Worldcoin Ordered to Delete Biometric Data in Kenya Over Privacy Breach

A Kenyan court has ruled that Worldcoin must erase biometric data it unlawfully gathered from thousands of citizens, in a major regulatory pushback against the cryptocurrency-linked identity project, local media outlet Citizen Digital reported.

The ruling follows mounting concerns over data protection and privacy violations in the firm's short-lived but controversial operations in the country.

World coin Data Breach:Court orders World coin to delete data collected in Kenya Court says data was collected unlawfullyData commissioner will supervise the deletion of data #CitizenBriefs @jimkario pic.twitter.com/e4TLMumqOY

Deletion of Sensitive Biometric Data

The decision targets the company’s use of orbs to scan individuals' irises in exchange for $50 worth of cryptocurrency. According to regulators, this process happened without valid consent and an approved Data Protection Impact Assessment (DPIA), both required by Kenyan law.

The Office of the Data Protection Commissioner (ODPC) will reportedly oversee the deletion process. The regulator raised the alarm over the company’s handling of personal data, warning that continued processing could lead to unauthorized use, erasure, or modification of Kenyan citizens’ biometric profiles.

Deputy Data Commissioner Oscar Otieno filed an affidavit in court asserting that Worldcoin’s activities posed a risk to public safety. After reviewing the company's methods, he concluded the project was not safe for Kenyans and lacked proper transparency.

No Processing Without Assessment and Consent

The court ruling also barred Worldcoin from handling any further data unless it conducts a complete DPIA and secures informed, valid consent from users. Regulators argued that these were not optional steps but core requirements under the Data Protection Act.

Although Worldcoin announced its return to Kenya in 2024, this ruling complicates its plans. The crypto project, co-founded by tech entrepreneur Sam Altman, had aimed to resume enrollment and expand digital identity tools linked to blockchain-based incentives. Now, it must meet strict legal conditions before restarting any operations in the country.

CS Kindiki suspends Worldcoin hours after CS Owalo says they have not broken any law pic.twitter.com/pgi3iRdZNa

In 2023, Kenya’s interior and information ministries told the country’s National Assembly that the data controller registration certificate issued to Worldcoin was not a valid license for the project to operate in the country. Kenyan authorities then started “criminal investigations” to establish “the authenticity and legality” of Worldcoin’s operations in the East African country.

Later, ODPC, again, “directed immediate cessation of processing of sensitive personal data,” according to the statement. This suspension was not lifted, the then-Cabinet Secretary noted.

“The government has commenced investigations to ensure that Worldcoin complies with the data collection, storage, and sharing principles,” the statement noted. “Immediate mitigation steps being undertaken are the constitution of a multi-agency team comprising of security, financial services and data protection agencies [that] have commenced inquiries and investigations to establish the legality of the activities of Worldcoin, the safety and the protection of data collected with the aim to safeguard personal data and mitigate against any adverse practices.”