The draft Online Safety Bill, 2026, would allow the Communications Authority of Kenya to fine social media and online service providers up to KSh500 million or 10 per cent of their annual global turnover, whichever is higher, for breaching a statutory duty of care.
The Bill covers social networks, search engines and other online services accessible in Kenya, naming platforms such as TikTok, Facebook, Instagram, X and YouTube, and creates a duty of care that obliges providers to conduct risk assessments at least once a year on how recommendation algorithms, content distribution systems and platform size may facilitate illegal or harmful material.
Providers would be required to act promptly when illegal content is identified or reported, and the Bill lists priority categories that include terrorism-related material, child sexual exploitation, pornography, bullying, identity-based abuse, incitement to hatred, serious violence and content encouraging self-harm or dangerous behaviour; it also separates illegal content from material harmful to children, triggering safety obligations even where the content is not a criminal offence.
For services likely to be used by children, the Bill proposes that platforms assess risks such as grooming, predatory contact and cyberbullying and obtain parental consent before allowing access, with verification methods that may involve credit-card checks, secure identity cross-referencing or decentralized digital identity systems, while requiring compliance with the Data Protection Act and data-minimisation principles.
Clause 18 sets the fine of up to KSh500 million or 10 per cent of global turnover for non-compliance, and senior executives who consent to a breach, take part in it or are grossly negligent could face a fine of up to KSh10 million, up to five years’ imprisonment, or both; the Communications Authority may also issue civil penalties based on the seriousness, duration and financial capacity of the provider, with appeals possible to the Communications and Multimedia Appeals Tribunal within 30 days.
The Bill includes safeguards that require proportionality, exempt platforms from proactively scanning private messages, and stipulate that any scanning technology must satisfy tests of necessity, proportionality and data protection, with human review in certain circumstances.
Clause 12(2) bars a child from accessing any regulated service without verified parental consent, and the draft mentions verification methods such as credit-card checks and linking to national identity cards, raising concerns about data-minimisation and the ability of users without official documents to access services.
The legislation remains a proposal pending parliamentary debate, public participation and likely amendments before it can become law.
