The office of the Data Protection Commissioner (DPC) has confirmed that Tools for Humanity, the organisation behind the contentious Worldcoin initiative, deleted all biometric information previously obtained from Kenyan citizens.
The announcement, made in a public notice on Tuesday, is a key milestone in a year-long regulatory dispute over digital privacy and the harvesting of iris scans for cryptocurrency.
The DPC, established under the Data Protection Act of 2019, is the official watchdog responsible for overseeing the processing of personal information in Kenya.
In its statement, the regulator emphasised its duty to protect individuals' privacy and ensure that multinational businesses comply with the country's legal and institutional regulations.
"The Office remains dedicated to enforcing the law, protecting data subjects, and ensuring that all data controllers and processors are held accountable for any non-compliance," the DPC stated.
It added: "Regarding the processing of Kenyans' personal data by Tools For Humanity, we confirm that the Data Controller has deleted all biometric data previously collected from Kenyan citizens."
The conflict between the Kenyan government and Tools for Humanity began in mid-2023, when thousands of Kenyans queued at malls and public places to have their eyes scanned by Orbs biometric imaging equipment.
In exchange, participants received digital tokens worth approximately $50 at the time.
This triggered quick government intervention, which resulted in a stop of the project's operations in August 2023 due to worries over informed consent and the security of sensitive biological identities.
The scenario developed into a landmark legal dispute, ending in a High Court decision in May 2025.
The court ruled that Worldcoin's data collection was unconstitutional, noting the company's failure to conduct a necessary Data Protection Impact Assessment and its use of financial incentives to obtain consent.
The presiding judge ordered that all improperly gathered data be permanently deleted under the direct supervision of the DPC.
The suspension led to a multi-agency investigation involving the Ministry of Interior and the ICT Ministry, culminating in the recent verification that the collected data has been purged.
The deletion of the data serves as a corrective measure under Section 25 of Kenya’s Data Protection Act, which outlines the principles of data minimisation and purpose limitation.
By confirming the destruction of these biometric records, the DPC aims to reassure the public that sensitive biological identifiers cannot be misused or leaked.
Share
