Buying a phone or laptop in Kenya just got safer on paper. Under new rules from the Communications Authority of Kenya (CA), every mobile phone, tablet, and laptop sold in the country must now carry a minimum one-year warranty and a return policy, and vendors who ignore this face fines starting at Sh500,000.The requirement is part of the CA's revised Communications Equipment Vendor (CEV) Class Licence guidelines, which govern the sale of low-powered electronic gadgets including phones, tablets, laptops, set-top boxes, remote devices, and tracking devices. It is a direct response to a well-known gap in Kenya's device market: shops selling handsets with warranties as short as one month, or none at all.<h2>What the New Rules Actually Require</h2>The core obligation is straightforward. Vendors must ensure that every device sold in Kenya "shall have at a minimum, a warranty period of one (1) year with a return policy," according to the licence conditions, and must "provide after-sales services to customers for the duration of the warranty period." That means repairs and support have to be available for the full 12 months, not just a replacement offer in the first few weeks.<ad-spot></ad-spot>Beyond the warranty itself, the guidelines add several other consumer protections:<ul><li>Receipts for every sale, online or in-store, listing the seller's name, device model, serial number, and warranty period.</li><li>Mandatory labelling of refurbished devices, with packaging clearly marked "Refurbished" so buyers cannot mistake a renovated unit for a new one.</li><li>Verified contact details for online sellers, including a physical address, email, and phone number for complaints.</li><li>Accurate advertising, requiring that claims about a device's features, performance, and network compatibility be truthful and verifiable.</li><li>Environmental disposal information, so customers know how to dispose of old electronics responsibly.</li></ul>Vendors also now have to source stock only from licensed importers and sell only devices that have been type-approved, type-accepted, or exempted from type approval by the CA. Records of every sale and warranty claim must be kept for at least three years, and vendors must give CA officers access to their premises and systems for inspections.<h2>Why This Is Happening Now</h2>The rules target a specific and long-running problem: grey-market imports. A large share of phones and laptops sold cheaply in Kenya originate from markets such as the UAE, the US, and the UK, where dealers offload stock never intended for the Kenyan market. These devices often carry warranties as short as 30 to 90 days, if any warranty applies at all, because manufacturer warranties are typically region-specific and are not honoured by authorised service centres in Kenya.Some retailers compound the problem by sourcing through unauthorised distributors rather than official manufacturer channels, meaning the original brand does not recognise the sale or back any warranty claim. Others deliberately skip official warranty channels to cut costs and undercut competitors on price, leaving buyers with no recourse when a device fails.By forcing every vendor, regardless of where the stock originates, to provide a 12-month warranty and a return policy, the CA shifts the liability back onto the seller rather than leaving it to chance based on where a device was originally manufactured for sale.<h2>What Happens If a Vendor Doesn't Comply</h2>Breaches carry a financial penalty tied to company size rather than a flat fee: fines equivalent to 0.2 percent of a vendor's annual turnover, with a floor of Sh500,000. That structure means the penalty scales with the business, so a large retail chain faces a proportionately larger fine than a small shop, though no vendor pays less than the half-million-shilling minimum.<ad-spot></ad-spot>For small and mid-sized vendors who have relied on selling grey-market or short-warranty stock at a discount, this is likely to squeeze margins directly. Extending warranty coverage and after-sales support to a full year adds a cost that many of these businesses previously avoided by importing devices outside official channels. Some may need to raise prices, work only with licensed importers, or exit that segment of the market altogether.<h2>How Kenya's Rules Compare Internationally</h2>The CA's move brings Kenya closer to consumer protection standards seen in more developed markets, though it still falls short of some. The European Union requires a minimum two-year legal guarantee on consumer goods, covering defects and mismatches with advertised specifications, with sellers liable for repairs, replacements, price reductions, or refunds at no cost to the buyer. Spain and Portugal go further, mandating a three-year guarantee. Kenya's one-year minimum is a meaningful step up from the unregulated status quo, but it remains shorter than what EU consumers are entitled to by law.Kenya's phone and laptop retail market, particularly in areas like Nairobi's River Road and similar electronics hubs, includes large numbers of small, informal vendors who have operated on thin margins by avoiding official warranty and import channels. Whether the CA has the capacity to inspect and penalize this many businesses consistently will determine whether the rules meaningfully change buying conditions or become another regulation that is easy to sidestep in practice.Consumers should also expect some price adjustment. Vendors absorbing the cost of longer warranties and after-sales support are likely to pass at least part of that cost on, particularly for refurbished and lower-cost imported devices that previously competed on price precisely because they skipped these protections. The net effect, if enforcement holds, is a market with fewer ultra-cheap, warranty-free devices and more consistent protection for buyers who do get burned by a faulty phone or laptop.

