Internet access is somewhat limited by poor infrastructure, but penetration rates and connection speeds continue to improve.

According to DataReportal’s Digital 2024 report, Kenya’s internet penetration rate was 40.8 percent as of January 2024.1 The CA, the national telecommunications regulator, reported that the total number of mobile data subscriptions increased to 34.6 million in September 2023, up from 30.9 million in September 2022.2 Fixed-line internet subscriptions exceeded 1.2 million in September 2023, compared to 986,000 in September 2022.3 Third- and fourth-generation (3G and 4G) mobile network subscriptions respectively stand at 29.6 percent and 68.9 percent of total mobile data subscriptions as of September 2023.

Safaricom began offering 5G services in major urban centers in 2021.4 Airtel launched its 5G network in July 2023 and continued to expand its network throughout the coverage period.5 According to the CA, there were 509,737 5G subscriptions in Kenya as of September 2023.6

Average mobile download speeds increased to 23.7 megabits per second (Mbps) in February 2024, from 22.4 Mbps in February 2023, according to Ookla's Speedtest Global Index, while mobile upload speeds declined from 9.8 Mbps to 9.5 Mbps over the same time period. Fixed download speeds increased from 9.83 to 10.58 Mbps, while fixed-line upload speeds decreased from 12.6 to 11.9 Mbps between February 2023 and February 2024.7

The National Optic Fibre Backbone Infrastructure (NOFBI) project aims to increase internet connectivity across the country and improve the delivery of e-government services.8 In the first phase of the project, only 6,000 of the planned 50,000 kilometers of fiber-optic cables were installed, though a planned addition of 2,500 kilometers was outlined in the 2018–2023 National Broadband Strategy.9 In January 2024, the Ministry of Information, Communications, and The Digital Economy (MOIC-DE) announced that they would engage the private sector to complete the NOFBI project.10

Under the Kenya Vision 2030 development plan, the government has prioritized the expansion of information and communication technology (ICT) capacity, including through plans to expand the country’s fiber-optic infrastructure and internet connectivity.11 The concept note for the fourth phase (2023–2027) of the Vision 2030 plan was published in February 2022.12 In November 2023, the government announced a last-mile connectivity project that would connect primary and secondary schools to the NOFBI and establish public Wi-Fi hotspots in unconnected areas.13

Internet users in Kenya occasionally experience outages in internet services. In June 2023, Telkom users experienced a network disruption following claims that the company was unable to meet rental obligations for 723 masts to the American Tower Corporation.14 Aging infrastructure and deteriorating supply lines have made electricity interruptions more common across several regions in Kenya,15 subsequently interrupting home internet connections. The Kenya Power and Lighting Company reported major outages in August, November, and December of 2023.16 During the August power outage, it took 24 hours for power to be restored across most of the country.

In May 2024, damage to two submarine cables, SEACOM and the Eastern Africa Submarine Cable System (EASSy), off the coast of South Africa led to slower speeds and intermittent service disruptions in Kenya until the cables were repaired in June. Mobile service providers activated alternative sources of connectivity to minimize the impact of the disruptions.17

Internet access remains prohibitively expensive for much of the population, despite significant investments meant to improve rural connectivity.

As of September 2023, the average monthly price of fixed-line broadband internet in Kenya was $47.73, according to Cable.18 Mobile data is relatively affordable in comparison, at an average price of $0.59 per one gigabyte (GB) of data as of July 2023.19 A report by the Friedrich Naumann Stiftung Foundation found that the high cost of data in the country excludes lower-income Kenyans from benefiting from the digital economy.20

Following a lawsuit against Safaricom, Airtel, and Telkom for their data-expiration practices,21 Safaricom rolled out non-expiry data bundles in October 2019, and Airtel rolled out its own in December.22 However, Safaricom’s non-expiry data plans cost the same amount as expiring data packages but include only half the amount of data. Crucially, this impacts more affordable bundles and not the more expensive ones, affecting subscribers with less disposable income available to purchase data.23

The Finance Act signed by then-president Uhuru Kenyatta in September 2018 increased the tax on telephone and internet data from 10 to 15 percent.24 In response to the tax, internet service providers (ISPs) raised prices for both mobile data bundles and fixed-line home internet connections,25 making internet access unaffordable for many poorer Kenyans.

The affordability and availability of internet services vary between urban and rural areas. Many rural areas have not benefited from Kenya’s high-capacity bandwidth, in part due to market disparities and weaknesses in last-mile connectivity, which is expensive and requires basic infrastructure, such as electricity and roads, that is often poorly developed.

The Universal Service Fund (USF), which was established in 2013, aims to expand mobile and internet service in a bid to close the digital divide.26 The Voice Infrastructure and Services Project, a USF initiative administered by the CA, had connected 75 rural sublocations to basic mobile telephony as of June 2021.27 The CA awarded 1.57 billion Kenyan shillings ($12.7 million) in contracts to develop further infrastructure for the project in February 2021.28 The Education Broadband Connectivity Project, another USF initiative, provided 887 secondary schools with 5 Mbps internet connections as of October 2019.29

A gender-based digital divide also persists, with more men than women using mobile and internet services. In a 2023 survey, the Global System for Mobile Communications (GSMA) found that only 39 percent of women in Kenya are mobile internet users, compared to 58 percent of men.30

There were no reports of the government exercising its control over internet infrastructure to limit connectivity during the coverage period, though internet disruptions during the #RejectFinanceBill protests after the end of the coverage period raised suspicions of government involvement.

