A Kenyan High Court has ruled that Worldcoin, a digital identity project co-founded by OpenAI CEO Sam Altman, violated the country’s data protection laws by collecting biometric data without proper authorisation. The court ordered the company to permanently delete all biometric data collected from Kenyan citizens within seven days of the ruling.
The judgment, delivered on 5 May 2025 by Justice Roselyne Aburili, found that Worldcoin failed to conduct a mandatory Data Protection Impact Assessment (DPIA), as required under Kenya’s Data Protection Act of 2019. Furthermore, the company did not register as a data processor with the Office of the Data Protection Commissioner (ODPC) before initiating its biometric data collection operations. The court has also prohibited Worldcoin from collecting or processing any further biometric data in Kenya unless it complies fully with these legal obligations.
Worldcoin’s operations in Kenya involved scanning individuals’ irises using a device called the “Orb” in exchange for cryptocurrency tokens. This approach raised concerns among regulators and civil society groups, who accused the company of exploiting vulnerable populations by offering financial incentives for highly sensitive personal data. Deputy Data Commissioner Oscar Otieno testified that Worldcoin’s activities lacked transparency and accountability, potentially posing risks to public safety and privacy.
The ODPC has been tasked with supervising the deletion process to ensure Worldcoin complies with the court’s directive. This ruling marks a significant milestone in Kenya’s efforts to enforce its data protection framework and uphold the privacy rights of its citizens in the face of emerging digital technologies.
Worldcoin has been under scrutiny in other countries as well. In 2023, regulatory authorities in France, the United Kingdom, Germany, and South Korea launched investigations into the company’s data collection practices. More recently, Indonesia suspended Worldcoin’s operations over similar privacy concerns, adding to the project’s growing list of legal hurdles.
The Kenyan court’s decision highlights the critical importance of informed consent, regulatory registration, and risk assessment when dealing with biometric and other sensitive data. It sends a clear message to technology firms operating in the region that compliance with local data protection laws is non-negotiable.
As Worldcoin faces mounting legal challenges across multiple jurisdictions, the outcome in Kenya could set a precedent for how digital identity projects structure their operations and interact with privacy regulations globally.
