Have you seen the Worldcoin or Humanity airdrop and felt the urge to scan your eyes or palm to claim it — but also felt a little uneasy?This guide won't tell you to rush off and claim it, nor will it just try to scare you. Instead, it first walks you through why these airdrops want to scan your body, the privacy risks behind them, how Worldcoin and Humanity compare, then points out the most real-world threat — fake airdrop scams — and finally helps you decide whether this airdrop is worth claiming at all.
What Are These Airdrops? Why Do They Scan Your Body
"It's just claiming an airdrop, so why do I have to scan my eyes or my palm?" Because what these projects are trying to solve is a long-standing problem in the blockchain world — how to prove that there's a real human behind the screen, and not a swarm of bot accounts controlled by one person.Get this underlying logic first, and you'll understand what you're handing over and what you're getting in return.
Using Biometrics for "Proof-of-Personhood"
Worldcoin and Humanity Protocol are trying to build a digital identity system that can "prove you're a unique, real human." In the space, this concept is called Proof-of-Personhood.It sounds abstract, but the problem it tackles is very concrete: online, one person can easily register thousands of accounts, and the traditional username-and-password approach simply can't tell who's a real human and who's part of a bot army.
To separate real humans from bots, these projects chose to use biometrics as their basis for identification, because features like the iris and palm print are nearly unique to every person and hard to forge, so they can ensure that "the same person can only verify once." And to get people to willingly go through verification, they use a token airdrop as the incentive.So here's the essence you need to see through first: the airdrop is the candy; what the project team really wants is your biometric verification.Once you understand this, your angle on these airdrops shifts from "there are free tokens to grab" to "do I want to trade my biometric data for these tokens."
Worldcoin Scans Your Iris, Humanity Scans Your Palm
Even though both do proof-of-personhood, different projects collect biometrics in different ways, and the sense of intrusion varies a lot.Worldcoin's approach is to use a spherical device called the Orb to scan your iris. The project was started by OpenAI's founder Sam Altman, so it's well-known and generates a lot of buzz — but the image of "scanning your eyes into a ball" itself makes quite a few people uneasy.
Humanity Protocol took a different path, focusing on using your phone to scan the veins in your palm for verification, and it touts that it uses zero-knowledge proofs (a technology that lets you complete verification without exposing the original data) to protect your data, claiming to be less intrusive and less controversial than scanning your iris. I personally take this difference seriously: even though both involve handing over biometrics, the iris and the palm print don't carry the same level of sensitivity or public acceptance, so before choosing, it's worth thinking through which collection method you're more comfortable with, and why.
The Airdrop Is an Incentive, Not a Free Lunch
Many beginners hear "airdrop" and instinctively think, "free tokens, why not grab them," but this kind of airdrop that you trade biometrics for is precisely the kind you should never treat as "free".The price you pay is handing over a permanent, unique piece of your biometric data to a third-party system you may not fully understand, to store and use.
What makes this price special is that it's completely different from the passwords you use every day. If a password leaks, you can just set a new one; but the iris and palm print — these kinds of biometrics — are born on your body and can never be changed. Once collected and linked into a system, you have almost no way to take them back or reset them. So whether this trade is worth it — the point was never how much that airdrop is worth right now, but whether you're willing to trade something permanent and irreversible for tokens whose value is still full of uncertainty.Get this balance right, and every judgment that follows will actually mean something.
Before You Scan Your Eyes, Understand the Privacy Risks
"The project team says the data is encrypted and protected, so is it safe and fine to scan?" This is exactly where you should stop and think carefully before scanning.Privacy risk isn't just as simple as "will it get stolen by hackers." It also involves how regulators in different countries view it and what your biometric data might be used for in the future — you have to look at all these layers together.
Regulatory Concerns Across Countries Are No Small Matter
Worldcoin's iris collection has already triggered regulators to step in across more than one region over the past year or two, and this is the signal beginners should pay the most attention to.For example, Hong Kong's Privacy Commissioner's Office once found that Worldcoin's collection of iris and facial images was "not necessary" and the means were "disproportionate," violating local privacy protection rules; Germany's regulator has also warned that this kind of device that collects biometrics at massive scale carries the concern of being used for long-term surveillance beyond simple identity verification.