Kenya Now Requires a One-Year Warranty on Every Phone and Laptop Sold, With Fines of at Least Sh500,000 for Vendors Who Skip It

For years, data protection compliance in Kenya had a reputation problem. Founders saw it as a box to tick after the real work of building a product, something to worry about once the company had money and time to spare. That mindset is no longer safe, and it was never really smart.On June 4, 2026, the Office of the Data Protection Commissioner (ODPC) issued a public notice urging every eligible business, government agency, and non-profit that handles personal data to register as a data controller or processor. The warning was blunt: non-compliance now comes with a cost, and organisations that ignore the Data Protection Act risk fines of up to KES 5 million. The notice specifically named banks, hospitals, schools, telecoms, transport operators, and marketing companies, but the underlying message applies to almost any Kenyan startup collecting customer data.This is the moment to stop thinking of compliance as friction and start treating it as infrastructure, the same way you'd think about your payment rails or your cloud hosting. Here's why, and what it actually means for a founder building in Kenya today.<h2>Kenya Has Entered a Real Enforcement Era</h2>For a long time, the Data Protection Act, 2019 existed on paper more than in practice. That has changed. Kenya is now in what regulators and advisors are calling a new enforcement phase, marked by more structured audits, growing public awareness, and a rising number of individuals filing complaints directly with the ODPC.The numbers back this up. The ODPC has issued 20 penalty notices, 357 determinations, 134 enforcement notices, and 184 compensation orders since the Act came into force, with total fines exceeding KES 26 million by late 2024 alone. In 2025, the number of determinations roughly doubled from the year before. This isn't a regulator testing the waters. It's a regulator that has found its footing.<ad-spot></ad-spot>A few cases make the point vividly. Digital lender Mulla Pride was fined nearly KES 3 million for abusive, third-party debt collection practices, a penalty the High Court later upheld on appeal. Oppo Kenya, Whitepath, and Regus Kenya each faced the maximum fine of KES 5 million, though Regus successfully argued on appeal to have its penalty reduced. Compensation orders, which pay affected individuals directly rather than the state, totalled around KES 30 million in 2025. Some awards to individuals have reached KES 500,000.None of this is designed to scare founders into paralysis. It's designed to make one thing obvious: the ODPC has teeth now, and pretending otherwise is a bad bet.<h2>Why Investors Are Asking Compliance Questions Earlier</h2>Here's where the story shifts from risk to opportunity. Legal advisors working with Kenyan startups now report that investors routinely run regulatory due diligence before deploying capital, and corporate clients ask for proof of compliance before signing partnership agreements. Data protection has moved from being a legal footnote to being part of how a company's commercial viability gets assessed, right alongside financial health and IP ownership.Some investors go further and factor privacy compliance directly into how they value a startup at all. That makes sense once you think about what a data breach actually threatens: not just a fine, but the trust that a fintech, healthtech, or lending platform depends on to exist. A messy cap table can kill a term sheet. So can a compliance gap that surfaces during due diligence.<h3>A Concrete Example: Pezesha</h3>Nairobi-based fintech Pezesha offers a useful case study of what this looks like in practice. In 2023, alongside receiving its Digital Credit Provider license from the Central Bank of Kenya, Pezesha also secured approval as a registered data controller from the ODPC. The company's legal and compliance team framed this explicitly as more than a regulatory checkbox, describing it as proof of their commitment to protecting customer data and building trust with the partners and consumers they serve.<ad-spot></ad-spot>That compliance groundwork didn't slow Pezesha down. In the years since, the company closed an $11 million pre-series A round led by Women's World Banking Capital Partners, secured a $500,000 technical assistance grant from the U.S. International Development Finance Corporation to strengthen its credit scoring systems, and launched a lending product with Safaricom that plugged directly into M-Pesa's business wallet, reaching millions of potential customers. None of this proves compliance alone drives growth. But it shows that treating regulatory approval as a trust signal, not just a legal formality, sat comfortably alongside serious fundraising and serious partnerships. For a startup handling alternative credit data on underserved SMEs, that trust is the product.<h2>The Data Protection Officer Gap Nobody Talks About</h2>Here's a statistic that should catch every founder's attention: only around 56 percent of Kenyan organisations have appointed a Data Protection Officer, despite it being one of the highest-leverage compliance moves available. Under the Act, a DPO isn't required for everyone, but it becomes mandatory for public bodies, organisations processing sensitive personal data at scale, or businesses that carry out systematic monitoring of data subjects at scale. Financial services and health platforms usually fall squarely into this category.The good news is that appointing a DPO doesn't require hiring a full-time executive. The law allows the role to be outsourced, shared across a group of companies, or combined with another position, as long as there's no conflict of interest. For an early-stage startup, this is a relatively cheap way to close a gap that competitors are still ignoring. A DPO doesn't just keep you out of trouble. They give you someone who owns your privacy notices, your data mapping, and your breach response plan before a regulator or a journalist forces the issue.<h2>What Non-Compliance Actually Costs Beyond the Fine</h2>It's tempting to read fine amounts and mentally file them as a cost of doing business. That undersells the real damage. A digital lender that mishandles debt collection data doesn't just pay a fine, it becomes the subject of news coverage that follows the brand for years. A flower company fined for misusing customer photos loses more than KES 1.5 million, it loses the benefit of the doubt with future customers.Reputational damage compounds in ways a balance sheet doesn't capture. Kenyan consumers, particularly in fintech and lending, already carry justified skepticism about how their data gets used. A public enforcement notice confirms the worst assumptions people already have about digital lenders. Rebuilding that trust takes far longer than the compliance work would have.<h2>A Practical Starting Checklist</h2>For founders ready to move from theory to action, the core steps look like this:<ul><li>Register with the ODPC if your business processes data at scale, operates in a mandatory sector like finance or health, or exceeds the KES 5 million turnover and 10-employee thresholds.</li><li>Map your data. Know what personal data you collect, why, where it's stored, and who else touches it.</li><li>Appoint a DPO, in-house or outsourced, if your data processing meets the scale or sensitivity thresholds.</li><li>Write a real privacy notice and internal data policy, not a copy-pasted template.</li><li>Build a Data Subject Access Request workflow so customers can request their data or ask for deletion without your team scrambling.</li><li>Run a Data Protection Impact Assessment before launching any feature that processes data in a higher-risk way, such as automated credit scoring or biometric verification.</li></ul><h2>The Long Game: Positioning for Cross-Border Trust</h2>There's a bigger prize on the horizon. Kenya and the European Union launched an adequacy dialogue in May 2024, the first of its kind on the continent. If it succeeds, personal data could flow between the EU and Kenya without the extra legal safeguards currently required, since Kenya's Data Protection Act already closely mirrors the GDPR. For any Kenyan startup with ambitions beyond East Africa, that's a meaningful door to have open.Compliance, in other words, isn't just about avoiding this year's fine. It's about being ready for the market Kenya is trying to become, one where data can move across borders because the systems handling it are trusted by design. Startups that build that trust early won't just avoid enforcement notices. They'll be the ones investors, partners, and customers choose when there's a choice to make.

