High Court upholds ODPC action against Worldcoin's iris-scanning scheme

On 5 May 2025 the High Court of Kenya declared Worldcoin's operations unlawful under both the Data Protection Act 2019 and Article 31 of the Constitution, in Republic v Tools for Humanity Corporation & 9 others [2025] KEHC 5629 (KLR). Worldcoin had enrolled Kenyans at mass scale, iris scans taken with the Orb device in exchange for cryptocurrency tokens. The court upheld the ODPC's September 2023 cancellation of Worldcoin's data controller registration, finding the consent obtained inadequate and the company short of the accountability standard the Act demands of controllers. The judgment is the baseline for biometric processing in Kenya. Any operator using biometric KYC, facial recognition or fingerprint verification for Kenyan users should read its consent and accountability holdings as directly applicable, and its unresolved questions on cross-border biometric transfers as the next fight.