The country's data protection watchdog, AEPD, has effectively banned Worldcoin for up to three months in a move that the organisation says is "circumventing EU law".
Launched last year, Worldcoin distributes tokens to people "just for being a unique individual".
To prove their uniqueness and get the token, people have their eyeballs scanned by a piece of hardware called "The Orb".
AEPD says it has received several complaints about the project, including that insufficient information is provided to users, that data from minors is collected, and that consent cannot be withdrawn.
The regulator says that the processing of biometric data, which has special protection under the European Union's General Data Protection Regulation (GDPR), "entails high risks to the rights of individuals".
It has therefore taken urgent measures "in order to avoid potentially irreparable damage".
In a statement, Worldcoin data protection officer Jannick Preiwisch says: “Our efforts to engage with the AEPD and provide them with an accurate view of Worldcoin and World ID have gone unanswered for months,
“We are grateful to now have the opportunity to help them better understand the important facts regarding this essential and lawful technology.”
Worldcoin has been liaising with the Bavarian state authority in Germany, which has jurisdiction and has been investigating the venture.