By Heath Muchena · Sources reviewed 13 November 2026 · Original DN analysis and illustrative records
What Matters
Ask which representation is stored, by whom and under which claim. A biometric image, derived template, computation fragment and public proof artifact need separate records. Deletion of one copy does not describe every other artifact.
Proof-of-personhood systems are often described with a short list of terms: biometrics, hashes, zero-knowledge proofs and decentralization. Those words do not tell a reader where a particular representation resides or what remains after an account changes.
This guide uses current public World documentation as an architecture example and UK ICO guidance for a limited identifiability distinction. It is neither an independent audit of World nor a legal or privacy rating. The DN map never accepts biometric material or connects to a user account.
The DN thesis
The useful unit of review is one representation at one holder and location. Keep a provider claim, an inspection result and a statement about other copies separate. That structure makes a narrow question answerable without pretending the whole system has been verified.
1. State what the proof is meant to establish
Start with the actual question. A service may want evidence of uniqueness within a scheme, a minimum age, a credential or control of an identifier. Those propositions are different from knowing a legal name, trusting every future action or deciding whether software has legal personality.
W3C’s DID standard describes identifiers, subjects and controller/verification relationships. It does not turn a digital identifier into a legal person. [6] Similarly, a claim that an action comes from a verified human should be assessed within the particular system’s rules and assurance boundary.
Write the proposition and the relying service in the record. Ask whether the service needs the underlying data or only evidence of a property. This first step prevents a discussion of “identity” from silently expanding into a request for photographs, a complete profile or unrelated transaction history.
2. Distinguish the image from every derived artifact
A statement that “biometrics are onchain” can collapse several different objects. A raw image, a derived template, a fragment used in multiparty computation, a public commitment and a proof output are not interchangeable records. Each needs its own description.
World’s 2026 whitepaper describes a personal-custody package containing images, embeddings and MPC fragments, alongside a proof architecture with a public commitment, zero-knowledge proof and nullifier. [2] This supports inspecting the representations separately. It does not establish that all proof-of-personhood providers use that architecture.
In a review, avoid treating the word “hash” as a sufficient data definition. Record what input it represents, where the relevant secrets or mappings reside, what it can be linked to and which party can use it. If those details are missing, label the artifact unknown rather than filling in the design from a marketing diagram.
3. Map one representation to one holder and location
Create a separate row for each meaningful holder and storage boundary. “On my device” describes one location; it does not automatically describe a processing service, a backup or a proof registry. “Decentralized” describes a design property, not a complete recipient inventory.
World’s current FAQ describes images being sent to the user’s device and deleted from the Orb, with MPC fragments used by the uniqueness service. [1] Its privacy page separately describes shares compared across independent compute nodes. [3] Those are vendor descriptions of different handling stages, not a reason to assume one universal storage location.
Use aliases for holders in this worksheet. Keep the actual operator names, region, product version, evidence date and supporting documents in a controlled review file. Repeat the record for another representation or holder instead of trying to make one row stand for an entire system.
4. Check the audience and linkage, not just encryption
Ask who receives the artifact and what additional information they can combine with it. The same representation may reveal different things to different holders. A recipient with a mapping, account history or other context is not necessarily in the same position as a public observer.
The ICO’s current UK guidance distinguishes pseudonymisation from anonymisation and explains the role of separately held information. It also notes that information may have different identifiability in another recipient’s hands. [5] This is a reason for context-specific review, not a legal classification produced by a hash function.
Keep two questions separate: whether underlying data is disclosed, and whether uses can be linked. A proof may limit one disclosure while an application independently collects a username, payment address or telemetry. Record those separate flows rather than attributing every application behavior to the proof protocol.
The instrument does not attempt re-identification or inspect anyone’s biometrics. It records the limits of a claim so a qualified review can ask the next question.
5. Read the exact scope of a deletion statement
“Delete my account,” “remove this optional field” and “erase every copy of this representation” describe different actions. Ask what object, holder, location and observation time the statement covers. Preserve a request acknowledgement separately from evidence about the resulting state.
World Money’s current help page explicitly distinguishes account deletion from data deletion and describes exceptions and a process that can take time. [4] That page should not be treated as a universal erasure specification for all World ID, MPC or public-registry artifacts.
A device image marked deleted and a separate fragment retained elsewhere need separate records. Their coexistence is not automatically a contradiction if the deletion claim concerned only the device image. Conversely, an all-copies claim needs evidence covering the declared copies; a report that one remains should not be hidden.
An empty screen is also a bounded observation. It may show that a record is no longer accessible through that interface. It does not, on its own, establish the state of every backup or other system.