In November 2023, data from OONI showed that Telegram was inaccessible in Kenya for a 16-day period that coincided with the Kenya Certificate of Secondary Education examinations following reports that the platform was being used to distribute leaked exam papers (see B1).31 The CA did not acknowledge the disruption or provide a reason for the restriction.32

In June 2024, after the end of the coverage period, internet connectivity was disrupted in Kenya during mass protests. The government’s role in the disruption of connectivity remained unclear; service providers Safaricom and Airtel attributed the disruption to submarine cable outages.33

Kenyans were able to access the internet without interruptions during the August 2022 general election. After the release of a Global Witness report that detailed Facebook’s failure to curb hate speech on its platform in Kenya, and just days before the August 9 voting, the National Cohesion and Integration Commission (NCIC) gave Facebook seven days to comply with regulations to tackle hate speech on its platform or face suspension (see B7).34 Although Facebook did not announce any policy changes during that seven-day period, multiple ministers stated that the government would not disrupt connectivity or suspend the platform.35

Kenya’s decentralized internet infrastructure and nongovernmental control of the Kenya Internet Exchange Point (KIXP) make it unlikely that the government could exercise technical control over the internet.

Kenya connects to the international internet via seven main undersea cables—SEACOM, the East African Marine System (TEAMS), the Eastern Africa Submarine Cable System (EASSy), the Lower Indian Ocean Network 2 (LION2), Pakistan and East Africa Connecting Europe (PEACE) Cable, Djibouti Africa Regional Express 1 (DARE1), and 2Africa; one additional cable, Africa-1, is expected to be completed in 2024.36

The KIXP is operated by the Telecommunication Service Providers of Kenya (TESPOK), a nonprofit organization representing the interests of ISPs. The KIXP keeps domestic Kenyan internet traffic within the country, lowering the cost of connectivity. With support from the African Union, a backup IXP was established in 2016 to further lower the costs of connectivity for ISPs.37

Economic obstacles restrict the diversity of service providers in Kenya.

There are five mobile service providers: Safaricom (which holds a 61.9 percent market share of mobile broadband subscriptions as of December 2022), Airtel (32.7 percent), Telkom (2.5 percent), Equitel (1.6 percent), and Jamii Telecommunication (1.3 percent).38 Safaricom also leads the fixed-line broadband data market with 36.5 percent of subscriptions, followed by Jamii Telecommunications (24.1 percent) and Wananchi Group Limited (20.7 percent).39

The Kenyan government owns 35 percent of Safaricom,40 and in October 2022 the government increased their stake in Telkom to become its sole owner, halting its listing on the Nairobi Securities Exchange.41

Because Safaricom holds the majority of the market, there have been calls to declare it a dominant player, which could force the company to separate from its mobile money service in an effort to foster greater competition.42 A bill introduced in March 202143 and revived in November 2022 could have compelled Safaricom, Airtel, and Telkom to split their telecommunications businesses from their mobile money holdings.44 If passed, telecommunications companies would have six months to comply.45 The bill has yet to undergo its first reading.46 The CA previously abandoned plans to split Safaricom in 2018 amid fierce resistance from the company and other powerful business interests.47

The CA is the regulatory body that licenses all communications systems.48 Licensing requires companies to pay an application fee, an initial fee, and annual operating fees throughout the license term. The size of the fines varies by the type of license.49 As of January 2024, the CA listed five providers with submarine-cable landing rights and 152 network facility providers as licensees.50 These licensees provide, among other things, facilities for internet, voice, and mobile virtual operations. Cybercafes are licensed as business units by local governments, and there are no special regulatory or economic obstacles to their establishment.

In April 2024, legislators introduced the ICT Authority Bill, 2024, which seeks to regulate the provision of ICT infrastructure and services.51 The bill’s proposed accreditation process and levies for service providers could unfairly disadvantage start-ups and smaller companies and undermine fair competition (see A5).52

The regulatory bodies that oversee service providers generally operate in a fair manner, but there have been some encroachments on regulators’ independence in the past.

The ICT Authority Bill, 2024, which reintroduces many of the provisions from the controversial 2016 ICT Practitioners Bill, would grant the ICT Authority the ability to develop codes of conduct for the sector. Inputs from civil society in response to the bill called for multistakeholder involvement in the development of any such codes. Submitted comments also called attention to potential conflicts of interest introduced by the bill, as the ICT Authority’s role as both a regulator and a service provider could lead to bias in the accreditation process and prevent it from acting impartially.53

The CA is managed by a board of directors that consists of a chairperson appointed by the president, three principal secretaries hired by the Public Service Commission, and seven members appointed by the cabinet secretary of the Ministry of Information, Communications and The Digital Economy (MOIC-DE).54 The day-to-day operations of the regulator are managed by a director general who is appointed by the board to a four-year term, renewable only once.55 The director general is an ex officio member of the board without any voting rights.

While the authority’s independence is provided for under Section 5 of the Kenya Information and Communications Act (KICA), tensions between the MOIC-DE and the board of directors on one side and the director general of the CA on the other have flared up in recent years.

In October 2021, former Independent and Electoral Boundaries Commission (IEBC) chief executive Ezra Chiloba was appointed CA director general.56 During his tenure at the IEBC, Chiloba oversaw a controversial election marred by technical disruptions.57 Following the release of the CA’s 2022/23 audit report, in September 2023, Chiloba was suspended for gross misconduct and negligence for allegedly attempting to defraud the CA of 25 million Kenyan shillings ($162,000).58 Shortly after, in October 2023, Chiloba submitted his resignation to the CA board.59

In December 2022, President Ruto appointed businesswoman Mary Wambui Mungai as the chair of the CA board and replaced board members who had only been recently appointed.60 In December 2023, David Mugonyi was appointed as the new CA director general.61 Mugonyi previously headed the Presidential Communication Service and is considered a trusted ally of the president, which has undermined public confidence in the CA’s independence.

Score Change: The score declined from 6 to 4 because the communication platform Telegram was inaccessible for 16 days during national examinations.

