Worldcoin Forced to Delete Kenyans’ Biometric Data After High Court Ruling
Worldcoin just got slapped with a judicial reality check—and it's scrambling to delete biometric data faster than a trader exiting a leveraged position.
The Compliance Purge
Kenya's High Court handed down a ruling that sent Worldcoin's legal team into overdrive. The order was clear: delete the biometric data collected from Kenyan citizens. No appeals, no delays. The company is now executing a full-scale data purge—a mandatory reset for its controversial identity verification model in the region.
Privacy vs. Proof-of-Personhood
This isn't just a data management issue—it's a direct challenge to Worldcoin's core premise. The project promised a global digital identity network, using eye-scanning orbs to distinguish humans from bots. Kenya pushed back, questioning the ethics of biometric collection and who really controls that sensitive data. The court sided with privacy, forcing Worldcoin to dismantle its local biometric framework.
The Regulatory Domino Effect
Watch this space closely. Kenya's move could trigger a chain reaction. Other nations eyeing similar biometric projects now have a legal precedent—and a blueprint for resistance. For crypto ventures banking on invasive data collection, the message is clear: innovate, but don't overreach. Or prepare for the regulatory wipeout. After all, in the high-stakes game of global finance, sometimes the most bullish move is knowing when to delete your data—before a court does it for you.
World upholds Kenya High Court’s ruling, deletes user data
According to court filings shared with local news publications, World collected sensitive biometric information without carrying out a mandatory Data Protection Impact Assessment, as legally required by Section 31 of Kenya’s Data Protection Act of 2019.
The assessment must be made before any processing of sensitive personal data, including biometric identifiers such as iris scans. The court was also told the project transferred biometric data belonging to Kenyan citizens to servers located in Germany. World is operated by Tools for Humanity Corporation and its German subsidiary, Tools for Humanity GmbH.
The legal battle came about from public outcry in mid-2023, when the project was called Worldcoin. It launched a mass registration drive, with thousands of people queuing at shopping malls and public spaces to have their irises scanned with the project’s Orb devices. In return, participants received cryptocurrency tokens worth $50, which was around 8,000 Kenyan shillings at the time.
Several lawmakers, civil society groups, and privacy advocates pushed regulators to suspend the project’s activities and investigate whether the Altman-backed project broke privacy laws.
Digital rights lawyer Mercy Mutemi told the BBC that World could have used other options to collect data that were “less invasive.”
“If the goal is to prove people are human, they can just show up. You don’t need to go in the most invasive manner to prove people are human,” she said.
Last year, China’s Ministry of State Security issued a warning about the misuse of biometric data collected by World. In a post on its official WeChat account, the ministry mentioned a foreign company issuing crypto rewards in exchange for iris scans, which the public took as a reference to the project.
The Chinese agency reiterated that such practices could expose its citizens’ information to foreigners and put the country’s security at risk.
In 2024, South Korea’s Personal Information Protection Commission opened an investigation into Worldcoin following complaints about its handling of personal data. The commission said it would examine how the project collected, processed, and transferred private information overseas.
Moreover, it promised to take enforcement actions if it found World had violated local privacy rules. After the PIPC completed its investigations, the government fined OpenAI 3.6 million Korean won, finding that personal information belonging to 687 South Korean citizens had been leaked through OpenAI’s large language model, ChatGPT.
Worldcoin privacy protection gaps spark European probe
Worldcoin’s activities have also faced resistance in Europe and Asia, leading the crypto network to suspend iris-scanning in Indonesia, Thailand, Germany, and France.
German state Bavaria’s Data Protection Authority, the lead supervisory agency for the project in Europe, said it had not completed its review when Worldcoin launched in Germany.
Its President, Michael Will, insisted that the company was not legally required to seek approval before launch, but the assessment process was still ongoing when operations began in 2023. At the time, Worldcoin was also conducting testing in France.
The company responded to information requests from the Bavarian authority and submitted a privacy impact assessment, a requirement under the General Data Protection Regulation for firms processing sensitive biometric data.
Based on the submission, the Bavarian watchdog concluded that the local Worldcoin entity met GDPR requirements, though regulators were unconvinced it was fully compliant and placed it under review.
A spokesperson from France’s data protection authority, the CNIL, said the legality of the biometric data collection and the conditions under which the data was preserved were “questionable.”
Get seen where it counts. Advertise in Cryptopolitan Research and reach crypto’s sharpest investors and builders.