6. Preserve the evidence and the unanswered question
A useful review can end with an unresolved question. Record the product version, source date and exact statement, then identify the missing evidence. That is more reliable than giving a system a privacy score because its documentation contains cryptographic terminology.
Separate a provider’s public description, an independent assessment and an observation from a particular deployment. A document may accurately describe an intended architecture without proving that every deployed instance follows it. An observation can also be too narrow to settle the provider’s broader claim.
Before delegating a disclosure, identify who owns the decision, what information the recipient needs and how changes will be reviewed. The worksheet does not authorize collection or deletion. It supplies a compact handoff: this artifact, this holder, this claim, this observation and this remaining boundary.
Keep legal questions scoped to the relevant jurisdiction and processing facts. The presence of a cryptographic transformation is evidence about a technique, not a universal conclusion that data-protection duties no longer apply.
DN Personhood Data-Location Map
Use one record for one representation, holder and location. Enter aliases only. No biometric data, private identifiers or raw logs belong here. The tool preserves unknowns and compares declared evidence boundaries; it does not discover copies or validate erasure.
No current calculation. Enter a record or load a labelled example.
This worksheet sends no entered values to a server, connects to no account and stores no input in browser storage. Downloads contain the entries you supplied. Use aliases rather than private data. Other site services remain subject to the site’s privacy policy.
Labelled examples and practical use
The first invented case concerns IMAGE-A on USER-DEVICE. The reader reports a this-copy deletion claim, an inspection that did not observe that image and another copy elsewhere. The tool keeps the absence observation conditional and notes the other-copy boundary. It does not call the system anonymous or declare the claim false merely because another copy exists.
Change the claim to all declared copies and the reported remaining copy becomes a record conflict. A different inspection context prevents comparison. A retained public commitment receives a separate boundary note rather than being labelled a stored biometric image. All six examples are fictional and contain no personal information.
Methodology, assumptions and limits
The model checks declared categories and references. A claim/observation comparison requires an artifact alias, both evidence references and a reader declaration of comparable context. A reported present artifact conflicts with a deleted or not-collected claim under that same declared context. A reported absence remains conditional. Different context is outside the comparison.
Copy scope is independent: a deleted-all-declared-copies claim conflicts with the entry that another copy remains; a this-copy claim does not. “No other copies reported” remains a reader statement, not a discovery result. There is no weighted risk score, anonymity test, biometric verification or legal conclusion.
Sources were reviewed on 13 November 2026. The World whitepaper is dated 25 March 2026 and may describe different protocol stages; the article does not resolve every release’s implementation. World’s older 2025 blog carries an age warning and is not used to establish today’s deletion behavior. ICO guidance is explicitly under review. No service account, actual data flow or deletion was tested.
Frequently asked questions
Does a public proof mean my raw image is onchain?
Not by itself. The representation needs to be identified. World’s architecture distinguishes personal-custody data from commitments and proof outputs. [2]
Is hashed data always anonymous?
No such universal conclusion follows. Identifiability depends on context, additional information and the holder; the ICO distinguishes pseudonymisation from anonymisation in its UK guidance. [5]
Does account deletion prove every artifact was erased?
No. Account and data-deletion scopes can differ. Inspect the named product’s terms and the precise object covered by the claim. [4]
Why does an absent observation remain conditional?
It describes an inspection boundary. The worksheet cannot discover backups, authenticate evidence or establish that no copy exists elsewhere.
Primary sources
Reviewed13November2026. A publication or export time does not refresh the evidence.
- World current FAQ — Vendor description of verification, personal custody and proof use; no independent privacy certification.
- World whitepapers, updated 25 March 2026 — Architecture distinctions among images, templates, MPC fragments, commitments, proofs and nullifiers.
- World privacy architecture page — Vendor description of secret shares and multiparty uniqueness checks; marketing assurances are not treated as audited outcomes.
- World Money: account deletion guidance — Named app’s account/data deletion distinction; not a universal erasure statement for every World artifact.
- ICO pseudonymisation guidance — UK context; identifiability depends on additional information and holder. Guidance is under review after the Data (Use and Access) Act.
- W3C DID Core — Identifiers and controllers are separate from legal personhood or biometric data storage.
Turn the unresolved question into a research brief
For a scoped review of the public documents behind a claim, explore the DN Research Desk. An enquiry is subject to agreed scope and capacity; it does not certify a deployment, establish an entitlement or commit you to a paid service.
Disclosure: this article promotes DN’s own research service. Commercial enquiries do not purchase a favorable conclusion. No external provider is promoted through an affiliate link here.