Political and social websites are generally not subject to blocking in Kenya. However, in November 2023, Telegram was inaccessible in Kenya for a 16-day period that coincided with the Kenya Certificate of Secondary Education examinations, following reports that the platform was being used to distribute leaked exam papers.62 The CA did not acknowledge the disruption or provide a reason for the restriction.63 Testing by the Open Observatory of Network Interference (OONI) revealed that several networks showed signs of Telegram being blocked, including Safaricom and Jambonet, which implemented the heaviest restrictions.64

During mass antigovernment protests in June 2024, after the end of the coverage period, data from OONI indicated possible restrictions on messaging apps Telegram and Signal for several hours, in addition to connectivity disruptions (see A3).65

Other social media platforms and communication applications, such as Facebook, X, YouTube, and LinkedIn, were fully accessible during the coverage period.66

In June 2022, the High Court of Kenya ordered ISPs to block live sports streaming sites for infringing on copyrighted material after MultiChoice Kenya, a leading entertainment company, argued in court that these sites continue to limit their revenues from paid subscriptions.67

In July 2022, the NCIC, Kenya’s ethnic cohesion watchdog, threatened to suspend Facebook’s operations if the platform did not take steps to eliminate hate speech (see B7). In August 2022, the MOIC-DE minister clarified that the ministry would not block social media platforms during the election and stated it was not clear what legal framework would be used to suspend Facebook.68 Later that month, Access Now reported that it received no reports of disruption during the voting period.69

Although censorship is not systematic, the state has increasingly sought to remove online content that it deems immoral or defamatory.

In March 2024, the KFCB, Kenya’s film and broadcast content regulator, ordered an artist by the name Embarambamba to pay 6.4 million Kenyan shillings ($42,000) in film and licensing fees, as well as to delete over 1,000 of his YouTube videos that it deemed “indecent.” The KFCB also demanded that the artist cease circulating and broadcasting music videos and obtain a film license.70 After Embarambamba issued a public apology and deleted “unpalatable content” from his YouTube channel,71 the fine and ban on content creation were overturned on the condition that the artist create only ”clean content” in the future.

The same month, the KFCB ordered gospel artist William Getumbe to remove “questionable content” from his platforms or face legal action. Getumbe was arrested a week later for noncompliance with the Film and Stage Play Act (see C3). Charges filed against him included filming without a license, distribution of unclassified audiovisual content, possession of “obscene” films, and public exhibition of indecent content.72

In September 2023, the KFCB reportedly demanded that TikTok disable its livestreaming feature following reports of explicit late-night livestreams. The board’s acting CEO, Joel Wamalwa, reported discussing with TikTok that the livestream feature should be disabled until the company could “ascertain all the credentials that are originating from Kenya.” Following these discussions, TikTok agreed to tailor its algorithm to remove content that violates community guidelines set by both the company and by the KFCB before it goes live and to take down livestreams in violation of the guidelines within one minute of a stream’s start. The platform also reportedly agreed to establish a process for creators to ensure they adhere to KFCB guidelines before they go live. Accounts failing to follow these guidelines would be banned and their devices would risk being blacklisted (see B3).73

The penal code criminalizes same-sex sexual activity, and the KFCB routinely censors LGBT+ content.74 In February 2023, Netflix signed an agreement to restrict LGBT+ content in Kenya and classify content according to the KFCB’s ratings system.75 The board was also reportedly in talks with other local streaming services to restrict LGBT+ content available in Kenya.76 The KFCB previously prohibited both online and offline distribution, exhibition, and broadcast of the films Badhaai Do in February 2022 and I Am Samuel in September 2021.77 The KFCB claimed the films were inappropriate for Kenyan audiences because they attempted to normalize same-sex relationships.

The government occasionally issues content removal requests for reasons other than morality. Between January and June 2023, Google received seven takedown requests for 58 pieces of content from the Kenyan authorities. The company removed 3 content items in response: two removals were in response to legal requests from government officials and one was for violating policy.78 From July to December 2023, Google received five requests for six total pieces of content from services including web search, YouTube, and Google Docs. Two requests came from government officials, and one came from the country’s information and communications authority. The company reported removing five of the content items for fraud, impersonation, and defamation.79 Meta reported restricting one piece of content due to violations of local law between July and December 2022, but between January and December 2023, the company reported no content restrictions specifically imposed in Kenya.80 X (formerly Twitter) has not published data on government content removal requests since 2021.

In recent years, authorities have sometimes compelled ordinary users and online journalists to delete content deemed defamatory from their social media profiles and websites.81

Authorities in Kenya have also made efforts to restrict access to pirated content online. In December 2023, the authorities arrested two people linked to Lime Fiber Internet for providing “illegal internet services” after the ISP gave access to premium sports streaming content to subscribers through the WeCast app.82 Lime Fiber Internet later stated that it was not directly involved in distributing content through the app.83 WeCast remained accessible through the Google Play store, but customers reported that the service stopped functioning the month of the arrest.84

Restrictions on the internet are largely transparent, but censorship of online content sometimes lacks fairness or proportionality.

The KFCB has justified banning advertisements that contain sexual content and promote abortion services by invoking a law that prohibits the airing of sexual content before 10 p.m. Those found to have distributed video content without the KFCB’s approval face fines of up to 100,000 Kenyan shillings ($810) and prison terms of up to five years,85 as outlined in the Films and Stage Plays Act, 2012.86

Following discussions between the KFCB and TikTok (see B2), the social media platform agreed that accounts found in violation of the board’s guidelines for livestreaming content would be permanently banned, and acting CEO Wamalwa stated that the board was pushing for bans not only on accounts but also on devices used to stream on the platform to prevent offenders from creating new accounts using the same device.87 It is unclear if banned users would be able to appeal such decisions.

In advance of the 2017 election, the CA implemented guidelines to curb online abuse in partnership with the NCIC, a statutory body that works to reduce interethnic conflict.88 The broadly worded guidelines prohibit political messages that “contain offensive, abusive, insulting, misleading, confusing, obscene, or profane language,” and analysts warned that they could be used to limit legitimate online expression. The guidelines also require administrators of social media pages to “moderate and control the content and discussions generated on their platform” and give mobile service providers the power to block the transmission of political messages that do not comply with the guidelines at their discretion.89 In addition, bulk political messages require prior approval from the NCIC.

