Kenya has published a proposed Online Safety Bill 2026 that would put a statutory duty of care on social networks, search engines and other online services available in the country. The goal is legitimate. The mechanism, as reported, is heavier than the evidence for it supports.
The strongest case for the bill
Children in Kenya do face real online harms: grooming, cyberbullying, and recommendation systems that can push self-harm content. Self-regulation by large platforms has been uneven, and Kenyan regulators have had little leverage over companies with no local presence. A duty of care that requires annual risk assessments, and that looks at how recommendation algorithms spread harmful material, is a systemic approach that is preferable to ordering individual posts removed. Techweez reports that the bill requires providers to assess risks at least once a year and to act "quickly and appropriately" once they learn of illegal content. It also reportedly says platforms are not obliged to proactively scan private messages, and that any scanning must meet necessity, proportionality and data-protection tests. Those are real safeguards, and they deserve credit.
What the bill would do
According to Techweez, the bill covers social networks, search engines and other services accessible in Kenya, and the Cabinet Secretary could add categories by regulation. It lists priority harms including terrorism, child sexual exploitation, bullying, incitement to hatred, serious violence and content encouraging self-harm. It separates illegal content from content that is harmful to children.
The Communications Authority of Kenya (CA) would be the regulator. It could issue compliance notices naming the alleged breach and the required fix, and impose civil penalties. Certain decisions could be appealed to the Communications and Multimedia Appeals Tribunal within 30 days.
The penalties are what set this bill apart. Clause 18 reportedly proposes fines of up to KES 500 million or 10% of annual global turnover, whichever is higher. Executives who consent to, take part in, or are grossly negligent in a breach could face up to KES 10 million, five years in prison, or both. TechTrendsKE reports that the bill was introduced by Embakasi West MP Mark Mwenje.
A caveat on sourcing: we could not locate the official bill text. The penalty figures and clause numbers come from trade press, and the two outlets we read describe different instruments. TechTrendsKE separately reports a Kenya Information and Communications Amendment Bill 2026 that would add a Section 85C requiring platforms to register with the CA and report unlawful activity. The clause-level details should be checked against the gazetted text.
Where it overreaches
Turnover-based fines are a blunt tool. A 10% global-turnover ceiling is modelled on the largest regimes in the world. Kenya's market is a small share of any global platform's revenue, so the fine can exceed what the Kenyan business earns. The rational response for a smaller provider is to geo-block Kenya or to over-remove lawful content. Neither helps Kenyan users, creators or startups building on these platforms. The fixed KES 500 million alternative is more proportionate, but "whichever is higher" removes that benefit.
Personal criminal liability for "gross negligence" is vague. Prison terms of up to five years for executives turn a compliance dispute into a threat against individuals. Kenya's courts have limited experience with what counts as "grossly negligent" in algorithmic content moderation. Vague standards combined with prison sentences push platforms to remove first and ask questions later, which falls hardest on political speech, satire and journalism.
Age verification by card or national ID carries privacy costs. TechTrendsKE reports that the bill would require "highly effective age verification or age estimation," with parental authorisation checked through credit card verification, cross-referencing the parent's identity, or decentralised digital identity. The CA could approve other methods. Credit card ownership in Kenya is low, so a card-first approach may exclude many families, and ID-based checks tie online activity to a verified real-world identity. That sits uneasily with the Data Protection Act 2019, which already regulates how children's data is processed and which the Office of the Data Protection Commissioner publishes. Collecting more identity data to protect children creates a larger store of sensitive data to protect.
The regulatory backdrop
This bill does not arrive in a vacuum. The CA's Industry Guidelines for Child Online Protection and Safety entered into force on 29 October 2025, according to the Digital Policy Alert tracker, and are tagged with an age-verification requirement. Kenya already has a child-protection framework that is only a year old. Parliament should ask what the guidelines have achieved, and what evidence of harm they leave unaddressed, before legislating much harsher penalties on top of them.
A better design
Parliament can keep the core of the bill and fix its weak points:
- Cap fines by reference to revenue earned in Kenya, or keep the fixed amount alone.
- Limit personal liability to defined, wilful failures, such as ignoring a compliance notice, rather than "gross negligence."
- Require privacy-preserving age assurance, such as on-device estimation or tokenised proof of age, and bar platforms from keeping identity documents.
- Publish the regulator's evidence on harm and on how well the 2025 guidelines are working before the penalties take effect.
- Run real public participation. As of today we found no published comment deadline.
Kenya is right to want accountable platforms. The strongest version of this bill would hold them to a duty of care that is clear, proportionate and enforceable without making Kenyan users hand over their identity or leaving them without services.