Bavaria's data regulator has directed Worldcoin to establish a GDPR-compliant data deletion protocol by January's end.