Internet intermediaries in Kenya can be held liable for illegal content, such as copyright infringements and hate speech, though they are not required to actively monitor traffic passing through their networks unless they are made aware of illegal content.90 Under the National Cohesion and Integration Act, 2008 (NCIA), a media enterprise can be fined up to one million Kenyan shillings ($8,100) for publishing hate speech, which is broadly defined in the legislation.91 This provision can be invoked to block or take down online content, according to the Association for Progressive Communications.92

Arrests of online journalists and statements by media regulators have prompted concerns about self-censorship by the press, as threats of gag orders and defamation charges may deter individuals from posting online. The importance of government purchases of advertising to the financial survival of media outlets, including those that publish online, results in some self-censorship among journalists (see B6).

In February 2023, Kenya Union of Journalists Secretary-General Erick Oduor, quoting a report released by the Kenya Media Sector Working Group (KMSWG), said there are 22 laws used by influential actors, including political leaders, to restrict the independence of the media. The KMSWG report found a growing trend of gag orders and exorbitant defamation charges in civil suits, which journalists view as violations of media freedom.93

In March 2023, statements from Senate Majority Leader Aaron Cheruiyot that referred to the media as a “powerful and influential cartel” that needed to be “crushed”94 were seen as further confirmation of diminishing press freedom in Kenya.95

Journalists covering the August 2022 elections expressed concerns and fears that the political environment was becoming increasingly hostile for the media, resulting in journalists practising self-censorship and brown-envelope journalism.96

According to the Media Council of Kenya, press freedom violations have been on the rise in recent years. The police and other government authorities are reportedly responsible for most of the attacks against journalists.97 Such attacks have a chilling effect on speech and can lead to self-censorship online.

False and misleading information continued to spread through Kenya’s online information landscape during the coverage period. Disinformation was utilized to manipulate public perceptions of government performance, as well as to attack media organizations reporting on graft.

In February 2024, following the Nation Media Group’s (NMG) publication of an investigative report about the difficulty of accessing government services, a fake notice from the Kenya Bureau of Standards circulated on social media platforms in Kenya with the hashtag #RIPNationMedia and #WhatIsNationHiding, warning consumers that the NMG and the Standard Group were using printer ink that caused cancer.98 In response, the NMG published an opinion piece reiterating that they would not be cowed by what they called a well-coordinated malicious campaign.99

The Media Council of Kenya reported that during the 2022 general election digital platforms were inundated with misinformation and propaganda, spread by both media houses and influential social media users.100 Presidential front-runners’ political campaign teams also ran active disinformation campaigns that tech platforms failed to curb.101 TikTok was used to spread hate speech, incitement, and manipulated content; researchers from the Mozilla Foundation identified several videos that were widely viewed and contained manipulated content, including a falsified Kenya Television Network bulletin discussing a nonexistent opinion poll, a video of an inauthentic tweet from US President Joe Biden, and videos displaying fake newspaper covers.102

In the aftermath of the 2022 elections, reports emerged of a disinformation and hacking campaign that sought to undermine the credibility of Kenya’s presidential election results. After Ruto was declared the winner, an anonymous source claimed that the Ruto campaign had hacked the IEBC to steal the election and submitted forged logs from the electoral commission’s servers as forensic evidence supporting Raila Odinga’s appeal to overturn the results.103 Although the Supreme Court rejected Odinga’s petition, efforts to undermine the public’s faith in the integrity of the election continued as anonymous bloggers, some of whom were connected to the Odinga campaign, uploaded documents that allegedly contained “authentic” election results.104 These election-rigging narratives had a significant impact on public debate in Kenya, contributing to mass demonstrations in 2023.

Loosely organized “bloggers for hire” use their collective social media clout to shape public opinion and manipulate the online information landscape.105 Participants in disinformation campaigns aimed at Kenyan Twitter users between May and June 2021 coordinated over WhatsApp groups and were paid the equivalent of $10 to $15 a day to boost progovernment narratives. The researchers found that the extent of the campaigns—over 23,000 posts distributed by 3,700 accounts—impacted legitimate activism on Twitter.106

There are few regulatory constraints that negatively affect users’ ability to publish content online. However, media outlets’ reliance on revenue from government advertisements constrains their publication of certain content. Powerful, politically influential media owners have affected the editorial lines and reporting of their outlets to advance their own interests.107 Declining advertisement revenue and layoffs have impacted both traditional and digital media journalists.

The controversial ICT Authority Bill, 2024—which revived a 2016 bill aimed at regulating the provision of ICT services in Kenya—introduces technical qualifications for individuals and companies to receive government accreditation required to operate, including university degrees. The bill includes websites in its definition of “ICT resources” that require accreditation. If passed, the bill could exclude a large number of website owners and prevent those who lack formal higher education from publishing online.108

The government has been known to use its advertising budget to influence media outlets’ editorial choices, resulting in financially induced self-censorship (see B4).109 Some online outlets also adjust the tone of their content to avoid upsetting other major advertisers,110 though this phenomenon has been more frequently observed among traditional media outlets.111 In June 2023, sitting cabinet secretary Moses Kuria threatened to withhold government advertising from the Nation Media Group after they published an expose of a cooking oil import scheme that allegedly involved government officials. Kuria accused the NMG of being an opposition party and threatened to fire government officials who advertised with the media house.112 The High Court in Nairobi later issued an injunction against Kuria to stop him from further “insulting or vilifying” the media.113

