If you have been using WhatsApp lately, you may have noticed something new and unwelcome showing up between your status updates: advertisements. The platform that built its entire reputation on being a clean, private, and ad-free messaging service has officially crossed a line that many users never thought it would. For millions of Kenyans who depend on WhatsApp as their primary communication tool, this feels like a betrayal. But here is the thing: a better alternative has existed for a while now, and most people simply do not know about it.That alternative is Signal, and it might just be the most important app upgrade you make this year.<h2>WhatsApp Ads Are Here, and People Are Not Happy</h2>On June 16, 2025, Meta officially rolled out advertisements on WhatsApp's Updates tab. The ads appear as full-screen promotions between your contacts' status updates, similar to how Instagram Stories work. Meta also introduced Promoted Channels (paid placements for businesses seeking visibility in WhatsApp's discovery section) and Channel Subscriptions that let creators charge for exclusive content. It is a multi-pronged monetization push on a platform that once loudly declared, "We don't sell ads."WhatsApp stood as a rare bastion of ad-free communication in the digital realm, and its commitment to a clean, private, and uncluttered interface was a significant differentiator. The introduction of ads, despite Meta's careful positioning, has been met with significant disappointment and outrage across various social media platforms, with users vocalizing a sense of betrayal and using the term "enshittification" to describe what they perceive as a platform degrading its core user experience in pursuit of increased profit.Meta insists the impact on users is minimal. The ads will only appear on the Status screen, so users who mainly use WhatsApp for private messaging, group chats, and calls will not be directly affected. Meta says it is not using personally identifiable data like phone numbers, messages, or call history to serve the targeted ads. If you have also linked your WhatsApp to your Facebook or Instagram accounts via Meta's Accounts Center, however, your ad preferences from those platforms will now also inform your WhatsApp ad experience, and the cross-platform integration has raised concerns among users who expected WhatsApp to remain more private than Facebook or Instagram.The situation gets more complicated when you look at the legal cloud hanging over WhatsApp's privacy promises. A class-action lawsuit filed in a US Federal Court in January 2026 accuses Meta of misleading over three billion users by falsely claiming that WhatsApp messages are protected by unbreakable end-to-end encryption, with plaintiffs alleging that Meta stores, analyzes, and provides internal access to encrypted messages or purportedly private communications, contradicting public assurances of privacy. Meta has denied these claims, calling them "false and absurd," and the lawsuit is in early stages with no proven technical evidence yet. But the very fact that such allegations exist, combined with WhatsApp's closed-source architecture, makes a reasonable person pause. When a platform is closed-source and controlled by a single company, users ultimately have no way to verify assurances they cannot independently check.All of this is a far cry from WhatsApp's founding promise of simplicity and privacy.<h2>Why Your Phone Number Is More Sensitive Than You Think in Kenya</h2>Before we get into Signal's features, it is worth pausing on something that may not be obvious: why sharing your phone number to chat with someone you barely know is actually a significant privacy risk in Kenya specifically.In this country, your phone number is not just a contact detail. It is the key to your entire financial and personal life. Your M-Pesa account, your bank accounts, your KRA PIN registration, your NHIF and NSSF records, your employer's HR system, your insurance provider, and your family and friends' contact books are all tied to one number. Changing your number is not a simple privacy reset. It means contacting your bank, your employer, government agencies, and every person who matters to you to update their records. It is a logistical nightmare that most people would rather avoid.This creates a serious vulnerability. Once someone has your number, they essentially have a thread they can pull on. In Kenya, a phone number has historically been enough to reveal your full name in M-Pesa transactions. Safaricom acknowledged this posed a high-security risk, as merchants were said to use numbers to send unsolicited advertising through text messages or sell them to third parties, which is what prompted Safaricom to start hiding full customer details in Lipa na M-Pesa payments. Most recently, Safaricom rolled out a major privacy upgrade to M-Pesa on March 24, 2026, introducing data minimization that masks portions of a sender's phone number across Till, PayBill, and peer-to-peer transactions, meaning recipients now see only two names and a partially masked number.These are positive developments, but they do not eliminate the underlying