World, the crypto and digital identity project co-founded by Sam Altman as Worldcoin, has conceded to a High Court order to delete all biometric data collected from Kenyan citizens.
In a communiqué cited by local media outlets, Kenya’s Office of the Data Protection Commissioner (ODPC) confirmed the project’s data controller permanently erased all information gathered from Kenyan users during World’s iris data collection operations in September 2023.
The confirmation came after the High Court issued orders last May, directing that the data be wiped from World’s systems. ODPC said it would continue monitoring the compliance of technology firms in the country, in line with Kenya’s data protection laws.
World upholds Kenya High Court’s ruling, deletes user data
According to court filings shared with local news publications, World collected sensitive biometric information without carrying out a mandatory Data Protection Impact Assessment, as legally required by Section 31 of Kenya’s Data Protection Act of 2019.
The assessment must be made before any processing of sensitive personal data, including biometric identifiers such as iris scans. The court was also told the project transferred biometric data belonging to Kenyan citizens to servers located in Germany. World is operated by Tools for Humanity Corporation and its German subsidiary, Tools for Humanity GmbH.
The legal battle came about from public outcry in mid-2023, when the project was called Worldcoin. It launched a mass registration drive, with thousands of people queuing at shopping malls and public spaces to have their irises scanned with the project’s Orb devices. In return, participants received cryptocurrency tokens worth $50, which was around 8,000 Kenyan shillings at the time.
Several lawmakers, civil society groups, and privacy advocates pushed regulators to suspend the project’s activities and investigate whether the Altman-backed project broke privacy laws.
Digital rights lawyer Mercy Mutemi told the BBC that World could have used other options to collect data that were “less invasive.”
“If the goal is to prove people are human, they can just show up. You don’t need to go in the most invasive manner to prove people are human,” she said.
Last year, China’s Ministry of State Security issued a warning about the misuse of biometric data collected by World. In a post on its official WeChat account, the ministry mentioned a foreign company issuing crypto rewards in exchange for iris scans, which the public took as a reference to the project.
The Chinese agency reiterated that such practices could expose its citizens’ information to foreigners and put the country’s security at risk.
In 2024, South Korea’s Personal Information Protection Commission opened an investigation into Worldcoin following complaints about its handling of personal data. The commission said it would examine how the project collected, processed, and transferred private information overseas.
Moreover, it promised to take enforcement actions if it found World had violated local privacy rules. After the PIPC completed its investigations, the government fined OpenAI 3.6 million Korean won, finding that personal information belonging to 687 South Korean citizens had been leaked through OpenAI’s large language model, ChatGPT.
Worldcoin privacy protection gaps spark European probe
Worldcoin’s activities have also faced resistance in Europe and Asia, leading the crypto network to suspend iris-scanning in Indonesia, Thailand, Germany, and France.
German state Bavaria’s Data Protection Authority, the lead supervisory agency for the project in Europe, said it had not completed its review when Worldcoin launched in Germany.
Its President, Michael Will, insisted that the company was not legally required to seek approval before launch, but the assessment process was still ongoing when operations began in 2023. At the time, Worldcoin was also conducting testing in France.
The company responded to information requests from the Bavarian authority and submitted a privacy impact assessment, a requirement under the General Data Protection Regulation for firms processing sensitive biometric data.
Based on the submission, the Bavarian watchdog concluded that the local Worldcoin entity met GDPR requirements, though regulators were unconvinced it was fully compliant and placed it under review.
A spokesperson from France’s data protection authority, the CNIL, said the legality of the biometric data collection and the conditions under which the data was preserved were “questionable.”
