They Paid $10 for Her Iris Scan. Now Her City Wants $47 Million Back.

They scanned the eyes of four hundred thousand people in São Paulo. Most of them lived in low-income neighborhoods. And in exchange for a permanent scan of their iris, the colored ring around your pupil, they got about ten dollars in cryptocurrency.

The city wants forty-seven million dollars back

Now the city wants forty-seven million dollars back.

Here's why this reaches past Brazil. If you've ever unlocked your phone with your face or your thumb, you've already handed over a piece of your body as a password. The difference with an iris scan is simple. You can change a stolen password. You can't change your eyes. Prosecutors in São Paulo say the people who ran this program didn't clearly tell residents where that data would go, how it would be stored, or that it would leave the country. So the question threading through this whole case is this, when a company pays you for your body, is that consent, or is it a purchase?

Let's start with the money. The people signing up weren't wealthy. Prosecutors say the program targeted neighborhoods where ten dollars matters. That's the first thing the lawsuit hits, the argument that a small payment to someone who's struggling isn't a free choice. It's leverage. For the rest of us, it raises an uncomfortable point. If a price tag can buy your iris, what's yours worth on a bad week?

Then there's the paper trail

Then there's the paper trail. The case grew out of a São Paulo City Council investigation. Investigators found the operators kept offering rewards through their app, even after Brazil's national data protection authority ordered them to stop the financial incentives. Read that again. A regulator said stop paying. The payments continued. That single fact is what turns a privacy complaint into a lawsuit with teeth.

The third piece is where the data actually lived. Prosecutors say residents were never clearly told their scans would be sent abroad and stored on Amazon's cloud servers. That matters because of one rule that shows up everywhere, from Europe to Brazil to a growing list of U.S. states. Consent to hand over biometric data has to be freely given, specific, and informed. A checkbox during signup doesn't count. And if you didn't know your eye scan crossed an ocean, you couldn't have agreed to it.

This isn't only a Brazil problem. In the U.S., states like Colorado have passed laws modeled on Illinois. They demand real consent. They cap how long a company can keep your biometric data at about three years. And they let ordinary people sue for violations, the kind of lawsuits that get expensive fast. So the next time an app asks to scan your face or your fingerprint, three questions should follow. What are they taking? Where does it go? And can you make them delete it?