risk of having your number in the wrong hands. The financial fraud angle is especially worrying. Since your phone number is also your M-Pesa number, a bad actor who has it can attempt various manipulative transactions against your account. They might send money and reverse it, or send money and then report your account for suspicious activity, potentially triggering a temporary freeze on your funds. And since M-Pesa is effectively Kenya's digital wallet for millions, having it frozen, even briefly, can be a nightmare.Then there is the harassment problem. A number that leaks to scammers or committed bad actors does not just get blocked. Scammers frequently operate dozens of virtual numbers, meaning blocking one number rarely ends the problem. You end up drowning in calls from unknown numbers, with no clean way out short of changing your number entirely.The bottom line: your phone number in Kenya is a master key to your financial identity, and treating it like a casual social handle is a risk not worth taking.<h2>Enter Signal: The App Built Around Your Privacy</h2><img src="https://cdn.calebms.com/articles/6286a9c3-4bcc-4a66-8946-500ea334d1df.jpg" alt="72500.jpg" data-caption="A screenshot of Signal App on Apple Store. Image via Getty Images">Signal has been around since 2014, but many Kenyans are only now discovering it as a genuine WhatsApp alternative. Signal uses mobile telephone numbers to register and manage user accounts, but configurable usernames were added in March 2024 to allow users to hide their phone numbers from other users. As of January 2025, the platform had approximately 70 million monthly active users and had been downloaded more than 220 million times.The key insight here is the separation between registration and communication. You still need a phone number to sign up for Signal, but once you are in, you can create a username and share only that username with people you want to chat with. Your phone number will no longer be visible to people you chat with on Signal unless they have it saved in their phone's contacts. You can also configure a new privacy setting to limit who can find you by your phone number, and if you set it to "Nobody," even people who have your number cannot search for you on Signal or know you have an account.This is a completely different model from WhatsApp. You can meet someone new, share your Signal username, and start chatting without ever exposing your phone number. Groups, calls, voice notes, file sharing, GIFs via Giphy — it all works just like WhatsApp. Signal secures all communications with end-to-end encryption and provides group voice and video calls with up to seventy-five participants, supporting text messages, documents, voice notes, pictures, stickers, GIFs, and video messages.<h2>Signal Is Open Source: This Is a Bigger Deal Than It Sounds</h2>One of the most important differences between Signal and WhatsApp is something that sounds technical but is incredibly important: Signal's code is open source, meaning anyone in the world can read it, review it, and verify that it actually does what it claims to do.WhatsApp says it uses end-to-end encryption. Signal actually proves it. Signal is built on open-source software, meaning anyone can scrutinize the source code and test it for security purposes, and it is entirely funded by grants and donations with no ads, affiliate links, or any kind of tracking when you use the app.This transparency matters because it replaces "trust me bro" with verifiable evidence. You do not have to take Signal's word for it that your conversations are private. Security researchers, academics, privacy advocates, and journalists around the world constantly audit Signal's code and would quickly flag anything suspicious. The Signal Protocol now encrypts the messages of over 2.5 billion people, the vast majority of whom have never installed the Signal app, since WhatsApp, Google Messages (RCS), Facebook Messenger's encrypted mode, and Skype all license or implement the Signal Protocol. The fact that even WhatsApp borrows Signal's encryption technology is perhaps the most honest endorsement Signal could receive.<h2>Who Is Behind Signal, and Why Does It Matter?</h2>Signal is not a product of a corporation trying to monetize your data. The Signal Technology Foundation is an American non-profit organization founded in 2018 by Moxie Marlinspike and Brian Acton, whose mission is to "protect free expression and enable secure global communication through open source privacy technology." Brian Acton is notably the co-founder of WhatsApp, who left Facebook in 2017 over disagreements about monetization and data sharing, then put $50 million of his own money into building a privacy-first alternative. He reportedly walked away from $850 million in potential earnings to stand up for user privacy.The Signal Foundation's annual operating costs are estimated at $35 to $50 million, covering server infrastructure, bandwidth, development staff, and operational expenses. Signal achieves comparable core functionality at a fraction of the cost by maintaining a lean team of approximately 50 full-time staff as of 2025 and avoiding