Kenya Court Orders WorldCoin to Delete 300,000 Biometric Records

On May 5, 2025, the High Court of Kenya issued a landmark ruling, declaring the collection and processing of biometric data by WorldCoin, a cryptocurrency and digital identity platform, unconstitutional and illegal under Kenyan law. Justice Roselyne Aburili ordered the immediate deletion of all biometric data, including iris scans and facial images, collected from over 300,000 Kenyans. This data must be deleted under the supervision of the Office of the Data Protection Commissioner (ODPC).

The case was initiated by the Katiba Institute and the Kenyan Section of the International Commission of Jurists, who challenged WorldCoin’s practice of collecting sensitive biometric data through its “Orb” device in exchange for cryptocurrency tokens valued at approximately $55 USD. Launched in Kenya in 2022, the initiative attracted thousands of citizens who queued to have their irises scanned, lured by the promise of financial reward amidst economic hardship. However, concerns quickly surfaced regarding the project’s compliance with Kenya’s Data Protection Act of 2019, which mandates strict safeguards for personal data, including informed consent and a Data Protection Impact Assessment (DPIA) prior to collection.

Justice Aburili’s ruling highlighted multiple violations by WorldCoin and its parent entities, Tools for Humanity Corporation and Tools for Humanity GmbH. The court found that the company failed to conduct a DPIA, neglected to register as a data processor with the ODPC, and obtained consent through inducement rather than freely given agreement—practices that contravened both Kenyan law and international data protection principles. The judge emphasized the irreversible nature of biometric identifiers like iris scans, which, unlike passwords, cannot be changed if compromised.

The court’s order prohibits WorldCoin from further collecting or processing biometric data in Kenya without a proper DPIA and valid consent mechanisms in place. Additionally, it mandates the supervised destruction of all previously collected data, a move hailed by civil society groups as a critical step in safeguarding Kenyans’ privacy. “This judgment reinforces the importance of ethical practices in the deployment of emerging technologies,” said a spokesperson for the Katiba Institute, which led the judicial review.

WorldCoin’s entry into Kenya had initially sparked excitement, with the platform positioning itself as a revolutionary tool to provide universal access to the global economy through a blockchain-based digital ID. However, the project faced mounting scrutiny after the Kenyan government suspended its operations in August 2023, citing potential risks to national security and data integrity. A multi-agency investigation followed, revealing that the company had continued processing data despite a cessation directive from the ODPC, prompting further legal action.

The ruling aligns Kenya with a growing global pushback against WorldCoin’s biometric data practices. Countries have imposed restrictions or fines on the company for similar privacy violations. These developments underscore the ethical and regulatory challenges facing tech initiatives that rely on biometric data, particularly in regions with vulnerable populations.

For Kenyans who participated in the program, the decision brings mixed implications. While some welcomed the financial incentive during a period of economic strain, others expressed relief at the court’s intervention. The lack of transparency around data storage—spanning jurisdictions—had fueled fears of potential breaches or misuse.

WorldCoin has yet to issue an official response to the ruling, though its previous statements have emphasized a commitment to privacy-preserving technology. The company’s chief legal officer had earlier indicated plans to resume operations in Kenya following a decision to close a criminal probe into the project. However, today’s judgment effectively halts such ambitions unless WorldCoin complies with stringent new requirements.

Legal experts predict the ruling will set a precedent for how Kenya handles digital identity projects in the future. “This is a wake-up call for tech companies operating in Africa,” said a prominent digital rights lawyer. “You cannot bypass local laws or exploit economic desperation to harvest sensitive data.” The ODPC, tasked with overseeing the data deletion, has been urged to strengthen enforcement and public awareness around data rights.