Nairobi, Kenya – In a landmark ruling on May 5, 2025, the High Court of Kenya declared the collection and processing of biometric data by WorldCoin, a cryptocurrency and digital identity platform, unconstitutional and illegal under Kenyan law.
Justice Roselyne Aburili ordered the immediate deletion of all biometric data, including iris scans and facial images, collected from over 300,000 Kenyans, under the supervision of the Office of the Data Protection Commissioner (ODPC).
The decision marks a significant victory for data privacy advocates and a major setback for WorldCoin’s operations in the country.
The case, brought forward by the Katiba Institute and the Kenyan Section of the International Commission of Jurists (ICJ Kenya), challenged WorldCoin’s practice of collecting sensitive biometric data through its “Orb” device in exchange for cryptocurrency tokens valued at approximately $55 USD (around 7,000 Kenyan shillings).
Launched in Kenya in 2022, the initiative saw thousands of citizens queuing to have their irises scanned, drawn by the promise of financial reward amid economic hardship.
However, concerns quickly arose over the project’s compliance with Kenya’s Data Protection Act of 2019, which mandates strict safeguards for personal data, including informed consent and a Data Protection Impact Assessment (DPIA) prior to collection.
Justice Aburili’s ruling highlighted multiple violations by WorldCoin and its parent entities, Tools for Humanity Corporation and Tools for Humanity GmbH.
The court found that the company failed to conduct a DPIA, neglected to register as a data processor with the ODPC, and obtained consent through inducement rather than freely given agreement—practices that contravened both Kenyan law and international data protection principles.
“The collection and processing of biometric data without adherence to statutory requirements undermines the constitutional right to privacy,” the judge stated, emphasizing the irreversible nature of biometric identifiers like iris scans, which, unlike passwords, cannot be changed if compromised.
The court’s order prohibits WorldCoin from further collecting or processing biometric data in Kenya without a proper DPIA and valid consent mechanisms in place.
Additionally, it mandates the supervised destruction of all previously collected data, a move hailed by civil society groups as a critical step in safeguarding Kenyans’ privacy.
“This judgment reinforces the importance of ethical practices in the deployment of emerging technologies,” said a spokesperson for the Katiba Institute, which led the judicial review alongside ICJ Kenya.
WorldCoin’s entry into Kenya had initially sparked excitement, with the platform positioning itself as a revolutionary tool to provide universal access to the global economy through a blockchain-based digital ID. However, the project faced mounting scrutiny after the Kenyan government suspended its operations in August 2023, citing potential risks to national security and data integrity. A multi-agency investigation followed, revealing that the company had continued processing data despite a cessation directive from the ODPC, prompting further legal action.
The ruling aligns Kenya with a growing global pushback against WorldCoin’s biometric data practices. Countries like Germany, Portugal, and South Korea have also imposed restrictions or fines on the company for similar privacy violations. In December 2024, Germany ordered the deletion of non-compliant data, while South Korea fined WorldCoin for transferring sensitive data without proper consent. These developments underscore the ethical and regulatory challenges facing tech initiatives that rely on biometric data, particularly in regions with vulnerable populations.
For Kenyans who participated in the program, the decision brings mixed implications. While some welcomed the financial incentive during a period of economic strain, others expressed relief at the court’s intervention. “I scanned my eyes because I needed the money, but I didn’t know where my data was going,” said James Otieno, a Nairobi resident who enrolled in 2023. The lack of transparency around data storage—spanning jurisdictions like the Cayman Islands and the Virgin Islands—had fueled fears of potential breaches or misuse.
WorldCoin has yet to issue an official response to the ruling, though its previous statements have emphasized a commitment to privacy-preserving technology. The company’s chief legal officer, Thomas Scott, had earlier indicated plans to resume operations in Kenya following a June 2024 decision by the Director of Public Prosecutions to close a criminal probe into the project. However, today’s judgment effectively halts such ambitions unless WorldCoin complies with stringent new requirements.
Legal experts predict the ruling will set a precedent for how Kenya handles digital identity projects in the future. “This is a wake-up call for tech companies operating in Africa,” said Mercy Mutemi, a prominent digital rights lawyer. “You cannot bypass local laws or exploit economic desperation to harvest sensitive data.” The ODPC, tasked with overseeing the data deletion, has been urged to strengthen enforcement and public awareness around data rights.