the product complexity that inflates headcount at commercial messaging platforms.Because Signal is a non-profit with no shareholders and no advertising revenue model, it has zero financial incentive to sell your data or compromise your privacy. Its entire existence depends on doing the opposite: being the app users can actually trust. If you transition to Signal and you can afford to donate, doing so is genuinely meaningful. Every donation directly funds the infrastructure that keeps the app running for millions of users worldwide, including activists, journalists, and ordinary people who simply value their privacy. Signal also gives donors a small badge in-app to acknowledge their support, but unlike Meta, it does not sell verification badges or inflate their meaning.<h2>What Signal Does Not Have (and You Should Know Before You Switch)</h2>Being honest about Signal's limitations is important, especially if you have been a heavy WhatsApp user. The core messaging, calling, and group features are all present and solid, but there are a few areas where Signal is more modest.Stickers: WhatsApp lets anyone create custom stickers from any image or person, which has produced an enormous, community-driven library of sticker packs. Signal has a smaller selection of downloadable sticker packs but does not support the same level of user-created, shareable sticker culture. GIFs work the same way on both platforms as both use Giphy, so that part of your expressive arsenal remains intact.Story/Status Features: If you enjoy interacting with WhatsApp statuses, Signal's Stories tab offers a reduced experience. You can reply to a story but cannot react with a like, reshare someone else's story, add music to your own story, or use layouts. The Stories feature on Signal is functional but bare-bones compared to WhatsApp.Single Account Per App: WhatsApp allows you to run multiple accounts on a single device and switch between them effortlessly. Signal does not support this. You get one account per Signal installation. This can be inconvenient if you currently separate a personal and work WhatsApp account on the same phone.No Channels: WhatsApp introduced Channels as a broadcast feature, and it has become a significant part of how Kenyans follow news, businesses, and creators. Signal only supports groups, not channels. If you rely heavily on WhatsApp Channels for information, this is a gap worth factoring in.None of these limitations are dealbreakers for most users, but they are honest trade-offs to understand before making the switch.<h2>How to Get Started on Signal</h2>Getting set up on Signal is straightforward and similar to the WhatsApp onboarding experience. You download the app from the Play Store or App Store, verify your phone number once (this is the only time your number is truly needed), and then you are in. Once registered, go to Settings, then Privacy, then Phone Number, and set "Who can see my number" and "Who can find me by my number" to Nobody. Then create your username under Settings and Profile. From that point forward, you can share your username instead of your number with anyone you are not already close to.Your existing close contacts who you already trust with your number can still find you if they have it saved on their phone, so you do not lose those connections. And for everyone new, you get to stay in control of what you share.<h2>The Realistic Picture: Signal and WhatsApp Side by Side</h2>Switching entirely to Signal overnight is not realistic for most people. WhatsApp is deeply embedded in Kenyan family groups, workplace chats, and business communities, and you cannot force everyone you know to move at once. A practical approach is to use both apps simultaneously: keep WhatsApp for family and work groups where you have no choice, and gradually move trusted friends and new contacts to Signal.Over time, as more people in your circle join Signal, your dependence on WhatsApp naturally shrinks. The key shift is changing how you introduce yourself to new contacts: instead of giving out your number by default, you give out your Signal username. It is a small habit change that compounds into meaningful privacy gains over time.<h2>The Bottom Line</h2>WhatsApp's arrival of ads is not the end of the world, but it is the clearest signal yet that the platform is following the same path as every other Meta product: maximizing attention and revenue at the expense of user experience and privacy. The encryption lawsuit controversy, even if ultimately unproven, adds another layer of unease for anyone paying attention.Signal offers a genuinely better answer to the question of how private communication should work. It is transparent, ad-free, open source, and now lets you connect with people without ever handing over your phone number. In a country where your number is your financial identity, that is not a minor convenience feature. It is a meaningful protection.If you value your privacy, your M-Pesa security, and your digital peace of mind, Signal deserves a serious look. Download it, set up your username, and start sharing it instead of your number. Your future self will thank you.

