Kenyan court orders Worldcoin to erase biometric data it unlawfully gathered from citizens

A Kenyan court has ordered Worldcoin to delete the biometric data it unlawfully collected from thousands of citizens, local media outlet Citizen Digital reported.

The ruling follows mounting concerns over data protection and privacy violations in the firm’s short-lived but controversial operations in the country.

The decision to order deletion of the sensitive biometric data is part of a broader regulatory pushback against the cryptocurrency-linked identity project.

The project had seen individuals line up for hours in sweltering heat to be scanned by orbs in exchange for $50 worth of cryptocurrency. But regulators said the process happened without valid consent and an approved Data Protection Impact Assessment (DPIA), both required by Kenyan law.

The Office of the Data Protection Commissioner (ODPC) will reportedly oversee the deletion process. The regulator raised the alarm over the company’s handling of personal data, warning that continued processing could lead to unauthorized use, erasure, or modification of Kenyan citizens’ biometric profiles.

Deputy Data Commissioner Oscar Otieno filed an affidavit in court asserting that Worldcoin’s activities posed a risk to public safety. After reviewing the company's methods, he concluded the project was not safe for Kenyans and lacked proper transparency.

The court ruling also barred Worldcoin from handling any further data unless it conducts a complete DPIA and secures informed, valid consent from users. Regulators argued that these were not optional steps but core requirements under the Data Protection Act.

Although Worldcoin announced its return to Kenya in 2024, this ruling complicates its plans. The crypto project, co-founded by tech entrepreneur Sam Altman, had aimed to resume enrollment and expand digital identity tools linked to blockchain-based incentives. Now, it must meet strict legal conditions before restarting any operations in the country.

In 2023, Kenya’s interior and information ministries told the country’s National Assembly that the data controller registration certificate issued to Worldcoin was not a valid license for the project to operate in the country.

Kenyan authorities then started “criminal investigations” to establish “the authenticity and legality” of Worldcoin’s operations in the East African country.

Later, ODPC, again, “directed immediate cessation of processing of sensitive personal data,” according to the statement. This suspension was not lifted, the then-Cabinet Secretary noted.

“The government has commenced investigations to ensure that Worldcoin complies with the data collection, storage, and sharing principles. Immediate mitigation steps being undertaken are the constitution of a multi-agency team comprising of security, financial services and data protection agencies [that] have commenced inquiries and investigations to establish the legality of the activities of Worldcoin, the safety and the protection of data collected with the aim to safeguard personal data and mitigate against any adverse practices."