Kenya’s High Court has ordered the permanent deletion of all biometric data that Worldcoin collected from Kenyan citizens, ruling that the project broke local privacy laws.

The decision marks a firm stand by the judiciary in defence of individual rights amid the rapid adoption of new digital technologies.

The data removal was confirmed by Kenya’s Office of the Data Protection Commissioner (ODPC) on January 20,  2026, after Tools for Humanity, the company behind the Worldcoin project, complied with the court’s directive. In a public notice, the ODPC said:

“Regarding the processing of Kenyans’ personal data by Tools for Humanity, we confirm that the Data Controller has deleted all biometric data previously collected from Kenyan citizens,” the state authority said.

This outcome concludes a lengthy legal and regulatory dispute that began in mid‑2023 when Worldcoin launched its biometric sign‑up campaign in Kenya.

Why Worldcoin sparked concern

Worldcoin is a global cryptocurrency project co‑founded by Sam Altman, also known as the CEO of OpenAI. As part of its mission to create a “proof of personhood” system, Worldcoin used silver orb‑shaped devices to scan people’s iris patterns.

These scans produced a unique digital identity called a World ID. People with a World ID could prove they were real human users, not bots, which Worldcoin says helps reduce fraud in online platforms.

In Kenya, the campaign began on June 24, 2023. Thousands of people queued in Nairobi and other towns to have their eyes scanned. Worldcoin offered about 25 digital tokens – roughly worth Ksh8,000 at the time – as an incentive to sign up.

The project had already run earlier pilot phases in countries including Chile, Indonesia, France and Sudan. However, the Kenya rollout quickly drew scrutiny from authorities and civil society.

Regulatory failings identified

Kenyan law requires that any organisation collecting sensitive personal data – such as biometric identifiers – must take specific steps before processing it. These include conducting a Data Protection Impact Assessment (DPIA) and obtaining valid, informed consent.

In its May 2025 ruling, the High Court found that Worldcoin and its agents did not follow these legal requirements. Lady Justice Aburili Roselyne said in court that the firm had failed to conduct a proper DPIA and had obtained consent in ways that were not compliant with the Data Protection Act, 2019.

The court also noted that the company and its local agents had not registered correctly under the law as data controllers and processors. This oversight meant the project effectively operated outside the legal framework for sensitive data.

One of the legal documents submitted to the court explained that Worldcoin had asked people to allow iris scans in exchange for cryptocurrency, a practice that Kenyan regulators said blurred the lines of genuine consent.

Some civil society organisations welcomed the ruling. Amnesty International Kenya described it as a “significant milestone in the protection of data privacy and digital rights.” The group said it had raised concerns about the “predatory nature” of Worldcoin’s data collection, especially how it targeted vulnerable communities with financial incentives.

A representative for Amnesty International said the decision “affirms that Kenyans’ personal data cannot be commodified under the guise of innovation.”

Worldcoin has not resumed data collection in Kenya since the 2023 suspension. The ODPC has made clear that if Worldcoin or any related entity wants to restart operations, it must first meet all legal requirements, including proper registration, a DPIA, and clear, informed consent from participants.