On May 5, 2025, Kenya’s High Court declared WorldCoin’s operations illegal, marking a key moment for data privacy in the country.

Lady Justice Roselyne Aburili ruled that WorldCoin, a cryptocurrency and digital identity project co-founded by OpenAI CEO Sam Altman, violated Kenya’s Data Protection Act, 2019, through its collection of biometric data: iris and facial scans.

The court ordered WorldCoin to permanently delete all such data collected from Kenyans within seven days, under the supervision of the Office of the Data Protection Commissioner (ODPC).

It also issued an order of certiorari, quashing WorldCoin’s data collection practices, and prohibited further processing without a valid Data Protection Impact Assessment (DPIA) or informed consent.

WorldCoin launched in Kenya in 2022, offering tokens worth KSh 7,000 (approximately $55) in exchange for iris scans via its Orb device.

By 2023, over 350,000 Kenyans had enrolled, with thousands queuing at registration points like the Kenyatta International Convention Centre (KICC) in Nairobi.

The project faced immediate scrutiny, leading to a government suspension in August 2023 over privacy and security concerns.

The legal challenge, spearheaded by Katiba Institute with the ODPC and ICJ Kenya as interested parties, wrapped up in the May 2025 ruling after final submissions in March 2025.

Why the Court Ruled Against WorldCoin

The High Court identified multiple violations of Kenya’s data protection laws and constitutional rights.

WorldCoin failed to conduct a mandatory DPIA, a critical requirement under Section 31 of the Data Protection Act to assess and mitigate privacy risks before collecting sensitive biometric data.

This left Kenyans vulnerable to potential data breaches, identity theft, and misuse of their information.

The court also ruled that WorldCoin’s method of obtaining consent through offering cryptocurrency as an incentive was invalid, exploiting economically vulnerable individuals and breaching the principle of informed consent. This practice violated the constitutional right to privacy under Article 31.

Moreover, WorldCoin and its affiliates, Tools for Humanity Corporation and the WorldCoin Foundation, were not properly registered as data controllers in Kenya at the time of collection, contravening Sections 19(2), 25, 26, 29, and 30 of the Act.

The ODPC had engaged with Tools for Humanity as early as June 2022, raising concerns and reviewing an inadequate DPIA.

READ ALSO:

What Kenya’s Data Protection Act Means for Fintech Users

Despite a 14-day suspension of data collection in June 2023, WorldCoin continued operations until the government intervened.

The court further noted that the cross-border transfer of Kenyan biometric data to entities in the Cayman Islands and Virgin Islands lacked safeguards, violating Sections 48 and 49 of the Act.

A Global Context of Scrutiny

Kenya’s ruling aligns with global regulatory actions against WorldCoin. On the same day, May 5, 2025, Indonesia suspended WorldCoin’s operations for failing to register properly and violating local laws.

Spain, Hong Kong, Brazil (January 2025), Germany (December 2024), and South Korea (September 2024) have also imposed bans or ordered data deletions, reflecting widespread concerns over WorldCoin’s data practices.

In the U.S., where WorldCoin launched in six cities on May 1, 2025, the project benefits from a pro-crypto position under the Trump administration but remains barred from collecting biometric data,a disparity criticised by Kenyan parliament majority leader Kimani Ichung’wah, who questioned why Kenya allowed practices banned in Altman’s home country.

WorldCoin frames its World ID as a “privacy-first” solution, emphasising local data storage and cryptographic protections. However, the Kenyan court rejected this claim, highlighting the inherent risks of collecting immutable biometric data, especially through financial inducements.

The global backlash highlights a tension between technological innovation and privacy rights, with WorldCoin’s model facing increasing resistance in regions with robust data protection laws.

Implications for Data Privacy in Kenya

The ruling sets a powerful precedent for data privacy in Kenya, reinforcing the enforcement of the Data Protection Act, 2019.

It affirms that constitutional rights, particularly the right to privacy, must be upheld even amidst technological advancements.

The decision ensures that companies failing to comply with procedural requirements, like conducting a DPIA or ensuring informed consent, face severe consequences, with the ODPC playing a key role in overseeing compliance, such as the deletion of WorldCoin’s data.

READ ALSO:

Why the Airtel SpaceX Deal Is Not Just Another Satellite Project

For Kenyans, the ruling addresses the exploitation of vulnerable communities. Many who enrolled were economically disadvantaged, drawn by the promise of quick financial gain, which the court found undermined their autonomy.

Public sentiment, as seen in reactions reported on May 6, 2025, reflects a divide: some Kenyans hailed the ruling as a victory for privacy, with comments like, “WorldCoin took advantage of vulnerable Kenyans and invaded their privacy for a few coins.”

Others expressed frustration over lost economic opportunities, with one stating, “Why are they banning WorldCoin when they can’t give youths jobs? It’s been feeding youths well the past 1-2 years.”

This tension highlights the complex interplay of economic needs and privacy rights in Kenya’s tech ecosystem.

Broader Impacts on the Global Tech Landscape

For WorldCoin, the ruling is a major setback. Its token (WLD) dropped nearly 10% to $0.88 on May 6, 2025, reflecting investor concerns about its global operations.

The case also raises broader ethical questions about the responsibilities of tech leaders like Sam Altman, whose ventures in AI and crypto increasingly intersect with societal concerns over data privacy.

A Defining Moment for Digital Rights

Kenya’s High Court ruling against WorldCoin is a landmark for digital rights, sending a clear message that innovation must not compromise privacy.

As Kenya joins a growing list of countries scrutinising WorldCoin, the decision could inspire a global shift toward more equitable tech governance.

For individuals and policymakers, it’s a reminder that in the digital age, safeguarding privacy is non-negotiable, regardless of technological promise.

Ronnie Paul is a seasoned writer and analyst with a prolific portfolio of over 1,000 published articles, specialising in fintech, cryptocurrency, and digital finance at Africa Digest News.