“The legality of this [data] collection seems questionable, as do the conditions for preservation of biometric data,” a CNIL spokesperson said in a written statement, referring to Worldcoin’s practise of scanning retinas to ensure that no single person can claim crypto rewards twice.