Why Data Compliance Is Becoming Kenya's New Startup Currency

On March 31, the Office of the Data Protection Commissioner confirmed in a formal letter that it has commenced suo moto investigations into privacy concerns related to Ray-Ban Meta smart glasses, specifically the processing of personally identifiable information for the training of Meta's AI systems.Data Commissioner Immaculate Kassait's letter states: "The Office of the Data Protection Commissioner confirms that it has already commenced suo moto investigations into the privacy concerns raised in relation to the Ray-Ban Meta glasses and the processing of personally identifiable information for the training of Meta AI. The outcome and further developments will be communicated once the investigations are concluded."<ad-spot></ad-spot>Kenya now joins the United Kingdom ( where the Information Commissioner's Office described the reports as "concerning" and demanded information from Meta ) and the United States, where lawsuits have been filed over biometric privacy violations. A Kenyan regulator opening a formal investigation into a global technology giant over AI training practices is not a routine event. It is a signal that the Data Protection Act 2019 has operational teeth, and that Kenya intends to use them.We wrote about this story on March 4. We called for this investigation. It has now begun.<h2>The Timeline That Got Us Here</h2>February 27 — Swedish newspapers Göteborgs-Posten and Svenska Dagbladet publish a joint investigation confirming that footage from Meta Ray-Ban smart glasses ( including bathroom visits, people undressing, bank card details, and intimate encounters ) was being routed to workers at Sama's Nairobi offices for AI training data annotation. Workers were paid approximately $2 per hour, required to sign NDAs, and told that raising concerns about the content risked termination.March 4 — TechInKenya publishes "<a target="_blank" rel="noopener noreferrer nofollow" href="https://www.techinkenya.com/articles/nairobi-is-watching-your-bedroom-and-meta-knew">Nairobi Is Watching Your Bedroom. And Meta Knew</a>." — profiling the Sama operation, its documented history of exposing Kenyan workers to harmful content for OpenAI in 2023, and making the explicit case that the ODPC has jurisdiction over this processing and the authority to investigate.<ad-spot></ad-spot>March 6 — The Oversight Lab, a Kenyan digital rights organisation led by Executive Director Mercy Mutemi, files a formal petition with the ODPC requesting an investigation. The petition cites Sections 8 and 9 of the Data Protection Act. It asks the ODPC to determine whether individuals recorded by the glasses consented to their data being used to train Meta AI, whether cross-border data transfers complied with the Act, and whether Meta, Sama, or associated entities conducted a data protection impact assessment before handling the material. The petition requests completion within 90 days.March 6 onwards — Over 150 organisations and individuals sign letters of support urging the ODPC to conduct the investigation openly, transparently, and with public stakeholder participation.March 31 — The ODPC formally confirms it has commenced investigations, placing Kenya alongside the UK and US in active regulatory scrutiny of Meta over this specific issue.<h2>What the Investigation Covers</h2>The ODPC's investigation has two distinct threads, and it is worth being precise about each.The data subjects thread — individuals worldwide whose footage was captured by Ray-Ban smart glasses and processed by Kenyan workers at Sama. These are people in Sweden, Germany, France, the US, and elsewhere who were recorded by wearers of the glasses ( sometimes unknowingly, sometimes in deeply private moments ) and whose footage subsequently arrived in Nairobi for annotation. The data protection question for this thread is: was there a lawful basis for transferring that footage to Kenya for processing? Did Meta conduct the required data protection impact assessment? Were affected individuals informed that their data would be processed in Kenya?<ad-spot></ad-spot>The Kenyan workers thread — the Sama annotators who were required to view and label intimate footage as a condition of employment. Their data rights, their labour rights, and the psychological harm they suffered intersect with the Data Protection Act in ways that Kenya's regulators have not previously been asked to adjudicate at this scale.The Oversight Lab's petition covers both threads. The ODPC's confirmation letter references the processing of personally identifiable information in connection with Meta AI training which encompasses the first thread directly and implies examination of Sama's data handling practices, which touches the second.