Members of the public register for the Worldcoin cryptocurrency at Kenyatta International Convention Centre on August 1, 2023.
The High Court has brought closure to one of Kenya’s most significant digital privacy scandals involving the unlawful collection and transfer of citizens’ biometric data by cryptocurrency project Worldcoin.
This follows confirmation by the Office of the Data Protection Commissioner (ODPC) to the court that the sensitive iris scan data collected from Kenyans two years ago has been permanently deleted in compliance with a court order issued in May this year.
It was disclosed to the court that Worldcoin, operated by US-based Tools for Humanity Corporation and its German subsidiary Tools for Humanity GmbH, had transferred the biometric data to servers in Germany without proper legal safeguards.
ODPC officials travelled to Germany to oversee the deletion process, marking the end of a contentious legal battle spanning two years.
The case stemmed from concerns that Worldcoin violated Kenya’s data protection laws by harvesting iris scans without proper consent or regulatory approval.
The controversy began in mid-2023 when Worldcoin launched a mass registration drive in Kenya, offering cryptocurrency tokens worth approximately Sh7,000 in exchange for iris scans.
Thousands of citizens lined up at shopping malls and public spaces to scan their irises–unique biological identifiers–using Worldcoin’s Orb devices in exchange for cryptocurrency tokens worth approximately Sh7,000.
Members of the public queue at Kenyatta International Convention Centre in Nairobi on August 1, 2023 to register for the Worldcoin Cryptocurrency.
Worldcoin, a cryptocurrency initiative, claimed its mission was to create a global digital identity system using iris scans. In exchange for scanning their eyes, Kenyans received Worldcoin tokens (WLD), which could be traded like other cryptocurrencies.
However, what they were not clearly told, according to court documents, was that their iris scans – unique biological identifiers – would be transferred overseas and processed by foreign entities not registered under Kenyan law.
Investigations later revealed that participants were not fully informed about how their biometric data would be processed, stored, or transferred internationally.
Court documents showed that Worldcoin failed to conduct a mandatory Data Protection Impact Assessment (DPIA) before collecting Kenyan biometric data, violating Section 31 of Kenya’s Data Protection Act (2019).
Illegal operations
Additionally, key entities involved in the data collection – including the Cayman Islands-registered Worldcoin Foundation, British Virgin Islands-based World Assets Limited, and Germany’s Tools for Humanity GmbH – were never registered as data controllers or processors in Kenya, rendering their operations illegal under Kenyan law.
The court ruling emphasized that the consents obtained from Kenyan citizens were invalid because they were induced by cryptocurrency rewards, which undermined the voluntary nature of consent as defined under Section 2 of the Data Protection Act.
The court found that Worldcoin bundled multiple data processing purposes into a single agreement, failed to disclose cross-border data transfers adequately, and created conditions where withdrawing consent would result in financial detriment – practices that contravened Kenyan privacy regulations.
A critical issue in the case was the transfer of Kenyan biometric data to servers in Germany and other countries without proof of equivalent data protection standards, breaching Section 48 of the Data Protection Act.
The court noted that Worldcoin did not obtain authorisation from Kenya’s Data Protection Commissioner (ODPC) for these transfers, nor did it provide sufficient safeguards to protect Kenyan data subjects’ rights under foreign jurisdictions.
Following regulatory scrutiny, the ODPC and the Communications Authority raised alarms and flagged “serious concerns” about Worldcoin’s operations, and cancelled its registration certificates in September 2023.
The High Court subsequently, in May 2025, ordered the immediate deletion of all collected data.
By November 2025, ODPC officials travelled to Germany to supervise the destruction of the data – an unprecedented enforcement action underscoring the sensitivity of the case.
Worldcoin trader displays a placard advertising his business at Kenyatta International Convention Centre in Nairobi on August 1, 2023 as members of the public queue to register.
The High Court’s ruling has also directed the ODPC to file a public confirmation of the deletion within seven days, ensuring transparency and compliance with the court’s orders.
“This court directs the applicant to file into court a written communication which will also be issued to the general public informing the public that it supervised the subject’s data deletion,” reads the ruling, underscoring the judicial scrutiny of biometric data harvesting by tech companies, particularly those leveraging financial incentives to obtain consent from vulnerable populations.
The case was initiated through a judicial review application filed by civil society organisations, including the Katiba Institute, Kenya Human Rights Commission, and Law Society of Kenya.
The petitioners argued that Worldcoin’s operations violated constitutional privacy rights under Article 31 and flouted statutory data protection requirements.
The court agreed, issuing orders of prohibition and mandating the firms to halt further data collection, quash Worldcoin’s unlawful decisions, and compel the permanent erasure of the illegally obtained biometric data.
The judge dismissed arguments by Worldcoin’s legal team that the applicants lacked standing, ruling that civil society groups could sue in the public interest under Articles 22 and 258 of Kenya’s Constitution.
The court also rejected claims that judicial review remedies could not apply to private entities, noting that Worldcoin’s actions involved public interest concerns and constitutional violations.
The ruling highlighted systemic regulatory gaps, particularly the absence of clear guidelines governing commercial data use under Section 37(3) of the Data Protection Act.
While the court declined to issue structural orders compelling the government to draft such guidelines, it acknowledged the need for legislative action to prevent similar violations in the future.
Members of the public queue at Kenyatta International Convention Centre in Nairobi on August 1, 2023 to register for the Worldcoin Cryptocurrency.
For now, Worldcoin’s operations in Kenya remain suspended indefinitely until they obtain the legal requirements.
The case sets a significant legal precedent, reinforcing Kenya’s data protection framework and affirming the government’s authority to hold foreign entities accountable for breaches of local privacy laws.
It also establishes a vital legal principle by rejecting “paid consent,” preventing companies from using financial incentives to circumvent privacy laws.
For Kenyan citizens who participated in the Worldcoin scheme, the ruling provides belated reassurance that their sensitive biometric data – once unlawfully exported – has now been permanently erased under judicial oversight of the ODPC.
