Skip to content
Submit incident
AII-1000-99789
ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.

Kenya Orders Deletion of Worldcoin Biometric Data After Court Finding

Kenya's High Court ruled that Tools for Humanity's collection of iris scans and facial images from Kenyan citizens via Worldcoin Orbs was unlawful, citing absence of valid consent and failure to conduct required privacy assessments. The court ordered deletion of the data, which Kenya's Data Protection Commissioner confirmed in January 2026 had been completed.

May 2025 Β· Tools for Humanity Β· Privacy and surveillance
May 2025
AII-1000-997892 sources ↓
Quick facts
Category
Privacy and surveillance
Country
Kenya
Source
CIO Africa
Date
May 2025
Drafted by
Raidu Incident Detection

What happened

Tools for Humanity collected iris scans and facial images from Kenyan citizens using Orb biometric devices as part of the Worldcoin project, offering cryptocurrency incentives in exchange for biometric data.

Kenya's High Court ruled in May 2025 that the data collection was unlawful, citing the company's failure to conduct a mandatory Data Protection Impact Assessment and its use of financial incentives to induce consent, which compromised the voluntary nature of consent.

The court ordered permanent deletion of all unlawfully collected data under supervision of the Office of the Data Protection Commissioner. The ODPC confirmed in January 2026 that all biometric data had been deleted.

Reported impact

Kenyan citizens' biometric data, including iris scans and facial images, were collected without valid legal consent and in breach of the Data Protection Act, 2019.

Index analysis

The ODPC found multiple breaches including failure to obtain valid consent, absence of a mandatory Data Protection Impact Assessment, unauthorised transfer of biometric data outside Kenya, and failure to properly register entities as data controllers.

Biometric data is classified as sensitive personal data under Kenyan law and subject to heightened safeguards due to its permanent and uniquely identifiable nature.

Governance controls

The Data Protection Act, 2019 establishes the ODPC mandate to oversee collection, storage and processing of personal data in Kenya, ensure compliance with data protection principles including data minimization and purpose limitation, and safeguard individuals' right to privacy.

Classification

Category
Privacy and surveillance
Industry
Digital security
Country
Kenya
Harm status
Actual harm
Intent
Unintentional
Timing
Post-deployment
Harm types
Public interest, Human or fundamental rights
Harmed
Consumers, General public
Consequences
Regulatory investigation, Content removal, Litigation
AI systems
Worldcoin Orb
Regulations
GDPR (cited)

Sources and evidence

This record was researched and written by the Index, based on the following original reporting.

CIO Africa
Kenya Confirms Deletion Of Worldcoin Biometric Data
20 January 2026
TechTrendsKE
Kenya Confirms Worldcoin Biometric Data Deleted
20 January 2026