The reason I place special weight on the regulatory angle is that these bodies take a relatively conservative stance and have no incentive to claim an airdrop — they're examining this purely from the angle of "protecting ordinary people."When regulators in multiple different regions all independently hit the brakes on the same collection method, that consensus itself is a warning light beginners should take note of.It doesn't necessarily mean the project is malicious, but it at least tells you: even professional regulators believe the privacy risk here shouldn't be underestimated, so you have even less reason to hand over your iris with your eyes closed.
Does "Only Storing a Hash" Equal Safety
Faced with privacy questions, a common line from project teams is: we don't directly store your original biometric image, we only keep a "hash" generated by computation that can't be reversed back into the original image, which greatly reduces the risk of misuse if the data leaks.This design does have its merits, and technically it does reduce some of the risk, which deserves credit.
But I won't drop my guard completely just because I hear that line. The reason is that how a system is designed is one thing, but how it's actually implemented, whether future policy will change, and whether the company will be acquired or change hands are another matter entirely — none of these are within your control. More critically, once your biometrics are linked into a global digital identity system, that connection is very hard to truly sever or take back. So my stance is clear: technical protection is of course a plus, but it shouldn't be your only reason for being willing to hand over your iris.Treat it as a "measure that reduces risk," not as a guarantee that "the risk is already zero", and your judgment won't be led astray by a marketing slogan.
What You Hand Over Is Something You Can't Change
Back to the most core point of privacy risk: compared with the other data you leave online, biometrics are special in that they're irreversible. If your email leaks you can switch inboxes, if your password is stolen you can reset it, you can even change your phone number, but your iris and palm print are bound to your body for life — there's no option to "apply for a new set."
This means the act of handing over biometrics has long-term, even permanent consequences, and no one can promise you where the project you're facing today and the company behind it will head in the future, or whether they'll always maintain the level of protection they promise now. I'd suggest beginners use a simple question to help make the decision: if one day this data really goes wrong, and I can't change it, can I afford that cost?Push the question this far, and whether and why you hand it over will be clear in your mind, instead of being led by the nose by an airdrop.
Worldcoin vs. Humanity — Which Is the Better Choice
"If I really do want to participate, how should I compare and choose between these two projects?" Rather than only looking at which airdrop shouts the loudest, it's better to lay out each one's collection method, privacy design, and level of controversy side by side.Only by seeing the differences clearly can you judge which one (if any) comes closest to a line you can accept.
Different Collection Methods, Very Different Sense of Intrusion
The most intuitive difference lies in how they collect biometrics.Worldcoin requires you to walk up to an Orb device in person and let that ball scan your iris; Humanity Protocol focuses on using your own phone to scan your palm veins, so the whole process is relatively lightweight and doesn't require you to go find a specific device.On this point alone, the psychological feeling the two give people differs noticeably.
For many beginners, the image of "scanning your eyes into an unfamiliar ball" is inherently more stressful than "scanning your own palm with your phone," because the eye is a highly sensitive organ, and the iris is often seen as a more core identity feature than the palm print. I personally treat this instinctive discomfort as a useful signal: if a collection method makes you uneasy just imagining it, then its privacy cost is inherently higher for you than the other one.Before choosing, being honest about which method you find more off-putting is more practical than trusting either side's marketing.
The Gap in Privacy Design and Level of Controversy
Beyond the collection method, the two projects' approaches to privacy design are also worth comparing.Humanity Protocol focuses on using zero-knowledge proofs to protect data, and it makes "less intrusive and less controversial than scanning your iris" one of its selling points; Worldcoin, although it also emphasizes only keeping hashes and not storing original images, has accumulated noticeably more regulatory controversy and public scrutiny because it started early, operates at scale, and scans the iris.