The Government Advertising Agency (GAA) was established in 2015 to manage government advertising purchases. In August 2018, the Directorate of Criminal Investigation began an investigation of the GAA for allegedly failing to pay 2.8 billion Kenyan shillings ($23 million) in advertising fees owed to media outlets.114 The KMSWG claimed in May 2019 that the GAA was actively working to muzzle the media by starving outlets of needed revenue.115 In December 2022, MOIC-DE cabinet secretary Eliud Owalo expressed concerns over major media layoffs and guaranteed that the GAA would settle its outstanding debt of 1.15 billion Kenyan shillings ($9.3 million) with media houses.116 While Owalo expressed a commitment to ensuring media outlets have sufficient funding, the current government has slashed its advertising budget by 75 percent.117 The government had still not paid the estimated total of 19 billion Kenyan shillings ($123,000) of its debts as of May 2024.118

In March 2024, the government sent out a directive that all government agencies should air their television and radio advertisements exclusively on the state-owned national broadcaster, Kenya Broadcasting Corporation (KBC).119 The directive aims to both improve KBC’s revenues and to avoid further debts to media houses.

The online information landscape is diverse and vibrant, with outlets reporting on many issues and offering a wide range of viewpoints. Social media platforms have become an important means for journalists to gather and share news. Traditional broadcast outlets have increasingly utilized social media and other digital platforms to interact with users in real time. However, false and misleading information on social media and digital platforms has undermined the reliability of the information space, in some cases stoking ethnic rivalries.

During the 2022 elections, the online information landscape was filled with misinformation and disinformation that made it difficult for Kenyans to distinguish between false and credible information. Online platforms like Facebook, Twitter, and TikTok made content moderation promises but failed to curb misinformation on their platforms (see B5). In July 2022, the NCIC threatened to suspend Facebook’s operations in Kenya if the platform could not address hate speech and inciting language on its platform, after it was revealed that Facebook had approved 20 political advertisements containing hate speech.120

Following the 2022 elections, Raila Odinga’s claims of election fraud were amplified online by anonymous bloggers, who leaked what they claimed were “authentic” election forms and forged documents that attempted to discredit William Ruto’s victory (see B5). Mass protests held in March 2023 over alleged fraud in the 2022 elections led to three deaths, several hundred injuries, and the looting of a number of businesses.121

Since 2018, Facebook has partnered with Africa Check, Africa’s first independent fact-checking organization, and Agence France-Presse (AFP) to help assess the accuracy of information being disseminated on its platform.122

Online tools for civic mobilization are freely available to users, but the authorities’ suppression of some forms of digital dissent limits their effectiveness. Social media, especially X (formerly Twitter), continues to be a critical platform for debate, advocacy, and mobilization on issues of public interest.

After the end of the coverage period, activists and social media users organized mass protests using the hashtag #RejectFinanceBill to oppose controversial tax increases under the proposed Finance Bill, 2024. The government responded to the protests with a widespread crackdown, reportedly abducting online activists involved in organizing the protests.123 Internet disruptions during the protests and indications that some messaging apps may have been temporarily blocked (see A3 and B1) also impacted people’s ability to mobilize.

Public hospital doctors who went on strike in March 2024 to organize for higher salaries and better working conditions used the hashtag #DoctorsStrikeKE on X to share their demands and mobilize public support.124 In January 2024, in response to an uptick of femicide in the country, Kenyans used the hashtags #EndFemicideKE and #StopKillingUs on X to rally and spread awareness of gender-based violence, which culminated in a nationwide protest.125

Ahead of the August 2022 elections, Kenyans on social media used the hashtag #KenyaDecides2022 to provide crucial general election updates. In March 2023, as opposition leader Raila Odinga led the country in nationwide protests against alleged electoral misconduct, the high cost of living, and government corruption,126 Kenyans used the hashtag #maandamano to participate in the protest both online and offline. In 2022, Twitter suspended the accounts of 22 activists who had participated in the #NjaaRevolution campaign, an online campaign protesting increasing food and commodity prices. Several of these accounts were suspended without a clear explanation from Twitter. Civil society organizations voiced concerns that these suspensions constituted censorship during the critical pre-election period.127

During a previous coverage period, users mobilized around the #ProtectQueerKenyans and #JusticeForSheila campaigns, which began after a member of the LGBT+ community was murdered in their home in April 2022.128

In the face of exceptionally high youth unemployment,129 Kenyans also use the hashtag #IkoKaziKE as a resource to find jobs and share hiring opportunities.

Freedom of expression is enshrined in Article 33 of the 2010 constitution and includes the rights to seek, receive, or impart information and ideas. However, these rights are frequently violated in practice, including for online journalists and other internet users.

The judiciary is relatively independent. However, President Ruto in January 2024 publicly accused some judges of corruption and of working with the opposition after the High Court in Nairobi blocked the introduction of an income tax that would have funded the construction of public housing, ruling the policy discriminatory and unconstitutional. Ruto’s remarks raised concerns of judicial independence in the face of undue pressure from a sitting president.130

In September 2022, several court cases against high-profile individuals charged with corruption and murder were withdrawn, raising questions about the courts’ ability to act independently.131 One such case was a $60 million corruption case against sitting deputy president Rigathi Gachagua.132

Despite this, the judiciary still exercises checks on the government. In March 2023, Kenya’s Supreme Court ruled that it was discriminatory for the government to prevent the registration of LGBT+ associations, a decision that has been met with great opposition from the government and religious groups.133

In April 2022, the Supreme Court ruled that the constitutional review process advanced by then president Kenyatta, which would have expanded the executive arm of the government at the expense of then prime minister Ruto, was unconstitutional.134 A High Court panel previously found that the process lacked sufficient public participation, though this decision was contested several times.135

Laws on hate speech and defamation are frequently used to prosecute online critics of the government, though courts have occasionally invalidated such provisions on constitutional grounds.

