Worldcoin Kenya Ban: Why Africa Largest Economy Rejected Iris Scanning

Kenyas data protection authority suspended Worldcoin operations in the country, citing failure to adequately protect biometric data of Kenyan citizens and lack of proper consent mechanisms. The suspension came after hundreds of thousands of Kenyans had already submitted iris scans, creating a situation where an enormous biometric dataset existed with questionable legal basis. The Kenya ODPC investigation found that Worldcoin consent processes did not meet the requirements of the Kenya Data Protection Act. Participants, many from economically disadvantaged communities, were offered cryptocurrency tokens as incentives without adequate explanation of what iris biometric data collection entailed or how the data would be processed internationally. Worldcoin registration agents in Kenya were not adequately trained to explain data processing implications, and the consent forms were available primarily in English despite targeting communities with varying literacy levels and language preferences. The investigation also revealed that biometric data collected in Kenya was transferred internationally without adequate safeguards, violating cross-border data transfer provisions of Kenyan law. The suspension order required Worldcoin to delete all data collected from Kenyan citizens, but compliance verification remains an ongoing challenge given the technical complexity of biometric data deletion across distributed systems. The Kenya precedent influenced regulatory responses in other African nations, with several countries implementing preemptive restrictions on biometric data collection for cryptocurrency purposes.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.