<h2>The Pattern That Makes This Investigation Necessary</h2>The details of the Sama operation were not new to anyone who had followed Kenyan tech labour reporting closely. This is the same company, in the same Nairobi offices, that TIME Magazine exposed in 2023 for paying workers $1.32 to $2 per hour to label child sexual abuse material, beheadings, and suicide footage for OpenAI. Workers from that operation described developing PTSD. Sama ended that contract after public pressure then pivoted to computer vision annotation for Meta's Ray-Ban programme.Mercy Mutemi's framing in the Oversight Lab petition draws the explicit parallel: "Just as we saw in the Worldcoin case, Kenya is once again being used as a training ground for exploitative and harmful AI." The Worldcoin biometric data collection scandal ( where Kenyan participants were paid small amounts to have their irises scanned for a cryptocurrency project ) resulted in the ODPC suspending Worldcoin's operations in Kenya and remains one of the clearest examples of the regulator acting assertively against a global tech platform.<ad-spot></ad-spot>The Ray-Ban glasses investigation presents a harder regulatory challenge than Worldcoin for one important reason: the data processing is not happening to Kenyans as subjects. It is happening by Kenyans as workers, processing data about people in other countries. The legal framework for that scenario under the Data Protection Act has not been fully tested.<h2>What the ODPC Can Actually Do</h2>The Data Protection Act 2019 gives the ODPC meaningful powers, but their application in a case of this complexity requires careful reading.Investigation powers — the ODPC can require Meta, Sama, and associated entities to provide information, documentation, and access to their data processing systems. This includes demanding evidence of the legal basis for processing, records of data protection impact assessments, and documentation of consent mechanisms.Enforcement powers — if the investigation finds violations, the ODPC can issue enforcement notices requiring specific remedial actions, impose administrative fines, and in serious cases refer matters to the Director of Public Prosecutions. The maximum fine under the Act is Ksh 5 million or 1% of annual gross turnover, figures that will not frighten Meta but that establish precedent and signal regulatory intent.The cross-border limitation— the ODPC's jurisdiction covers data processing operations conducted in Kenya. Sama's annotation work happens in Kenya. Meta's collection of footage from wearers in Europe and the US is outside Kenya's jurisdiction directly, but the transfer of that footage to Kenya for processing is squarely within it. The legal question is whether the Act's requirements for lawful cross-border data transfers were met, specifically whether the transfer was authorised under Section 48, which requires either the data subject's consent, contractual necessity, or adequacy determinations.<h2>What Comes Next</h2>The Oversight Lab has requested the investigation be completed within 90 days, which would put a conclusion around late June 2026. The ODPC's confirmation letter does not commit to a timeline, saying only that findings will be communicated upon conclusion.The investigation's credibility will depend on three things. First, whether the ODPC actually engages Meta and Sama directly demanding documentation, responses, and evidence rather than conducting a paper review. Second, whether civil society and affected stakeholders are given the opportunity to participate that Mercy Mutemi explicitly requested. Third, whether the findings, when they arrive, result in concrete enforcement action or recommendations rather than a report that is noted and filed.<ad-spot></ad-spot>Kenya has an opportunity here that goes beyond the specific facts of this case. The Worldcoin precedent demonstrated that the ODPC can act against a global platform with real consequences. A robust investigation into Meta's Ray-Ban data pipeline (one that examines the legal basis for data transfer, the adequacy of Sama's data handling, and the rights of both recorded subjects and annotating workers ) would establish Kenya as a serious data protection jurisdiction in the global conversation.That conversation is happening at the UK ICO, at Ireland's Data Protection Commission, and in US courts simultaneously. Kenya should be in that conversation as a regulator with standing and teeth, not as a footnote in someone else's investigation.The ODPC has taken the first step. What it does with the investigation it has opened will determine whether that step matters.This is a follow-up to our March 4 investigation "Nairobi Is Watching Your Bedroom. And Meta Knew." Read the full original piece <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.techinkenya.com/articles/nairobi-is-watching-your-bedroom-and-meta-knew">here</a>.

Kenya's Data Regulator Has Officially Opened an Investigation Into Meta's Ray-Ban Glasses. Here Is What Happens Next.

