Rapid technological advancement has shifted human interaction into the digital realm, highlighting the critical need for robust legal sovereignty and data protection. This normative legal research analyzes the legal liability of digital operators conducting unauthorized biometric data collection in Indonesia, focusing on the WorldCoin case involving PT Terang Bulan Abadi (TBA). Although the WorldCoin application officially holds an Electronic System Operator Certificate (TDPSE) registered under PT Sandina Abadi Nusantara (SAN), actual field operations specifically biometric iris scanning via "Orb" devices were fully executed by PT TBA, an entity lacking independent TDPSE registration. Utilizing statute and conceptual approaches, this study examines the legal consequences of such legal authorization transfers under Indonesian positive law. The findings reveal that TDPSE registration is intuitu personae (inherently attached to the specific applicant entity) and non-transferable. Consequently, PT TBA’s unauthorized utilization of PT SAN's legal credentials constitutes a multi-layered legal violation. Civilly, PT TBA is liable for Unlawful Acts (Perbuatan Melawan Hukum) under Article 1365 of the Indonesian Civil Code and Article 12 of the Personal Data Protection (PDP) Law, entitling data subjects to compensation. Criminally, using another entity's legal credentials violates Article 35 of the Information and Electronic Transactions (ITE) Law regarding digital manipulation. Furthermore, unpermitted collection of sensitive biometric iris data violates Article 65 paragraph (1) of the PDP Law, carrying criminal penalties under Article 67 paragraph (1). The study recommends strict regulatory updates prohibiting TDPSE transfers, mandatory compliance audits via Regulatory Technology (RegTech), and active supervision by an independent PDP agency.