Kenya’s High Court has issued a strong ruling against the Worldcoin Foundation, ordering it to delete all biometric data collected from local users permanently. Worldcoin extracts sensitive data from users, which includes both facial images and iris scans. Worldcoin received the ruling from Justice Aburili Roselyne on Monday that its privacy violations of constitutional rights occurred through unauthorized data collection.
The court issued a seven-day time constraint for data deletion while requiring this operation to be guided by Kenya’s Data Protection Commissioner. The Katiba Institute and ICJ Kenya filed this legal case to safeguard human rights and achieve transparency in the process. The court established that Worldcoin performed incorrectly on its mandatory Data Protection Impact Assessment responsibilities under Kenya’s Data Protection Act of 2019.
The court condemned Worldcoin because it gained consent by using “inducement” by offering cryptocurrency in exchange for biometric data. The practice of using cryptocurrency offers as a means to collect personal data from unsuspecting people was deemed unethical by the legal authorities, who believed this method lacked transparency. Earlier consent procedures used to collect data led the court to both stop the current data collection process and to invalidate previously authorized consent procedures.
In addition to the deletion order, the court issued several key rulings. The court ordered Worldcoin to cease collecting and processing additional biometric data in Kenya unless it performs a valid assessment process. The court removed every piece of data that was obtained from an illegal process that the court itself declared unlawful. The organization received a court order to delete all existing data with immediate effect, though the process required official oversight at all times.
Interestingly, a similar position against Worldcoin’s operations exists in Kenya, as other nations take similar measures. At the same time, Indonesia chose to stop Worldcoin operations within its borders. On May 4, 2025, the Indonesian Ministry of Communications and Digital Technology approved the operation suspension. Officials identified suspicious actions alongside regulatory process violations that led to this decision. Consequently, Worldcoin’s registration certificates, including those related to its World ID service, were also suspended.
Furthermore, similar challenges have emerged in other countries. For instance, Brazilian authorities have voiced concerns about Worldcoin’s payment system for exchanging biometric data from users. The South Korean government issued both an operational ban and an $800,000 fine to the project due to its breaches of data protection regulations. Worldcoin faces mounting international pushback throughout the world because of its collection methods for personal information.
The company started trying to connect with regulators in 2024, but many areas still do not have complete operational approval. Worldcoin promotes universal digital identity through its platform, yet critics allege its processes reduce standards of privacy and data protection. Governments worldwide appear to boost their efforts at safeguarding their citizens from practices they deem invasive or deceptive.
