REGULATION | Data Protection Commissioner Confirms Deletion of Kenyans’ WorldCoin Biometric Data

The Office of the Data Protection Commissioner (ODPC) has officially confirmed that WorldCoin’s parent company, Tools for Humanity, has deleted all biometric data previously collected from Kenyan citizens.

The regulator said this followed a compliance audit to ensure the deletion aligned with the Data Protection Act, 2019, putting a spotlight on data privacy enforcement in Kenya.

WorldCoin’s biometric data collection in Kenya, where thousands of people had their iris and facial scans captured via ‘Orbs‘ in exchange for crypto rewards, quickly drew regulatory fire.

REGULATION | Kenya Data Protection Office Issues Notice as Locals Throng for WorldCoin Registration

Kenyan law views biometric information as sensitive personal data, and companies collecting such data must comply with the Data Protection Act, 2019.

REGULATION | WorldCoin CEO Grilled by Kenyan Parliament – Says Over 635,000 Kenyans Have Downloaded the App

In May 2025, Kenya’s High Court ruled that WorldCoin’s data gathering was unlawful, largely because it:

• Didn’t conduct a mandatory Data Protection Impact Assessment (DPIA) before processing biometric data.
• Failed to obtain valid, informed consent from participants, instead offering cryptocurrency as an inducement.
• Operated without proper registration as a data controller or processor under Kenyan law.

REGULATION | Kenya High Court Declares WorldCoin Operations Illegal, Orders Deletion of Biometric Data

This ruling was part of a judicial review application brought by local rights groups, including Katiba Institute and others, underscoring serious privacy and regulatory gaps.

Following the court decision, the Kenyan government halted WorldCoin’s operations in August 2023 citing privacy and security concerns as thousands queued up especially at public registration points like KICC in Nairobi to get their eyes scanned.

REGULATION | The Kenya Ministry of Interior and National Administration Suspends WorldCoin Activities Pending Risk Assessment

Parliamentary committees and MPs also grilled authorities over the handling of the data and demanded transparency on deletion and verification long before the 2026 confirmation.

REGULATION | The Government Should Disable WorldCoin Virtual Platforms and Blacklist IP Addresses, Say Kenyan Lawmakers Report

In May 2025, the High Court didn’t just find Worldcoin’s activities unlawful, it ordered the permanent deletion of all biometric data collected from Kenyans. This meant WorldCoin had to remove iris and facial scan data from its systems under supervision of the Office of the Data Protection Commissioner (ODPC) within seven days.

This ruling prohibited WorldCoin from further processing or transferring biometric data unless it fully complied with legal requirements.

Regulators also noted that if WorldCoin wants to restart operations in Kenya, it must meet stringent local legal requirements including valid consent frameworks, DPIAs, proper registration, and compliance with cross-border data handling rules.

These developments matter because they reflect how Kenyan authorities are interpreting digital identity projects and crypto-linked data collection practices. WorldCoin’s case sets a precedent and becomes a test of Kenya’s data protection regime in balancing innovation with privacy rights and legal safeguards.

REGULATION | Kenyan Security Minister ‘Reluctant to Allow Cryptocurrencies’ Following WorldCoin Debacle

Stay tuned to BitKE for crypto regulatory updates across Africa.

Join our WhatsApp channel here.