has ordered Worldcoin to delete all iris scan data collected since the project’s inception due to privacy concerns.

Thursday’s directive follows a similar decision by Germany’s data protection authority, which found the company in violation of the European Union’s General Data Protection Regulation.

Worldcoin, now known as “World,” was co-founded in 2019 by OpenAI CEO Sam Altman, aims to create a global identity system by scanning irises in exchange for digital IDs and free cryptocurrency.

The initiative, which has its European headquarters in Erlangen, Germany, has faced criticism in multiple countries.