The Computer Misuse and Cybercrimes Act (CMCA), which was adopted in May 2018 and subsequently challenged in court, threatens to further restrict freedom of expression online. According to the law, anyone who “knowingly publishes information that is false in print, broadcast, data, or over a computer system, that is calculated or results in panic, chaos, or violence among citizens of the Republic,” or which is likely to discredit someone’s reputation, can be sentenced to a fine of as much as five million Kenyan shillings ($40,500) and up to 10 years in prison.136

Shortly after the law was promulgated, the Bloggers Association of Kenya (BAKE) sued to overturn 26 problematic provisions.137 A High Court judge ultimately dismissed BAKE’s case in 2020, ruling that the law does not violate freedom of expression and allowing the suspended provisions to take effect. BAKE and the Law Society of Kenya appealed the High Court’s ruling to the Court of Appeal.138 This case had not yet been heard as of May 2024.

Hate speech is penalized under the NCIA, which was passed in response to widespread ethnic violence following the 2007 general elections.139 Individuals found guilty of spreading hate speech, which is broadly defined, can face a fine of as much as one million Kenyan shillings ($8,100), a prison term of up to three years, or both.

During the coverage period, arrests and prosecutions for publishing false information under the CMCA increased.

In February 2024, a former Savings and Credit Cooperative Organization (SACCO) official, Joseph Mwendwa Kitheka, was arrested for knowingly publishing false information through his WhatsApp status that discredited the reputations of the current SACCO CEO and vice chairman. Kitheka pled not guilty and his lawyer argued that the complaints were an attempt to sabotage the cooperative’s upcoming elections. He was granted cash bail of 50,000 Kenyan shillings ($325.)140

In January 2024, blogger Cyprian Nyakundi was charged in court and barred from posting false information about the CEO of the Kenya Union of Savings and Credit Co-operatives (KUSCCO). Nyakundi’s posts on the social media platform X allegedly tarnished the reputation of the organization and were resulting in panic amongst members, jeopardising the stability of the financial institution.141

In November 2023, Nuru Okanga, a supporter of opposition leader Raila Odinga, was arrested after allegedly insulting President Ruto in a viral YouTube video for the channel Riba News. He was charged with publishing false information that sought to tarnish the reputation of a state officer and upset the peace.142 He was granted bail of 10,000 Kenyan shillings ($65).

In September 2023, blogger Silvance Adongo Abeta was arrested and charged in court for publishing false information online and for cyberbullying under the CMCA after posting on X under a pseudonym, alleging that deputy president Gachagua had placed a bounty on Ndini Nyoro, a member of parliament. He was released on a 100,000 Kenyan shillings ($650) cash bail.143

In July 2023, a lawyer was arrested and charged in court for publishing false information prejudicial to the public order and security after posting on X that the army would take over the government. Authorities confiscated his mobile phone, and prosecutors pushed to ban him from posting on X; the judge did not order the release of the phone or bar him from posting on the platform. He was released on a bond amount of 200,000 Kenyan shillings ($1,300.)144

In the same month, opposition blogger Pauline Njoroge was also arrested for alleged possession of narcotics. After her arrest, however, she was charged with publishing false information and two counts of cyberharassment on her X account on allegations of having intentionally discredited the reputation of President Ruto.145

The Film and Stage Play Act, which requires certification from the KFCB to exhibit or distribute films, is also used to punish users for their online expression. In March 2024, gospel artist William Getumbe was arrested for non-compliance with the Film and Stage Play Act, after he failed to comply with an order from the KFCB to remove “questionable content” from his online platforms (see B2). Charges filed against him included filming without a license, distribution of unclassified audiovisual content, possession of “obscene” films, and public exhibition of indecent content.146

Kenyans can freely use encryption tools, but a number of regulations and monitoring systems limit anonymous communication.

Anonymity is compromised by the expanding scope of mandatory SIM card registration and efforts to track the illicit sale of mobile phones. In 2017, Safaricom began keeping records of anyone registering for or renewing a SIM card, in compliance with the existing SIM card registration requirement.147 148 During the registration process, authorities collected pictures of identification documents,149 even though they were not required to do so under the regulation governing the registration of SIM cards.150 In addition, individuals under the age of 18 were required to present a copy of their birth certificate to register their SIM cards.151 The government stated that those in possession of unregistered SIM cards would face fines of up to 300,000 Kenyan shillings ($2,430), a six-month prison sentence, or both.152 The SIM cards of subscribers who failed to register by October 15, 2022 were deactivated.153

Regulations also grant the communications regulator access to service providers’ offices and records without a court order (see C6), raising concerns about the lack of judicial oversight.154

Article 31 of the 2010 constitution provides for the right to privacy. However, authorities surveil internet activities under laws that enable them to search and seize data on national security grounds, directly infringing on users’ privacy rights. The Data Protection Act, 2019 (DPA) leaves room for officials to continue to bypass user consent and access private data for national security reasons (see C6).

In April 2020, the Court of Appeal overturned a 2018 High Court decision, thus permitting the government to implement the Device Management System (DMS). The DMS is a mechanism for identifying counterfeit and illegal phones, but it also gives the CA access to mobile subscriber data, including call records.155 In June 2020, the Law Society of Kenya appealed the case to the Supreme Court over concerns that the DMS would infringe on subscribers’ right to privacy.156 In April 2023, the Supreme Court rejected the petition, allowing the CA to move forward with the implementation of the DMS.157 The CA has stated that it will only be able to access unique phone identifiers and subscriber numbers, but telecommunication companies like Safaricom have raised concerns that the system would grant the regulator access to other customer data.158

Section 48 of the CMCA allows the authorities to search and seize stored computer data and to collect and intercept data in real time.159

The KICA prohibits many forms of monitoring and interception of communications,160 though the Prevention of Terrorism Act, 2012 (PTA) allows the authorities to limit constitutional freedoms, such as the right to privacy, during investigations into terrorism.161 Amendments to the PTA in 2014 explicitly enabled national security bodies to intercept communications “for the purposes of detecting, deterring, and disrupting terrorism,”162 though this action must be authorized through an interception order from the High Court.163

