Kenya’s Data Watchdog Confirms Complete Erasure of Citizen Biometrics Held by WorldCoin
NAIROBI — In an enforcement of digital privacy rights, Kenya’s data protection authority has confirmed the complete and verified deletion of sensitive biometric information belonging to its citizens, which was collected by the controversial cryptocurrency project WorldCoin.
The Office of the Data Protection Commissioner (ODPC) announced that Tools for Humanity, WorldCoin’s parent company, has erased all iris and facial scan data it gathered from Kenyans. This decisive action follows a court order and a rigorous compliance audit, marking a significant test of Kenya’s 2019 Data Protection Act.
“This case has been a pivotal moment for data privacy in Kenya,” said a spokesperson familiar with the regulator’s work. “It demonstrates our legal framework’s capacity to hold powerful international entities accountable and protect the fundamental rights of our citizens.”
Legal Process Followed
WorldCoin’s operations, which involved scanning people’s irises with spherical devices called ‘Orbs’ in exchange for cryptocurrency rewards, drew massive queues at locations like the KICC in Nairobi in mid-2023. However, the project quickly attracted scrutiny from regulators, lawmakers, and privacy advocates.
The program was halted by the government in August 2023 over profound privacy and security concerns. The matter was then taken to court by local rights organizations, including the Katiba Institute.
In a decisive ruling in May 2025, the High Court declared WorldCoin’s data collection unlawful. The court found the company had:
- Failed to conduct a mandatory Data Protection Impact Assessment (DPIA).
- Did not obtain valid, informed consent, using cryptocurrency as an improper inducement.
- Operated without being properly registered as a data controller in Kenya.
The court ordered the permanent deletion of all Kenyan biometric data within seven days, under the supervision of the ODPC, and prohibited any further processing or transfer of the information.
Setting a National Precedent
The successful enforcement and confirmation of data deletion set a powerful legal precedent for Kenya. The case establishes a clear benchmark for how the country’s data protection regime will balance technological innovation with the imperative of privacy rights and legal safeguards.
“WorldCoin’s case was the test, and Kenya’s regulatory and judicial system has provided a clear answer,” commented a Nairobi-based technology lawyer. “Any company, local or global, wishing to handle sensitive personal data of Kenyans must now adhere to the highest standards of transparency, legality, and user consent.”
Regulators have stated that if WorldCoin ever seeks to restart operations in Kenya, it must first fully comply with all stringent local requirements, including robust consent frameworks, proper DPIAs, official registration, and rules governing cross-border data transfers.
The resolution of this case is being closely watched across Africa and globally, signaling Kenya’s assertive stance in the evolving landscape of digital identity and data sovereignty.
To learn how your business can benefit from customized financial solutions, visit MUIAA Ltd. MUIAA offers expert guidance on funding opportunities both for personal and business. Contact us today for personalized support in meeting your business needs within Kenya’s evolving digital economy.