The global tech press is framing this story as a privacy scandal for Meta Ray-Ban wearers in Europe and America. They are not wrong. But they are missing the other half of the story, the half that happens in Nairobi.A joint investigation published February 27 by <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.gp.se/nyheter/sverige/granskning-smarta-glasogon-delar-privat-innehall.0d4ff7f8-5ba3-5813-8806-e0c5c5ec14cc">Swedish newspapers Svenska Dagbladet and Göteborgs-Posten </a>has confirmed what should alarm anyone building Kenya's AI economy: a Nairobi-based company called Sama is routing intimate footage from millions of Western homes through its offices, paying Kenyan workers approximately $2 per hour to watch and label it, under NDAs, under office surveillance cameras, with an explicit policy that if you raise concerns about what you are seeing, you lose your job.This is not a technology problem. It is a labour problem, a data ethics problem, and, critically for Kenya, a regulatory problem that the Office of the Data Protection Commissioner has jurisdiction over right now.<h2>What Is Actually Happening</h2>Meta's Ray-Ban smart glasses, developed in partnership with EssilorLuxottica and priced from $299, have sold over seven million pairs. When a wearer says "Hey Meta" and asks the AI to analyse their surroundings, that footage does not stay on the device. It is uploaded to Meta's servers, where it enters a training pipeline that routes it to human data annotators at Sama's Nairobi offices.Those workers ( mostly college students and young graduates) are tasked with labelling objects in video clips so Meta's AI can learn to recognise the world more accurately. Draw a box around the chair. Identify the room type. Categorise the activity. Standard computer vision annotation work. Except the footage is not standard.<ad-spot></ad-spot>Workers told the Swedish journalists they regularly encounter footage of people using bathrooms, changing clothes, watching pornography, and having sex. Not because wearers were deliberately recording these moments, in many cases, the glasses were simply running, or left on a surface pointed at a room the wearer had forgotten was being captured."In some videos you can see someone going to the toilet, or getting undressed," one Sama worker told the newspapers. "I don't think they know, because if they knew they wouldn't be recording."Another contractor described reviewing footage where the wearer set the glasses on a bedside table and left the room, only for their wife to walk in and undress, unaware she was being watched.Other footage included bank card details captured accidentally in frame, users watching pornography with the glasses on, and recordings described simply as "sex scenes." Workers said they felt compelled to annotate regardless of the content, stopping or raising concerns meant risking termination.Meta's face anonymisation system is supposed to protect identities in the footage. Workers say the automatic face anonymisation does not always work, faces that should be obscured are sometimes fully visible, particularly in difficult lighting conditions.<h2>Sama's Track Record in Nairobi</h2>Sama is not a new name in this conversation. It is the same company, in the same Nairobi offices, that <a target="_blank" rel="noopener noreferrer nofollow" href="https://time.com/6247678/openai-chatgpt-kenya-workers/">TIME Magazine exposed in 2023 for paying Kenyan workers $1.32 to $2 per hour to label graphic content for OpenAI </a>(child sexual abuse material, beheadings, suicide footage ) while being billed to OpenAI at $12.50 per worker per hour. Workers described that experience as psychological torture. Several developed PTSD. Sama ended that contract after the TIME investigation and the resulting public pressure.It then pivoted to computer vision annotation, the work it now does for Meta's Ray-Ban glasses. Same workforce. Same pay structure. Same NDAs. Different content.After further reports exposed worker trauma and alleged union-busting at Sama's Nairobi office, the company ended its content moderation work for Meta in 2023 and shifted its focus to computer vision data annotation, the exact type of work now tied to the AI glasses.<ad-spot></ad-spot>The pattern is not coincidental. Sama's business model depends on a Nairobi labour market where $2 per hour is above minimum wage, where young graduates with limited formal sector options are willing to accept difficult conditions for stable income, and where NDA enforcement and office surveillance make collective action difficult.This is not unique to Sama. As Agence France-Presse documented last year, the global AI training industry routes its most sensitive, psychologically taxing, and legally ambiguous work to workers in Kenya, Colombia, India, and the Philippines — <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.straitstimes.com/world/gruelling-low-paid-human-work-behind-generative-ai-curtain">markets where labour costs are low</a>, regulatory oversight of outsourced data work is limited, and workers have limited recourse when the content damages them.But Sama is headquartered in Nairobi. It employs Kenyan workers. The data processing happens on Kenyan soil. That matters legally.<h2>The Regulatory Question Nobody Is Asking</h2>European privacy regulators are already moving. Petra Wierup, a lawyer at the Swedish data protection authority IMY, made clear that if Meta is the data controller under GDPR, protections must extend to subcontractors in third countries and cannot be weakened. NOYB, the Vienna-based privacy organisation that has filed multiple lawsuits against Meta, has flagged clear transparency failures and is examining legal grounds for action.The question that is not being asked loudly enough in Kenya: what is the Office of the Data Protection Commissioner going to do about this?<a target="_blank" rel="noopener noreferrer nofollow" href="https://www.odpc.go.ke/data-protection-laws-kenya/">The Data Protection Act 2019 </a>applies to data processing operations conducted in Kenya. Sama processing footage in Nairobi ( including footage of identifiable individuals who have not consented to Kenyan data handling) falls squarely within the ODPC's jurisdiction. The Act requires data processors to implement appropriate technical and organisational measures to protect personal data. Footage of people undressing, footage of people in bathrooms, footage of bank card details — all of it constitutes sensitive personal data under the Act's definitions.