Independent research has revealed various surveillance technologies that the authorities or other actors may employ to monitor citizens. A December 2020 investigation by Citizen Lab identified the Kenyan government as a likely customer of Circles, a surveillance company. Circles products allow customers to monitor calls, texts, and cell phone geolocation by exploiting weaknesses in mobile telecommunications infrastructure.164

Evidence of unlawful or disproportionate state surveillance has emerged in recent years. According to 2018 research published by Citizen Lab, Kenya is one of 45 countries worldwide where the use of Pegasus, a surveillance software tool developed by the Israeli technology firm NSO Group, has been detected. The spyware has targeted customers of Safaricom and Simbanet, and it is known to be used by governments elsewhere to intrusively monitor journalists, human rights defenders, and political opponents.165

In 2017, researchers identified a “middlebox,” a dual-use networking device that can filter or manipulate internet traffic, on a Safaricom network, which led to concerns over potential privacy violations.166 Safaricom denied using a middlebox, and subsequent tests returned negative results. Researchers concluded the technology was no longer in use.

The British nonprofit organization Privacy International (PI) separately revealed in a 2017 report that Kenyan national security agencies, especially the National Intelligence Service (NIS), have unlawful direct access to communications systems, allowing for the interception of both traffic data and content.167 Based on interviews, PI found that law enforcement and national security agents have a physical presence in the facilities of telecommunications providers. The report also indicated that intercepted information could be freely shared with other government agencies. PI also assessed two NIS cybersecurity projects, the Network Early Warning System and the National Intrusion Detection and Prevention System, which aim to monitor telecommunications traffic for cybersecurity threats. PI raised concerns that the two systems could monitor content as well as traffic, based on internal documents it received.168 Given the national security framework in which the systems are being implemented, transparency and oversight will be limited.

Service providers and other technology companies are not usually required to aid the government in monitoring the communications of their users, although at times authorities have reportedly requested their assistance. A data protection law passed in November 2019 offers safeguards for user data but includes broad exemptions that allow the government to sidestep the protections, endangering the right to privacy.

The Data Protection Act (DPA) regulates the collection, processing, storage, use, and disclosure of information relating to individuals.169 Processing that is “necessary for national security or public interest” is broadly exempted from the law’s protections, opening the door to government abuse. There are also exemptions to limits on data retention if retaining the data is required by law or “reasonably necessary for a lawful purpose.”170

The DPA established the Office of the Data Protection Commissioner (ODPC) to oversee implementation, but the entity has not been classified as an independent office under the constitution, raising concerns about its autonomy.171 In October 2020, Immaculate Kassait, a former IEBC commissioner, was appointed Kenya’s first data commissioner.172

The Data Protection (General) Regulations, 2021, passed in February 2022, operationalize the DPA and set out procedural guidelines for data controllers and data processors. Under the regulations, data controllers and data processors are required to ensure users give consent for their personal data to be used and to process personal data through servers located in Kenya.173 Draft regulations to implement the DPA, including the Data Protection (General) Regulations, 2021, were previously criticized for inadequately protecting the rights of data subjects and failing to create exemptions to data processing requirements for journalists.174

In May 2024, Kenya’s National Treasury sought to amend the DPA through the controversial Finance Bill to introduce an exemption for the Kenya Revenue Authority (KRA) that would allow it to access taxpayers’ sensitive data, such as property registries and information about bank accounts, without a court warrant to prosecute tax cheats.175

In March 2024, the ODPC contacted TikTok to request that the company demonstrate it is in compliance with local privacy and user verification laws, claiming that the platform had been used to spread propaganda, fraud, and sexual content.176 In April, members of the ODPC met with representatives from TikTok to discuss the company’s compliance with data protection regulations.177

In May 2023, the ODPC instructed the cryptocurrency company Worldcoin to halt its collection of Kenyans’ biometric data until it complied with the principles for processing personal data outlined in Section 25 of the DPA, including adequate protection of data subjects, a directive that the company ignored. Worldcoin was offering Kenyans 7,000 Kenyan shillings ($50) to have their irises scanned in what it said would be “the world’s largest human identity and financial network.” Thereafter, the High Court barred Worldcoin from collecting data and ordered it to preserve existing data that it had collected from Kenyans for review following a petition from the ODPC in August 2023.178 However, after negotiations with the government, Worldcoin was set to resume operations under new guidelines in early 2024.179

In September 2023, the ODPC issued three penalty notices totaling 9.4 million Kenyan shillings ($61,000) to data controllers for failing to comply with the DPA.180 The penalties were handed down to a school and a restaurant for posting photographs online without consent and to a mobile lending app for obtaining names and contact details from third parties to send threatening messages and phone calls.

As part of the countrywide SIM card registration directive by the Communications Authority in 2021, Safaricom began collecting biometric data during their SIM card registration process. However, after the CA revised its requirements for biometric data, Safaricom continued asking users for more data than was legally required.181 Following backlash from civil society, the telecommunications company dropped biometric data from their SIM card registration requirements but did not comment on the data it had already collected.182 Safaricom and the CA also faced a class action suit for requiring subscribers to sign a data privacy agreement that allowed the telecommunications company to collect bank account details.183 Safaricom and other businesses are also at risk of facing hefty fines for collecting personal data when users make payments using the “Lipa Na M-Pesa” feature. Currently, when customers pay for goods and services, their contact details are revealed, potentially allowing their data to be traded to advertisers and fraudsters.184

Under the KICA and the SIM card registration regulations, licensed providers are required to retain registration information on subscribers and their SIM cards and to retain call data records for a period of time stipulated by the CA. Licensees can be required to disclose customer data when presented with a court order or an act of parliament or hand it over to the CA or law enforcement agencies.185

