This preprint presents an analysis of the Worldcoin project in Portugal, focusing on legal, ethical, and social implications of biometric data collection within the context of the European GDPR. The study examines CNPD deliberations, Worldcoin’s official documentation, and an empirical survey conducted with Portuguese users. Results indicate significant transparency issues, inadequate mechanisms for user consent and data deletion, and disproportionate risks for socially and digitally vulnerable groups. Findings suggest that Worldcoin’s practices do not fully comply with GDPR principles, raising questions about biometric governance and digital inequality in the European context.