Experts warn new Bill targets online privacy of Kenyans

A proposed law presented as a consumer protection measure is sparking concern among digital rights advocates and human rights defenders, who caution it may introduce one of the most intrusive state surveillance systems the country has ever seen.

The Kenya Information and Communications (Amendment) Bill, 2025, introduced to parliament by Aldai MP Maryanne Kitany, aims to "protect the economic interests" of internet users.

In her explanation, Kitany states that the Bill aims to establish and implement a quality metered billing system that can track customer usage, translate data into understandable information, and generate invoices based on individual consumption.

However, digital rights experts warn that the Bill masks a disturbing agenda involving mass data collection, real-time surveillance of citizens, and a threat to human rights, all under the pretense of regulating internet billing by service providers.

The amendment suggests introducing a metered internet billing system, where every user would receive a Unique Meter Number linked to their internet activity for tracking purposes.

If enacted, the bill would require Internet Service Providers (ISPs) to track customer usage, convert the data into "readable details," and submit reports to the Communications Authority of Kenya (CA) at least once per financial year.

Victor Ndede, Technology and Human Rights Manager at Amnesty International, warns that the bill could significantly undermine fundamental rights and freedoms.

Ndede termed the proposed law an “invasive and extensive data collection and surveillance of citizens”.

Victor Ndede questioned the bill’s lack of clarity on what specific customer usage would be monitored, saying, "The bill mentions converting customer usage into readable details but doesn’t specify what data is being tracked or what will be shared with the Communications Authority."

He added, "If this were truly about billing, the data they plan to collect far exceeds what’s necessary. Assigning unique meter numbers to individuals clearly points to surveillance. Such identifiers create a traceable profile, which goes beyond simply measuring how much data someone used."

In response, Kitany insists the bill does not restrict fundamental human rights.

However, digital rights experts argue that it violates Kenya’s Data Protection Act and Article 31 of the Constitution, which protect citizens’ privacy and guard against unauthorized monitoring of personal communications.

“This means the Communications Authority would hold extensive data on nearly every person in the country and their online activities,” he explained.

Ndede added, “Although the bill mandates data submission only once a year, nothing prevents the Communications Authority from requesting or demanding an individual’s billing information at any time. This raises serious concerns.”

Experts warn that the bill could lead to a cybersecurity crisis, as the large volumes of sensitive personal data held by internet service providers and government agencies may become attractive targets for hackers, rogue insiders, and potential authoritarian abuse.

“There are no clear safeguards in the bill regarding how the Communications Authority of Kenya (CAK) will store, protect, or use the collected data. The powers granted are overly broad and come with minimal oversight. Additionally, ‘customer usage’ remains undefined,” Ndede remarked, describing it as massive and unchecked data collection.

He compared the proposed unique identifier and usage tracking to electricity token meter numbers for prepaid services.

"It’s like asking Kenya Power to figure out whether the fridge, cooker, TV, or washing machine consumed the most electricity. This kind of proposal is completely unreasonable."

The bill also ties the registration and annual licensing of internet service providers strictly to their compliance with the law.

Digital rights experts have also criticized the bill’s vague wording, warning that it opens legal loopholes the government could exploit and creates a climate of fear among citizens.

“Every website you visit, every piece of information you share, would be gathered by internet service providers. This infringes on Article 33, which protects freedom of expression,” they said.

There are growing concerns that, if enacted, the law would compromise the privacy and security of journalists, whistleblowers, human rights activists, government critics, and everyday users who rely on the internet to voice their views.

“The moment a unique identifier is assigned to an individual, anonymity is lost. This makes pseudonymous online activity nearly impossible, which is essential for certain groups,” Ndede explained.

Demas Kiprono, Deputy Executive Director of the International Commission of Jurists (ICJ), described the bill as an effort to suppress freedom of expression. He noted that the proposed law fails the three-part test for justifiably limiting the rights to privacy and freedom of expression.

“As human rights defenders, we are deeply worried about the intrusion into Kenyans’ privacy and the state’s efforts to closely monitor government critics, raising fears of surveillance and abductions similar to those witnessed during the Gen-Z protests,” Ngugi stated.

He added, “In other countries, governments use telecommunications or electricity data to track their opponents, deploying malware or sending agents to intimidate or attack them.

Such practices should have no place in a country whose constitution guarantees freedom of expression and the right to privacy.”

Another major concern is Kitany’s proposal for an Advanced Electronic Signature—a digital ID uniquely linked to each internet user, designed to reveal their identity and generated solely by the user.

Ndede warned this provision could be used to require internet users to link their national identity cards to their online activity.

“The national ID is the most unique identifier for many Kenyans, so it appears that you’d need your ID to obtain a meter number. Given Kenya’s mandatory SIM registration, this effectively means mandatory ID use for internet access as well,” he explained.

If passed, the law would breach several international human rights treaties Kenya has committed to.

It would also undermine the country’s digital transformation goals by damaging public trust in digital platforms and discouraging internet use.

“This bill is fundamentally unconstitutional and a serious setback to justice and the rule of law, especially considering the progress Kenya has made in its digital transformation,” Ndede said.

National Intelligence Service (NIS) Director General Noordin Haji has identified the misuse of social media and artificial intelligence as major security risks, stressing the importance of strong policies to tackle vulnerabilities in cyberspace.

“Although access to information is fundamental to democratic governance, socio-economic stability, and international relations, the spread of misinformation and disinformation continues to undermine these values,” Haji said during a symposium at the National Intelligence Research University earlier this month.