Other laws, like the Preservation of Public Security Act, the Official Secrets Act, 1968 (OSA), the National Intelligence Service Act, 2012, and the PTA, limit the privacy of personal data, ostensibly to safeguard national security.186 In 2020, the president signed a law that amended the OSA to require “any person who owns or controls any telecommunications apparatus used for the sending or receipt of any data to or from any place outside Kenya” to provide such data to the government. Such requests may be authorized by the president’s cabinet security, rather than through the courts. Those who refuse risk a one-year prison sentence, a fine of one million Kenyan shillings ($8,100), or both.187

PI has reported that Safaricom routinely supplies data to the authorities without a warrant for intelligence purposes. Safaricom claims that it only cooperates when the authorities present a court order.188

In May 2022, the Kenya Review Authority (KRA) announced that it planned to purchase a software that could scan data in emails, computers, smartphones, and social media accounts to combat tax and financial fraud.189 Kenyans have protested, saying that the KRA’s monitoring would be intrusive and unconstitutional.

Score Change: The score declined from 3 to 2 because multiple individuals faced physical violence, including abduction, torture, and murder, in retaliation for their online political expression during the coverage period.

Bloggers and internet users have faced increasing intimidation and violence in retaliation for their online activities in recent years. The current coverage period saw a string of violent attacks against those who expressed their political opinions online, with perpetrators linked to political figures in some cases.

In response to mass protests against the 2024 Finance Bill in June 2024, after the end of the coverage period (see B8), authorities reportedly abducted online activists involved in organizing the protests.190

In April 2024, blogger and activist Duke Nyabaro, who had commented on political topics in Kisii County, was found dead with a rope around his neck; the postmortem examination later ruled that he was strangled to death.191

In February 2024, another political commentator and blogger, Peris Mugera, went missing in Tharaka Nithi County until her body was found with bruises on her forehead on a roadside five days later. No suspects had been arrested for the murder as of March 2024.192

In December 2023, Meru political activist and blogger Daniel Muthiani (alias Sniper) disappeared after reportedly receiving a phone call about posts he had made on social media. Two weeks later, his body was found along a riverbank with fractured ribs, head injuries, and evidence of strangulation as well as torture before his death, according to the postmortem examination.193 The brother of the Meru governor is among the suspects charged with Muthiani’s murder, though a sentence had not been handed down by the end of the coverage period.194

In August 2023, a primary school teacher, Adam Kenneth Nthiga, was abducted and tortured in retaliation for a post he made on Facebook about the poor state of roads in his ward. He was taken to an undisclosed location in Tharaka Nithi County, stripped, and severely beaten.195 A member of the county assembly was one of three suspects charged with Nthiga’s abduction and torture.196

More than a quarter of Kenyan women have experienced some form of online gender-based violence, according to a 2020 report from Pollicy, a technology consulting firm.197 Female candidates faced rampant online harassment throughout the 2022 elections. During the elections, nearly 56 percent of female candidates experienced online violence, compared to 35 percent of male candidates, according to a study from Pollicy published in May 2023. Pollicy also found that 25.7 percent of female candidates on Facebook and 43.1 percent on X experienced sexualized online harassment.198

During the 2022 election period, at least 43 journalists reported incidents of harassment, most of which involved denying journalists access to polling places.199

Score Change: The score improved from 1 to 2 because there were no cyberattacks against media, civil society, or opposition groups reported during the coverage period.

Despite the National Computer Incident Response Team detecting 123 million cyberthreats between July and September 2023, a decrease from 278 million during the previous year, hacking and other forms of cyberattacks are a growing problem in Kenya.200 201 Financial institutions are frequent targets; however, during the coverage period, government ministries and parastatal organizations were the major target of technical attacks.

In July 2023, the eCitizen platform, where Kenyans access government services online, was the target of a distributed denial-of-service (DDoS) cyberattack, leaving it temporarily inaccessible. Mobile money services also suffered outages as a result.202 Hacking group Anonymous Sudan, which is believed to have ties to Russia, claimed responsibility for the attack. In an interview confirming the attack, cabinet secretary Owalo stated that the hackers were not able to access citizens’ personal data and that no data was lost.203

In July 2023, the Kenya Bureau of Standards (KEBS) suffered a major data breach after being targeted with a ransomware attack from Rhysida Ransomware Group. Rhysida published 739 GB worth of data belonging to the KEBS after the bureau refused to pay the ransom.204

In May 2023, Reuters reported that at least eight government ministries had been infiltrated by a group of hackers based in China with ties to the Chinese government between 2020 and 2022, in a years-long operation to gather information on debts owed by Kenya to China.205 The office of the president stated that none of the attacks had been successful, and the principal secretary for internal security and national administration referred to the Reuters report as “sponsored propaganda.”206

In February 2023, a consortium of investigative journalists reported that an Israel-based hacking and disinformation firm led by Tal Hanan had demonstrated it had hacked the email and Telegram accounts of Dennis Itumbi and Davis Chirchir, two senior members of William Ruto’s campaign staff.207 Through these accounts, Hanan and his team had also gained access to the United Democratic Alliance’s (UDA) internal website for tracking polling results. A local cell provider allegedly cooperated with Hanan’s team to facilitate the intrusion,208 which raised suspicions of state involvement in the attempt to surveil and undermine the Ruto campaign. These attacks on the opposition’s presidential campaign constituted a part of a larger effort to undermine the credibility of Kenya’s election results (see B5) and threaten the peaceful transfer of power in Kenya.

In June 2022, Kaspersky Lab reported that SessionManager, a backdoor used to target nongovernmental organizations, government entities, medical firms, and transportation companies, had been used in Kenya, though its targets were not identified.209

Under the CMCA, hackers face a fine of up to five million Kenyan shillings ($40,500), up to three years in prison, or both for unauthorized access to, interference with, or interception of data on computer systems; unauthorized disclosure of passwords; and cyberespionage, among other offenses.210