Post about a breaking news event, share an unverified allegation, or even repeat a rumor in a WhatsApp group, and until this year you could, in theory, have faced up to ten years in prison. That was the potential consequence of Sections 22 and 23 of the Computer Misuse and Cybercrimes Act, which criminalized the publication of “false” information using broad and vaguely defined offences. The provisions cast a long shadow over anyone with access to a phone or the internet. On 6 March, however, the Court of Appeal struck them down. In a case brought by the Bloggers Association of Kenya, International Commission of Jurists (ICJ) Kenya, Article 19 and others, the court called them so broad they were “like unguided missiles.”
The judges reached back to Galileo’s story to make a powerful point: what is considered false today may prove true tomorrow. A state that criminalizes “falsehood” therefore risks policing satire, journalism, opinion and honest mistakes. That is precisely why Articles 33 and 34 of the Constitution protect freedom of expression and media freedom. It was arguably the most significant victory for digital rights in Kenya during the first half of 2026 and a fitting place to begin, because much of what follows tells a more troubling story.
So, how did Kenya perform on digital rights between January and June 2026? Measured against the Constitution and the Data Protection Act, 2019, the country’s record is mixed.
The regulator: A-minus
The strongest performer has been the Office of the Data Protection Commissioner. It opened the year having awarded more than KES 30 million in compensation, processed over 9000 complaints and issued 184 enforcement orders.
In February alone, the ODPC ruled against a hospital, an insurance company, a school, a SACCO, and several digital lenders. It ordered St Luke’s Orthopaedic Hospital to compensate patients for mishandling medical records, sanctioned lenders for debt-shaming and unlawfully harvesting borrowers’ contacts and ordered an events company to pay KES 300,000 for using a woman’s photograph without her consent. The regulator also confirmed that Worldcoin had deleted the iris scans it collected from Kenyans, enforcing compliance with a Kenyan court order against a Silicon Vally-backed company.
Corporate and platform accountability: C-plus
The courts also delivered important wins. On 13th May, the High Court held Safaricom liable for violating subscribers’ constitutional right to privacy following a data breach and awarded more than KES 11 million in damages to the eleven petitioners.
The more difficult test, however, remains with Meta. A Swedish investigation revealed that workers at Sama in Nairobi were reviewing highly sensitive footage captured by Ray-Ban smart glasses, including nudity, banking information, and videos of unsuspecting members of the public, raising serious concerns that promised anonymization measures were failing. In response, the Oversight Lab, backed by more than 150 organizations, petitioned the ODPC to open its own investigation into user consent, AI model training and cross-border data transfers.
Expression and the surveillance shadow: B-minus
March brought a major constitutional victory when the Court of Appeal struck down Sections 22 and 23 of the Computer Misuse and Cybercrimes Act. The provisions, which criminalized the publication of “false information” and exposed journalists, bloggers and ordinary citizens to prison terms of up to ten years, were declared so broad that the judges likened them to “unguided missiles.” It was a significant affirmation of Articles 33 and 34 of the Constitution.
By mid-April, the case had reached the Supreme Court, where the Director of Public Prosecutions sought to reinstate the struck-down provisions while civil society groups argued for an even broader protection of digital rights. In May 2026, the Law Society of Kenya, BAKE, Article 19 and the Kenya Union of Journalists asked the Supreme Court to strike down the Act’s surveillance provisions altogether.
These legal victories exist alongside persistent concerns. Kenya continues to score just 52 out of 100 on internet freedom. Questions surrounding the unexplained internet disruptions during the 2024 protests remain unanswered, reports of Telegram restrictions during national examinations continue, and the government is now facing a fresh constitutional challenge over blocking citizens from its official social media accounts.
Children and young people: fail
This is where Kenya performs worst.
Within these last couple of months, Parliament has considered proposals to bar children under sixteen from social media, while the Artificial Intelligence Bill currently before the Senate contain no meaningful provisions to protect children online. At the same time, children continue to face growing risks from data collection, online exploitation, and AI-powered technologies without an adequate legal framework to safeguard them.
The verdict:
Kenya’s digital rights landscape presents two competing realities. The country’s data protection regulator is stronger than it has ever been. The courts are increasingly willing to call out constitutional violations, and landmark judgments have strengthened freedom of expression online.
Yet significant threats remain. Broad surveillance powers are still embedded in law, internet disruptions remain largely unresolved, and children continue to navigate an increasingly digital world without adequate legal protections.
The rights are already written in our Constitution. Whether they are truly protected depends on whether we continue treating digital rights violations as unacceptable exceptions or quietly allow them to become the new normal.