Kenya

Kenya Suspended Worldcoin Over Biometric Data Collection Concerns

Kenya's data protection regulator took decisive action against one of the most ambitious biometric data collection efforts anywhere in the world. In September 2023, the Office of the Data Protection Commissioner suspended Worldcoin's operations in Kenya for 12 months over non-compliance with the Data Protection Act related to its biometric data collection practices — the company had been scanning Kenyans' irises in exchange for cryptocurrency tokens. The case set an important precedent: even a well-funded international project offering direct incentives for biometric data isn't exempt from Kenya's privacy rules.

Digital Lenders Are Being Fined for Publicly Shaming Borrowers

Kenya's regulator has taken particular aim at a specific, harmful pattern among digital lending apps. The ODPC ruled that Fingrow misused data collected for loan processing by using it for debt-shaming and aggressive collection tactics, breaching the Data Protection Act's principles of consent, purpose limitation, and confidentiality — resulting in a KSh 200,000 fine, alongside a separate KSh 400,000 order against Platinum Credit Limited for processing a complainant's data without consent and bombarding him with unsolicited marketing calls and messages. This reflects a recurring problem across Kenya's digital lending sector, where borrowers' personal data and contacts have repeatedly been misused as leverage during debt collection.

Enforcement Nearly Doubled in a Single Year — And Compensation Is Now Flowing Directly to Victims

Kenya's privacy enforcement has moved from a foundational, awareness-building phase into genuinely consequential action. The ODPC determined 96 complaints in 2025, nearly double the number reviewed in 2024, and as of 2025 has issued 357 determinations, 134 enforcement notices, 184 compensation orders, and collected over KES 26 million in fines through September 2024 alone — with some individual compensation awards reaching KES 500,000. During 2025, Kenyan organizations collectively paid over KES 30 million in compensation directly to affected individuals, marking a genuine shift toward remedies that benefit ordinary Kenyans rather than only the state.

New Cybercrime Amendments Specifically Target SIM-Swap Fraud and Phishing

Kenya has also strengthened the criminal law framework around common attack methods affecting ordinary users. The Computer Misuse and Cybercrimes (Amendment) Act 2024, assented to in October 2025, specifically targets emerging threats including SIM-swap fraud, phishing, and identity theft, raising penalties with severe offences now attracting fines of up to KSh 10 million or lengthy imprisonment — a direct legislative response to the kinds of fraud most commonly used to compromise mobile money and banking accounts in Kenya.

What Kenyan Users Should Do Right Now

A VPN encrypts your internet traffic and masks your real IP address, adding a meaningful layer of protection against tracking and data harvesting that operates independently of how well any individual Kenyan company or app secures its systems. Choose a VPN with a verified no-logs policy and strong AES-256 encryption, and given how frequently digital lending apps have been fined for misusing borrower data and contacts, think carefully before granting loan apps access to your phone's contact list or personal information. Enable two-factor authentication on your mobile money and banking accounts, given the rise in SIM-swap-targeted legislation, and know that under the Data Protection Act, you have a formal right to file a complaint with the ODPC directly if a company misuses your personal data — a right recent enforcement data shows is increasingly resulting in real compensation.

VPNs Are Fully Legal in Kenya

Kenya is grouped among the countries where VPN use is fully legal, alongside Nigeria and Ghana. The usual caveat still applies here too: using a VPN doesn't grant immunity from existing laws. Kenya does have one law worth knowing about — a 2018 law imposing fines of up to $50,000 and prison terms of up to two years for distributing "fake information," with the term itself left vague and vloggers required to register their activity.

Kenya's Internet Disruption During the 2024 Protests

On 25 June 2024, thousands of protesters stormed Kenya's Parliament building in Nairobi in response to the Finance Bill 2024, which proposed new taxes on essentials like bread and cooking oil — the protest turned deadly, with 19 people dying in Nairobi as police opened fire, and President Ruto vetoed the bill the following day.Despite public assurances from the Communications Authority of Kenya that it would not shut down the internet, the country experienced a nationwide internet disruption beginning at approximately 4:25 p.m. that day, which also affected neighbouring Uganda, Rwanda, and Burundi. During the disruption, mobile money services, credit and debit card transactions, and e-commerce platforms were all inaccessible. Network operators attributed it to undersea cable issues, though analysis has found the event carries several signatures consistent with a government-directed shutdown.

What to Look For in a UCN VPN for Kenya

Given this documented pattern — including a separate 2023 blocking of Telegram during national exams — a UCN VPN with obfuscated servers and reliable performance during high-demand moments is a genuinely smart precaution. WireGuard® encryption paired with a verified no-logs policy gives you the strongest combination of speed and privacy for everyday banking, streaming, and browsing in Nairobi, Mombasa, or Kisumu.

What "No-Logs" Actually Means

A no-logs policy means the VPN provider stores no record of your browsing activity, IP address, or connection times — so there's nothing to hand over if it's ever requested. Rights groups have separately raised concerns about alleged online surveillance during Kenya's 2024 protests, including reports of security agencies using technology to locate protesters, making an independently audited no-logs policy a genuinely meaningful safeguard, not just a nicety.

Getting Started in Under a Minute

Download the UCN VPN app, sign in, and tap Connect — your traffic is encrypted immediately. Given Kenya's recent history of disruptions during periods of unrest — including further protests again in 2025 — setting up and testing a UCN VPN now, before you need it, is a genuinely smart move.

Kenya's VPN use is fully legal, and its documented pattern of disruptions during protests makes having one ready in advance a real, practical safeguard.