<ad-spot></ad-spot>The ODPC has the authority to investigate Sama's data handling practices, audit whether the processing meets the Act's standards, and impose penalties for non-compliance. It has the authority to require Meta to demonstrate the legal basis under which it transfers personal data to a Kenyan subcontractor. It has the authority to require Sama to disclose what data it holds, for how long, and what security measures protect it.Whether it exercises that authority is a different question. The ODPC is a young institution with limited resources and a mandate that has historically been stretched across complaints from individual Kenyans rather than investigations into multinational data pipelines. An investigation into Sama's Meta contract would be the most consequential enforcement action the ODPC has ever undertaken.It would also be entirely justified.<h2>What This Means for the Workers</h2>The international coverage has focused primarily on the privacy of the Ray-Ban wearers and the people accidentally captured in footage. That coverage is correct and important. But the workers in Sama's Nairobi offices are also victims of this pipeline, and they are getting less attention.These workers did not sign up to watch intimate footage of strangers from Western homes. They signed up for data annotation work, a job category that Kenya's government and tech industry have positioned as a formal sector opportunity for young graduates in the digital economy. The Kenya Vision 2030 framework and subsequent digital economy strategies have explicitly cited AI data labelling as a growth sector for employment.What Sama's model demonstrates is that "digital economy jobs" is not a self-evidently positive category. The digital economy can generate formal employment. It can also generate exploitative employment in professional-looking offices, with NDAs that prevent workers from speaking about what they experience, at pay rates that make the label "formal sector" technically accurate but economically misleading.The psychological toll of sustained exposure to intimate and disturbing footage ( documented in the OpenAI contract, documented again now ) is a worker welfare issue that Kenya's Ministry of Labour has not engaged with publicly. The Kenya ICT Board, which promotes Kenya as a BPO and data services destination, has been silent on the Sama revelations.Someone in government needs to ask: what are the conditions under which this work is being conducted, and do they meet Kenya's own standards?<h2>The Technology Defence That Does Not Hold</h2>Meta's official position is that its terms of service permit human review of AI interactions, that face anonymisation protects individuals in the footage, and that privacy controls give users meaningful choices about what is shared.Each of these claims deserves scrutiny.The terms of service defence is technically accurate and practically meaningless. Buried in a document that Ray-Ban users click through during setup is one sentence reserving the right to conduct "manual human review" of AI interactions. No reasonable person buying a pair of glasses marketed with the phrase "designed with your privacy in mind" reads that sentence and understands it to mean that strangers in Nairobi will watch footage from their bedroom.The face anonymisation claim has been directly contradicted by workers and by a former Meta employee. The system fails in difficult lighting — exactly the conditions common in homes, bedrooms, and bathrooms where the most sensitive footage originates.The privacy controls argument, that users can choose not to use the AI features, is accurate but deflects from the core problem. The LED indicator light intended to signal recording is, by multiple accounts, too small and dim for bystanders to reliably notice. The people accidentally captured in footage (the wife who walked into the bedroom, the person in the bathroom) have no controls. They are not Ray-Ban users. They never agreed to any terms of service. Their data is in Meta's training pipeline anyway.<ad-spot></ad-spot><h2>What Needs to Happen</h2>For Meta, the minimum response is meaningful: stop routing sensitive footage to human annotators without explicit, informed consent from all people identifiable in that footage. Fix the anonymisation system so it works in real-world lighting conditions, not just controlled tests. Publish a clear, plain-language explanation of what footage is reviewed by humans, by whom, in which countries, and under what data protection standards.For Sama, the questions are about labour standards: what psychological support is available to workers who encounter distressing content? What is the actual pay rate inclusive of all deductions? What does the NDA permit workers to disclose about their working conditions, and is that NDA itself compliant with Kenyan labour law?For the ODPC, the question is whether it will act. The Swedish investigation has provided the factual basis for an inquiry. European regulators are already examining the cross-border data transfer implications. Kenya's own data protection commissioner has both the jurisdiction and the obligation to investigate data processing happening in Nairobi offices that does not appear to meet the standards the Data Protection Act 2019 requires.For Kenya's broader tech sector, this story is a prompt for a harder conversation. AI data labelling is real employment. It is also work that can cause real harm, to workers who see things they cannot unsee, and to the people whose most intimate moments become training data without their knowledge. Positioning Kenya as Africa's AI data hub without asking hard questions about the conditions of that work is a strategy that trades short-term employment numbers for long-term reputational and human cost.The LED light on a pair of glasses in a Stockholm apartment is not doing enough to protect privacy. And the data commissioner's office in Nairobi has not yet done enough to protect the workers, and the data subjects, whose interests it exists to serve.If you work or have worked in AI data annotation in Kenya and want to share your experience confidentially, reach us at hello@techinkenya.com. Your identity will be protected.