WhatsApp Has Ads Now. Here Is Why I Switched to Signal (And You Should Consider It Too)

On March 31, the Office of the Data Protection Commissioner confirmed in a formal letter that it has commenced suo moto investigations into privacy concerns related to Ray-Ban Meta smart glasses, specifically the processing of personally identifiable information for the training of Meta's AI systems.Data Commissioner Immaculate Kassait's letter states: "The Office of the Data Protection Commissioner confirms that it has already commenced suo moto investigations into the privacy concerns raised in relation to the Ray-Ban Meta glasses and the processing of personally identifiable information for the training of Meta AI. The outcome and further developments will be communicated once the investigations are concluded."<ad-spot></ad-spot>Kenya now joins the United Kingdom ( where the Information Commissioner's Office described the reports as "concerning" and demanded information from Meta ) and the United States, where lawsuits have been filed over biometric privacy violations. A Kenyan regulator opening a formal investigation into a global technology giant over AI training practices is not a routine event. It is a signal that the Data Protection Act 2019 has operational teeth, and that Kenya intends to use them.We wrote about this story on March 4. We called for this investigation. It has now begun.<h2>The Timeline That Got Us Here</h2>February 27 — Swedish newspapers Göteborgs-Posten and Svenska Dagbladet publish a joint investigation confirming that footage from Meta Ray-Ban smart glasses ( including bathroom visits, people undressing, bank card details, and intimate encounters ) was being routed to workers at Sama's Nairobi offices for AI training data annotation. Workers were paid approximately $2 per hour, required to sign NDAs, and told that raising concerns about the content risked termination.March 4 — TechInKenya publishes "<a target="_blank" rel="noopener noreferrer nofollow" href="https://www.techinkenya.com/articles/nairobi-is-watching-your-bedroom-and-meta-knew">Nairobi Is Watching Your Bedroom. And Meta Knew</a>." — profiling the Sama operation, its documented history of exposing Kenyan workers to harmful content for OpenAI in 2023, and making the explicit case that the ODPC has jurisdiction over this processing and the authority to investigate.<ad-spot></ad-spot>March 6 — The Oversight Lab, a Kenyan digital rights organisation led by Executive Director Mercy Mutemi, files a formal petition with the ODPC requesting an investigation. The petition cites Sections 8 and 9 of the Data Protection Act. It asks the ODPC to determine whether individuals recorded by the glasses consented to their data being used to train Meta AI, whether cross-border data transfers complied with the Act, and whether Meta, Sama, or associated entities conducted a data protection impact assessment before handling the material. The petition requests completion within 90 days.March 6 onwards — Over 150 organisations and individuals sign letters of support urging the ODPC to conduct the investigation openly, transparently, and with public stakeholder participation.March 31 — The ODPC formally confirms it has commenced investigations, placing Kenya alongside the UK and US in active regulatory scrutiny of Meta over this specific issue.<h2>What the Investigation Covers</h2>The ODPC's investigation has two distinct threads, and it is worth being precise about each.The data subjects thread — individuals worldwide whose footage was captured by Ray-Ban smart glasses and processed by Kenyan workers at Sama. These are people in Sweden, Germany, France, the US, and elsewhere who were recorded by wearers of the glasses ( sometimes unknowingly, sometimes in deeply private moments ) and whose footage subsequently arrived in Nairobi for annotation. The data protection question for this thread is: was there a lawful basis for transferring that footage to Kenya for processing? Did Meta conduct the required data protection impact assessment? Were affected individuals informed that their data would be processed in Kenya?<ad-spot></ad-spot>The Kenyan workers thread — the Sama annotators who were required to view and label intimate footage as a condition of employment. Their data rights, their labour rights, and the psychological harm they suffered intersect with the Data Protection Act in ways that Kenya's regulators have not previously been asked to adjudicate at this scale.The Oversight Lab's petition covers both threads. The ODPC's confirmation letter references the processing of personally identifiable information in connection with Meta AI training which encompasses the first thread directly and implies examination of Sama's data handling practices, which touches the second.<h2>The Pattern That Makes This Investigation Necessary</h2>The details of the Sama operation were not new to anyone who had followed Kenyan tech labour reporting closely. This is the same company, in the same Nairobi offices, that TIME Magazine exposed in 2023 for paying workers $1.32 to $2 per hour to label child sexual abuse material, beheadings, and suicide footage for OpenAI. Workers from that operation described developing PTSD. Sama ended that contract after public pressure then pivoted to computer vision annotation for Meta's Ray-Ban programme.Mercy Mutemi's framing in the Oversight Lab petition draws the explicit parallel: "Just as we saw in the Worldcoin case, Kenya is once again being used as a training ground for exploitative and harmful AI." The Worldcoin biometric data collection scandal ( where Kenyan participants were paid small amounts to have their irises scanned for a cryptocurrency project ) resulted in the ODPC suspending Worldcoin's operations in Kenya and remains one of the clearest examples of the regulator acting assertively against a global tech platform.