That said, let me add one reminder: less controversy doesn't fully equal lower risk. A project with low exposure and a short track record naturally has fewer chances of drawing regulatory attention, but that doesn't mean its privacy protection is more solid.Zero-knowledge proofs sound advanced, but how they're actually implemented and whether they've been tested enough is something beginners find hard to verify on their own. So I treat "level of controversy" as a reference, not as a conclusion — it tells you which project is currently being scrutinized more fiercely, but it shouldn't mislead you into thinking the other is therefore perfectly safe.
Before Choosing Which One, Ask "Whether to Choose at All"
After comparing both collection methods and privacy designs, I actually want to pull the question back one step further: before agonizing over "Worldcoin or Humanity," it's more worthwhile to first ask yourself "do I even want to hand over my biometrics to participate in this kind of project at all."Because no matter which one you pick in the end, you're essentially trading a permanent piece of biometric data for tokens whose value is still uncertain.
If the answer is "I'm not sure, or I'm not really willing," then which project is less intrusive doesn't mean much to you — you can simply choose not to participate for now and keep watching.An airdrop isn't a limited-time offer you must grab; missing this round isn't the end of the world. By contrast, biometrics are very hard to take back once handed over.My order has always been decide whether to do it first, then decide how to do it and which project to use. Flip that order around, and it's easy to quietly default to "I have to pick one anyway" in the middle of "comparing which is better" — and that's the thinking trap you most need to avoid.
The Most Real-World Risk: Fake Airdrop Scams
"Even if I accept the privacy risk and decide to participate, what else absolutely must I guard against?" The answer is fake airdrop scams that ride the wave of hype. Whenever this kind of project is hot, scammers impersonate the official channel en masse and set up fake pages — this is where beginners are most likely to directly lose assets in a short span of time, more immediate and more vicious than the privacy risk.
What Fake Verification and Fake Claim Pages Look Like
The most common scam tactic is to build a "verification" or "claim airdrop" page that looks almost exactly like the official one, then find a way to shove the link in front of you.They copy the official visuals, wording, and flow as closely as possible, making it hard to tell real from fake at first glance, and once you let your guard down and start operating, the trap springs.
In practice, when you see any of the following situations, you should raise a red flag and be on high alert:
- A stranger DMs you and sends a link saying "verify now, claim your airdrop right away."
- The page keeps pushing you to act within a time limit, stressing "limited spots," "about to close," "void after expiry."
- It asks you to connect your wallet and sign some approval, or outright asks you to enter your seed phrase or private key.
The common thread behind these features is "manufacturing urgency and guiding you to hand over control." Remember one bottom line: a genuine official verification flow will never ask you to hand over your private key or seed phrase, and won't use a countdown to force you to rush through the process in a few minutes.Whenever you catch either of these vibes, just assume it's fake.
Always Pause Before Connecting a Wallet or Signing an Approval
Here's a key point many beginners don't realize: the real target of these fake airdrop scams is often not your biometrics, but the actual assets in your wallet.They wear the coat of "claiming an airdrop," but the way they harvest is by tricking you into handing over control of your wallet with your own hands.
Once you connect your wallet on a fake page and carelessly sign a malicious approval, the other party can transfer the tokens out of your wallet without you noticing, and afterward there's almost no way to recover them. So I've set myself an iron rule: any page that, in the name of "claiming an airdrop," asks me to connect a wallet or sign an approval, I treat as a scam by default, and I go back to the official channels I'm familiar with to re-confirm the source before deciding whether to act.Spending those extra few dozen seconds to stop and check is far more worth it than regretting it after your assets are wiped out.
Entering Only Through Official Channels Blocks Most of Them
The most effective and least effortful habit for guarding against fake airdrops boils down to one line: only enter through the official source.To participate in this kind of project, you must find the entry point yourself from the project's official website and official community accounts, rather than clicking links others send you privately, or casually trusting those obscure, top-ranked sites in search results — paid ads and copycat sites often hide right there.