Nairobi Is Watching Your Bedroom. And Meta Knew.

For 18 years, paying with M-Pesa at a till or paybill meant handing over two things: your money and your phone number. The merchant received a confirmation SMS showing your full name and complete mobile number, automatically, with no option to withhold it. That data did not stay in the transaction, it went into WhatsApp marketing lists, spam databases, and in the worst cases, social engineering scripts used to defraud you later.The Central Bank of Kenya approved a fix for this on February 27. Safaricom will now mask customer phone numbers across M-Pesa peer-to-peer transfers, Lipa na M-Pesa Till payments, and Paybill transactions. Merchants will still receive payment notifications, but instead of seeing 0722 123 456 they will see 0722XXXXXX. Your first name stays visible. Your money arrives. Your full contact details do not.It is a good change. It is also long overdue, the Data Protection Act 2019 has been in force for six years, and M-Pesa has been non-compliant with its data minimisation principles for all of them. But the implementation raises practical questions that the announcement did not fully answer, particularly for the millions of small merchants and the developers building M-Pesa integrations who need to understand exactly what changes and what does not.<h2>What Is Actually Changing</h2>The masking works differently depending on what type of transaction you are making.Peer-to-peer transfers— sending money directly from your M-Pesa to another person's M-Pesa, will partially mask your number in the recipient's confirmation SMS. If the recipient wants to see your full number, they can request it, and you get to decide whether to consent or decline. This is a meaningful privacy control. Previously, anyone you sent money to automatically had your number. Now you have a choice.Lipa na M-Pesa Till and Paybill payments — the transactions most Kenyans make dozens of times a week at supermarkets, fuel stations, restaurants, and utility payments, will mask both your full name and phone number from the merchant's confirmation. The merchant sees that a payment arrived, the amount, and a partial number. That is enough to confirm the transaction. It is not enough to build a marketing database or hand off to a scammer.Pochi la Biashara already had this protection. Safaricom piloted number masking through Pochi ( its small trader-focused product ) years ago, which is why mama mboga transactions have felt slightly different from supermarket till payments for anyone who noticed. This approval brings the rest of M-Pesa's merchant ecosystem up to that standard.The CBK has also directed Safaricom to run extensive consumer education before the rollout goes live, monitor feedback, address complaints, and submit monthly reports to the regulator. A specific rollout date has not been publicly announced.<ad-spot></ad-spot><h2>Why This Took Six Years</h2>The Data Protection Act 2019 required data minimisation (collecting only what is strictly necessary) from the moment it came into force. A payment transaction strictly requires the amount, a timestamp, and a reference number. It does not require the payer's full name and mobile number. By that standard, M-Pesa has been operating outside the spirit of the Act since 2019.Part of the delay is structural. The Communications Authority, not the CBK, regulates the telecommunications side of M-Pesa. Safaricom had already developed the number masking feature for merchant transactions. They built it, tested it with Pochi la Biashara, and were ready to deploy. But the CA's regulatory framework had not been updated to permit it for general M-Pesa transactions, creating a gap between what Safaricom could technically do and what it was permitted to do.The CBK approval granted last month covers the payments side, P2P transfers and Lipa na M-Pesa transactions that flow through the National Payment System. The CA still needs to update its framework to permit full rollout across all M-Pesa use cases. This is why the announcement specifies CBK approval but does not confirm a full deployment date, the regulatory picture is not entirely complete.The broader context is also worth noting. In 2025, the Directorate of Criminal Investigations arrested six cybercrime suspects in Mombasa running a scamming operation that relied heavily on harvested M-Pesa phone numbers. The pipeline from till payment to fraud attempt is not theoretical. It has been documented, prosecuted, and is still active. This feature closes one of the most exploited data leakage points in Kenya's mobile money ecosystem.<h2>The "Nionyeshe" Dilemma: Proof vs. Privacy</h2>This is where the practical disruption lands. The familiar ritual ("nionyeshe confirmation") is facing a forced evolution, but not for the reasons many think.For 18 years, the informal verification standard for M-Pesa has been the customer’s phone. A customer pays at a till or Paybill, and the merchant asks to see the SMS. The problem isn't usually that the merchant needs to "verify the name"; the problem is that the merchant often doesn't have the phone that receives the payment notification. Whether it’s a mama mboga whose business phone is at home or a supermarket cashier waiting for a delayed system hit, the customer’s SMS is the only immediate proof of payment.The Privacy PenaltyWhile "nionyeshe" solves the merchant's verification gap, it creates a massive privacy hole for the customer. Showing a confirmation message almost always means exposing your M-Pesa balance. In a busy queue or at a high-traffic stall, this "proof of payment" forces Kenyans to reveal their financial standing to strangers just to complete a transaction.Why the System is StrainingWith the move toward number masking and stricter data privacy, the "nionyeshe" ritual becomes even more problematic:Masked Identity: Even if the merchant looks at your phone, if the data is masked, they lose the ability to cross-reference the sender with the person standing there, making the "proof" less reliable for them.Security Risks: Forcing customers to show their screens is a practice the Office of the Data Protection Commissioner is actively discouraging to prevent social engineering and data theft.What Merchants Must Do Differently<ad-spot></ad-spot>To move away from peering at customers' balances for proof, Safaricom and the ODPC are pushing for tools that put the "proof" back into the merchant's hands:<ul class="tight" data-tight="true"><li>M-Pesa Business App: Real-time push notifications for the person actually running the till. It’s the cleanest way to see a transaction without asking the customer for a thing.