<ad-spot></ad-spot>The Ray-Ban glasses investigation presents a harder regulatory challenge than Worldcoin for one important reason: the data processing is not happening to Kenyans as subjects. It is happening by Kenyans as workers, processing data about people in other countries. The legal framework for that scenario under the Data Protection Act has not been fully tested.<h2>What the ODPC Can Actually Do</h2>The Data Protection Act 2019 gives the ODPC meaningful powers, but their application in a case of this complexity requires careful reading.Investigation powers — the ODPC can require Meta, Sama, and associated entities to provide information, documentation, and access to their data processing systems. This includes demanding evidence of the legal basis for processing, records of data protection impact assessments, and documentation of consent mechanisms.Enforcement powers — if the investigation finds violations, the ODPC can issue enforcement notices requiring specific remedial actions, impose administrative fines, and in serious cases refer matters to the Director of Public Prosecutions. The maximum fine under the Act is Ksh 5 million or 1% of annual gross turnover, figures that will not frighten Meta but that establish precedent and signal regulatory intent.The cross-border limitation— the ODPC's jurisdiction covers data processing operations conducted in Kenya. Sama's annotation work happens in Kenya. Meta's collection of footage from wearers in Europe and the US is outside Kenya's jurisdiction directly, but the transfer of that footage to Kenya for processing is squarely within it. The legal question is whether the Act's requirements for lawful cross-border data transfers were met, specifically whether the transfer was authorised under Section 48, which requires either the data subject's consent, contractual necessity, or adequacy determinations.<h2>What Comes Next</h2>The Oversight Lab has requested the investigation be completed within 90 days, which would put a conclusion around late June 2026. The ODPC's confirmation letter does not commit to a timeline, saying only that findings will be communicated upon conclusion.The investigation's credibility will depend on three things. First, whether the ODPC actually engages Meta and Sama directly demanding documentation, responses, and evidence rather than conducting a paper review. Second, whether civil society and affected stakeholders are given the opportunity to participate that Mercy Mutemi explicitly requested. Third, whether the findings, when they arrive, result in concrete enforcement action or recommendations rather than a report that is noted and filed.<ad-spot></ad-spot>Kenya has an opportunity here that goes beyond the specific facts of this case. The Worldcoin precedent demonstrated that the ODPC can act against a global platform with real consequences. A robust investigation into Meta's Ray-Ban data pipeline (one that examines the legal basis for data transfer, the adequacy of Sama's data handling, and the rights of both recorded subjects and annotating workers ) would establish Kenya as a serious data protection jurisdiction in the global conversation.That conversation is happening at the UK ICO, at Ireland's Data Protection Commission, and in US courts simultaneously. Kenya should be in that conversation as a regulator with standing and teeth, not as a footnote in someone else's investigation.The ODPC has taken the first step. What it does with the investigation it has opened will determine whether that step matters.This is a follow-up to our March 4 investigation "Nairobi Is Watching Your Bedroom. And Meta Knew." Read the full original piece <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.techinkenya.com/articles/nairobi-is-watching-your-bedroom-and-meta-knew">here</a>.

Kenya's Data Regulator Has Officially Opened an Investigation Into Meta's Ray-Ban Glasses. Here Is What Happens Next.

The global tech press is framing this story as a privacy scandal for Meta Ray-Ban wearers in Europe and America. They are not wrong. But they are missing the other half of the story, the half that happens in Nairobi.A joint investigation published February 27 by <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.gp.se/nyheter/sverige/granskning-smarta-glasogon-delar-privat-innehall.0d4ff7f8-5ba3-5813-8806-e0c5c5ec14cc">Swedish newspapers Svenska Dagbladet and Göteborgs-Posten </a>has confirmed what should alarm anyone building Kenya's AI economy: a Nairobi-based company called Sama is routing intimate footage from millions of Western homes through its offices, paying Kenyan workers approximately $2 per hour to watch and label it, under NDAs, under office surveillance cameras, with an explicit policy that if you raise concerns about what you are seeing, you lose your job.This is not a technology problem. It is a labour problem, a data ethics problem, and, critically for Kenya, a regulatory problem that the Office of the Data Protection Commissioner has jurisdiction over right now.<h2>What Is Actually Happening</h2>Meta's Ray-Ban smart glasses, developed in partnership with EssilorLuxottica and priced from $299, have sold over seven million pairs. When a wearer says "Hey Meta" and asks the AI to analyse their surroundings, that footage does not stay on the device. It is uploaded to Meta's servers, where it enters a training pipeline that routes it to human data annotators at Sama's Nairobi offices.Those workers ( mostly college students and young graduates) are tasked with labelling objects in video clips so Meta's AI can learn to recognise the world more accurately. Draw a box around the chair. Identify the room type. Categorise the activity. Standard computer vision annotation work. Except the footage is not standard.