Specifically, manually confirm and bookmark the official domain yourself, and check the URL for tampering before every operation; for community accounts, make sure they have official verification and that the follower count and post history are reasonable, so you don't get fooled by a lookalike account that popped up out of nowhere.Lock down "the correct entry point" first, then talk about whether to verify or claim, and you can block the vast majority of fake airdrops at the source.Get the order wrong, and all the caution afterward may be for nothing.
In the End, Should You Claim This Airdrop
"I've looked at privacy, regulation, and scams — so should I go claim this airdrop or not?"This section won't decide for you, but gives you a judgment framework you can follow yourself, distilling everything above into a few questions to ask yourself before acting, to help you make a choice you won't regret later.
First Separate "Can I Claim" from "Should I Claim"
The first thing is to separate two questions that often get conflated: can you claim, and should you claim."Can you claim" is about eligibility and operation — whether it's open in your region, whether there's a corresponding verification device or method, whether the process works; "should you claim" is about whether you're willing to bear the privacy and security cost behind it.The answers to these two can be completely different.
Many beginners, the moment they see "looks like I can claim it here," jump straight to "then let's go claim it," skipping the "should I claim it" checkpoint. But this is exactly where this kind of airdrop most needs you to slow down. I'd suggest you fix the order like this: confirming eligibility first only tells you "whether this door is open," and whether to walk through it has to be weighed against the privacy risk, regulatory concerns, and your own personal acceptance — not walked into automatically just because the door is open.Ask these two questions separately, and you won't be pushed by the line "I can claim it anyway" into a decision you may not have wanted to make.
A Self-Check to Run Before You Act
If you're already leaning toward participating, then before you actually hand over your biometrics or connect your wallet on any page, I'd suggest you quickly run through the following questions, so you don't get swept along by the moment's hype or community mood:
- Do I clearly understand what I'm handing over? It's an unchangeable iris or palm print, not just a password I can reset.
- If this biometric data goes wrong in the future and I can't get it back, can I afford that cost?
- Am I sure the entry I'm going through is the official one? Have I checked the URL and the community account?
- Is this page asking me to hand over my private key, sign an approval, or using a time limit to force me to rush?
Once you can answer all of these and pass each one, deciding how to act will be far steadier than rushing to verify and connect your wallet the moment you see an airdrop.The quality of a judgment often comes not from how fast you act, but from whether you asked yourself clearly before acting.
If You're Unsure, Don't Rush to Hand It Over
Finally, let me say the plainest but most easily overlooked thing: if after reading all this you're still on the fence and can't make up your mind, then "don't rush to hand it over just yet" is itself a perfectly reasonable, even smarter, choice.What airdrops exploit best is the sense of urgency that "if you don't claim now, you'll miss out," but biometrics and privacy aren't limited-time goods — there's no such thing as "void after expiry" for them.
You can absolutely choose to hold off for now and keep watching where these projects head next — their regulatory direction, privacy incidents, and actual development — and once you understand them more deeply and feel more at ease, it won't be too late to decide whether to participate.The worst outcome of missing one round of an airdrop is earning a bit less in tokens whose value is still uncertain; whereas handing over unchangeable biometrics without thinking it through, or getting your wallet wiped out on a fake page, could cost you far more.Get this sense of proportion right, and you won't make a rushed decision — one whose consequences only you have to bear — in the middle of someone else's FOMO.
Conclusion
This guide has walked you through what Worldcoin, Humanity, and other proof-of-personhood airdrops that rely on biometrics really are: they use tokens as bait, and what they trade for is that unchangeable iris or palm print of yours.Whether you can claim is a matter of eligibility; whether you should claim requires you to weigh the privacy risk, regulatory concerns across countries, and the differences between the two projects in collection method and level of controversy.More immediate than all of that are the fake airdrop scams that surge in with the hype — when you see a page asking you to connect a wallet, sign an approval, or using a time limit to force you to act, stopping first and trusting only official sources matters far more than rushing to grab that airdrop. Put the checkpoint of whether to hand over your biometrics ahead of claiming the airdrop, and only then can you make a choice you won't regret afterward.