</li><li>The *334# USSD Fallback: For the "non-smartphone" duka owner, dialing the USSD code is the official way to check the latest transactions on the business side without needing the customer to reveal their screen.</li><li>Daraja API Integration: For larger retailers, the payment should hit the POS system instantly, removing the human element entirely.</li></ul><h2>The Question Nobody Has Answered: What Does the Developer API Return?</h2>When a customer makes an M-Pesa payment on a merchant's website or app using the Daraja STK Push API, Safaricom sends a callback to the merchant's server with the transaction details. That callback currently includes the customer's full phone number in the JSON payload , it is what merchants use to identify which customer made which payment and update their order or account records accordingly.The masking approved by the CBK applies to the confirmation SMS the customer receives and the notification the merchant sees on their business app. What has not been publicly confirmed is whether Safaricom will also mask the phone number in the Daraja API callback sent to merchant backends.If the answer is no ( if the full number still arrives in the callback even while being masked in the SMS ) then the privacy protection is partially cosmetic. Merchants integrating directly via the API, including any operator who builds their own payment system, would still receive and potentially store the full number server-side. The spam and fraud risk would not be eliminated, just shifted from the SMS layer to the database layer.If the answer is yes ( if Safaricom masks the number at the API level too ) then merchants will need to update how they identify returning customers and match payments to accounts, since the phone number has historically been the primary identifier in M-Pesa integrations.Safaricom has not addressed this publicly. Developers building on Daraja should watch the API changelog and the developer forum closely as the rollout approaches. This is the implementation detail that matters most for anyone running M-Pesa on the backend.<h2>What This Means for You as a Consumer</h2>If you use M-Pesa to pay at merchants (which covers virtually every adult Kenyan) the change is straightforwardly positive with one adjustment.You will stop receiving unsolicited marketing messages from merchants after transactions, at least from the merchants who were harvesting your number from M-Pesa confirmations directly. You will face less exposure to social engineering attacks that start with a scammer who knows your M-Pesa number from a transaction record. Your data will travel with your money only as far as it needs to, to confirm the payment, not further.For peer-to-peer transfers specifically, the consent model for full number sharing is a meaningful new control. You can send money to someone without automatically giving them your contact details. For people who use M-Pesa to pay individuals they do not know well ( splitting a bill with a new acquaintance, paying a freelancer for the first time) that control matters.<ad-spot></ad-spot><h2>The Bigger Picture</h2>Kenya's mobile money system has been a global benchmark for financial inclusion for nearly two decades. But the architecture that made M-Pesa remarkable in 2007 ( simple, transparent, identity-anchored) was designed before data privacy was a regulatory concern anywhere in the world, let alone in Kenya.Number masking is a small technical change. What it represents is larger: the beginning of a serious attempt to retrofit modern data protection principles onto infrastructure that was never built with them in mind. The Data Protection Act 2019 was the legal mandate. The ODPC has been gradually enforcing it. The CBK's approval is the payments regulator catching up with a standard that the law set six years ago.The next step, and one that consumer advocates and privacy researchers have flagged, is the CA updating its framework to permit full rollout and closing the gap that currently prevents Safaricom from deploying the merchant masking feature without regulatory ambiguity. Once that happens, M-Pesa will for the first time operate as a payment system where your identity travels only as far as the transaction requires. In a country where mobile money is effectively the financial nervous system, that is a more significant upgrade than it sounds.

Consumer rights

Kenya Now Requires a One-Year Warranty on Every Phone and Laptop Sold, With Fines of at Least Sh500,000 for Vendors Who Skip It

Why Data Compliance Is Becoming Kenya's New Startup Currency

Kenya's Data Regulator Has Officially Opened an Investigation Into Meta's Ray-Ban Glasses. Here Is What Happens Next.

Nairobi Is Watching Your Bedroom. And Meta Knew.

M-Pesa Is Hiding Your Phone Number From Merchants. Here Is Everything That Changes, And What Nobody Has Answered Yet.

The Agentic AI Problem Nobody is Solving: Who Protects the Victims?

The Global Smartphone Inequality: Why Kenya Pays More for Less (And the Math That Proves It)