<ad-spot></ad-spot>Workers told the Swedish journalists they regularly encounter footage of people using bathrooms, changing clothes, watching pornography, and having sex. Not because wearers were deliberately recording these moments, in many cases, the glasses were simply running, or left on a surface pointed at a room the wearer had forgotten was being captured."In some videos you can see someone going to the toilet, or getting undressed," one Sama worker told the newspapers. "I don't think they know, because if they knew they wouldn't be recording."Another contractor described reviewing footage where the wearer set the glasses on a bedside table and left the room, only for their wife to walk in and undress, unaware she was being watched.Other footage included bank card details captured accidentally in frame, users watching pornography with the glasses on, and recordings described simply as "sex scenes." Workers said they felt compelled to annotate regardless of the content, stopping or raising concerns meant risking termination.Meta's face anonymisation system is supposed to protect identities in the footage. Workers say the automatic face anonymisation does not always work, faces that should be obscured are sometimes fully visible, particularly in difficult lighting conditions.<h2>Sama's Track Record in Nairobi</h2>Sama is not a new name in this conversation. It is the same company, in the same Nairobi offices, that <a target="_blank" rel="noopener noreferrer nofollow" href="https://time.com/6247678/openai-chatgpt-kenya-workers/">TIME Magazine exposed in 2023 for paying Kenyan workers $1.32 to $2 per hour to label graphic content for OpenAI </a>(child sexual abuse material, beheadings, suicide footage ) while being billed to OpenAI at $12.50 per worker per hour. Workers described that experience as psychological torture. Several developed PTSD. Sama ended that contract after the TIME investigation and the resulting public pressure.It then pivoted to computer vision annotation, the work it now does for Meta's Ray-Ban glasses. Same workforce. Same pay structure. Same NDAs. Different content.After further reports exposed worker trauma and alleged union-busting at Sama's Nairobi office, the company ended its content moderation work for Meta in 2023 and shifted its focus to computer vision data annotation, the exact type of work now tied to the AI glasses.<ad-spot></ad-spot>The pattern is not coincidental. Sama's business model depends on a Nairobi labour market where $2 per hour is above minimum wage, where young graduates with limited formal sector options are willing to accept difficult conditions for stable income, and where NDA enforcement and office surveillance make collective action difficult.This is not unique to Sama. As Agence France-Presse documented last year, the global AI training industry routes its most sensitive, psychologically taxing, and legally ambiguous work to workers in Kenya, Colombia, India, and the Philippines — <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.straitstimes.com/world/gruelling-low-paid-human-work-behind-generative-ai-curtain">markets where labour costs are low</a>, regulatory oversight of outsourced data work is limited, and workers have limited recourse when the content damages them.But Sama is headquartered in Nairobi. It employs Kenyan workers. The data processing happens on Kenyan soil. That matters legally.<h2>The Regulatory Question Nobody Is Asking</h2>European privacy regulators are already moving. Petra Wierup, a lawyer at the Swedish data protection authority IMY, made clear that if Meta is the data controller under GDPR, protections must extend to subcontractors in third countries and cannot be weakened. NOYB, the Vienna-based privacy organisation that has filed multiple lawsuits against Meta, has flagged clear transparency failures and is examining legal grounds for action.The question that is not being asked loudly enough in Kenya: what is the Office of the Data Protection Commissioner going to do about this?<a target="_blank" rel="noopener noreferrer nofollow" href="https://www.odpc.go.ke/data-protection-laws-kenya/">The Data Protection Act 2019 </a>applies to data processing operations conducted in Kenya. Sama processing footage in Nairobi ( including footage of identifiable individuals who have not consented to Kenyan data handling) falls squarely within the ODPC's jurisdiction. The Act requires data processors to implement appropriate technical and organisational measures to protect personal data. Footage of people undressing, footage of people in bathrooms, footage of bank card details — all of it constitutes sensitive personal data under the Act's definitions.<ad-spot></ad-spot>The ODPC has the authority to investigate Sama's data handling practices, audit whether the processing meets the Act's standards, and impose penalties for non-compliance. It has the authority to require Meta to demonstrate the legal basis under which it transfers personal data to a Kenyan subcontractor. It has the authority to require Sama to disclose what data it holds, for how long, and what security measures protect it.Whether it exercises that authority is a different question. The ODPC is a young institution with limited resources and a mandate that has historically been stretched across complaints from individual Kenyans rather than investigations into multinational data pipelines. An investigation into Sama's Meta contract would be the most consequential enforcement action the ODPC has ever undertaken.It would also be entirely justified.