No Consent, No Data: Kenya Orders Worldcoin to Delete Biometric Data Over Privacy Violations

Court Orders Worldcoin to Erase Kenyan Biometric Data After Illegal Collection

Worldcoin's controversial biometric data collection project in Kenya has faced a significant setback, as the High Court has ordered the company to delete the biometric data it unlawfully gathered from Kenyan citizens.

The court found that cryptocurrency-linked identity project’s use breached Kenyan data protection laws, setting the stage for a wider regulatory crackdown.

The decision, made on 5 May, also highlighted the absence of valid consent from individuals who participated in the data-gathering process, a requirement under the Kenyan Data Protection Act of 2019.

Worldcoin's Operations Under Legal Scrutiny

Worldcoin, which used orbs to scan individuals' irises and faces in exchange for $50 worth of cryptocurrency, began its operations in Kenya in September 2023.

However, the company’s activities quickly faced scrutiny, as it failed to comply with Kenya's Data Protection Act, specifically Section 31, which mandates a Data Protection Impact Assessment (DPIA) before processing personal data.

Lady Justice Aburili Roselyne issued a ruling compelling the company to delete all biometric data collected from Kenyan citizens.

The court emphasised the importance of protecting personal data and ensuring that individuals give valid consent before any such data is processed.

Furthermore, the Office of the Data Protection Commissioner (ODPC) will oversee the deletion process to ensure compliance with the ruling.

Concerns Over Lack of Transparency and Safety

During the proceedings, the ODPC highlighted serious concerns about Worldcoin’s handling of personal data.

Deputy Data Commissioner Oscar Otieno, in his affidavit, stated that the processing of biometric data without a proper assessment and consent posed significant risks to the public.

He affirmed that the company’s activities had been unsafe for Kenyans, citing the lack of transparency and security measures.

The court’s order also includes a mandate prohibiting Worldcoin from processing any further biometric data in Kenya unless it conducts a comprehensive DPIA and obtains valid consent from users.

These measures are in line with Kenya’s strict data protection regulations, which are designed to prevent unauthorised use and misuse of personal information.

The Legal Fallout for Worldcoin

This ruling adds to the growing list of challenges Worldcoin has faced in its operations across the globe.

In Kenya, the company had been forced to halt its registration process after large crowds gathered in Nairobi's Central Business District to have their irises and faces scanned.

The government intervened, citing concerns over data security and the potential for misuse.

Despite this setback, Worldcoin’s parent company, Tools for Humanity, announced in 2024 that it intended to resume operations in Kenya, following the Director of Public Prosecutions' decision to close an investigation into the project.

However, with this new court order, the company will now need to meet strict legal requirements before it can continue its work in the country.

Global Setbacks for Worldcoin

Worldcoin’s issues are not limited to Kenya.

The company has faced increasing regulatory pressure in other countries as well.

In Indonesia, Worldcoin’s activities were suspended on 4 May 2025, due to concerns over the misuse of outdated registration documents and potential data risks.

The Ministry of Communication and Informatics in Indonesia launched an investigation into the company’s compliance with local data protection laws.

Worldcoin’s troubles also extend to Hong Kong, where the Privacy Commissioner for Personal Data ordered the company to stop collecting iris and face images in 2024, citing privacy violations.

Similarly, Spain and Portugal have suspended the company’s activities over concerns regarding the protection of minors' data, with Portugal specifically highlighting the need for improved safeguards for children.

Worldcoin's Struggles With Data Protection

The legal challenges faced by Worldcoin reflect the growing concerns about data privacy and the handling of biometric information in an increasingly digital world.

While the company claims that the data it collects is encrypted and secure, its operations have raised alarms over potential breaches and the lack of informed consent from users.

With regulatory bodies around the world tightening their scrutiny of the project, Worldcoin now faces an uphill battle to regain trust and meet the legal standards required to continue its operations in countries like Kenya and Indonesia.