<h2>What This Means for the Workers</h2>The international coverage has focused primarily on the privacy of the Ray-Ban wearers and the people accidentally captured in footage. That coverage is correct and important. But the workers in Sama's Nairobi offices are also victims of this pipeline, and they are getting less attention.These workers did not sign up to watch intimate footage of strangers from Western homes. They signed up for data annotation work, a job category that Kenya's government and tech industry have positioned as a formal sector opportunity for young graduates in the digital economy. The Kenya Vision 2030 framework and subsequent digital economy strategies have explicitly cited AI data labelling as a growth sector for employment.What Sama's model demonstrates is that "digital economy jobs" is not a self-evidently positive category. The digital economy can generate formal employment. It can also generate exploitative employment in professional-looking offices, with NDAs that prevent workers from speaking about what they experience, at pay rates that make the label "formal sector" technically accurate but economically misleading.The psychological toll of sustained exposure to intimate and disturbing footage ( documented in the OpenAI contract, documented again now ) is a worker welfare issue that Kenya's Ministry of Labour has not engaged with publicly. The Kenya ICT Board, which promotes Kenya as a BPO and data services destination, has been silent on the Sama revelations.Someone in government needs to ask: what are the conditions under which this work is being conducted, and do they meet Kenya's own standards?<h2>The Technology Defence That Does Not Hold</h2>Meta's official position is that its terms of service permit human review of AI interactions, that face anonymisation protects individuals in the footage, and that privacy controls give users meaningful choices about what is shared.Each of these claims deserves scrutiny.The terms of service defence is technically accurate and practically meaningless. Buried in a document that Ray-Ban users click through during setup is one sentence reserving the right to conduct "manual human review" of AI interactions. No reasonable person buying a pair of glasses marketed with the phrase "designed with your privacy in mind" reads that sentence and understands it to mean that strangers in Nairobi will watch footage from their bedroom.The face anonymisation claim has been directly contradicted by workers and by a former Meta employee. The system fails in difficult lighting — exactly the conditions common in homes, bedrooms, and bathrooms where the most sensitive footage originates.The privacy controls argument, that users can choose not to use the AI features, is accurate but deflects from the core problem. The LED indicator light intended to signal recording is, by multiple accounts, too small and dim for bystanders to reliably notice. The people accidentally captured in footage (the wife who walked into the bedroom, the person in the bathroom) have no controls. They are not Ray-Ban users. They never agreed to any terms of service. Their data is in Meta's training pipeline anyway.<ad-spot></ad-spot><h2>What Needs to Happen</h2>For Meta, the minimum response is meaningful: stop routing sensitive footage to human annotators without explicit, informed consent from all people identifiable in that footage. Fix the anonymisation system so it works in real-world lighting conditions, not just controlled tests. Publish a clear, plain-language explanation of what footage is reviewed by humans, by whom, in which countries, and under what data protection standards.For Sama, the questions are about labour standards: what psychological support is available to workers who encounter distressing content? What is the actual pay rate inclusive of all deductions? What does the NDA permit workers to disclose about their working conditions, and is that NDA itself compliant with Kenyan labour law?For the ODPC, the question is whether it will act. The Swedish investigation has provided the factual basis for an inquiry. European regulators are already examining the cross-border data transfer implications. Kenya's own data protection commissioner has both the jurisdiction and the obligation to investigate data processing happening in Nairobi offices that does not appear to meet the standards the Data Protection Act 2019 requires.For Kenya's broader tech sector, this story is a prompt for a harder conversation. AI data labelling is real employment. It is also work that can cause real harm, to workers who see things they cannot unsee, and to the people whose most intimate moments become training data without their knowledge. Positioning Kenya as Africa's AI data hub without asking hard questions about the conditions of that work is a strategy that trades short-term employment numbers for long-term reputational and human cost.The LED light on a pair of glasses in a Stockholm apartment is not doing enough to protect privacy. And the data commissioner's office in Nairobi has not yet done enough to protect the workers, and the data subjects, whose interests it exists to serve.If you work or have worked in AI data annotation in Kenya and want to share your experience confidentially, reach us at hello@techinkenya.com. Your identity will be protected.