Kenya: cookie and consent rules under the Data Protection Act

What is Kenya's Data Protection Act?

The Data Protection Act, 2019 (No. 24 of 2019) gives effect to the right to privacy in Article 31 of Kenya's Constitution. It was assented to on 8 November 2019 and commenced on 25 November 2019. It created the Office of the Data Protection Commissioner (ODPC), which registers controllers and processors, handles complaints, issues enforcement and penalty notices, and publishes guidance notes. Regulations adopted in 2021 cover general obligations, registration, and complaints handling and enforcement.

Who does the Act apply to?

Section 4 applies the Act to processing by a controller or processor established or ordinarily resident in Kenya that processes personal data while in Kenya, and to one not established or resident in Kenya that processes personal data of data subjects located in Kenya. A foreign website that tracks visitors in Kenya falls within the second limb. An identifiable person is one who can be identified directly or indirectly by reference to an identifier, and the Act lists an online identifier among them (section 2), so cookie and advertising IDs are personal data.

Do cookies need consent in Kenya?

The Act does not mention cookies, and Kenya has no ePrivacy-style rule. Whether a cookie needs consent depends on the lawful basis. Section 30 allows processing only on one of these grounds: consent for one or more specified purposes; necessity for a contract, a legal obligation, vital interests, a public interest or public authority task; legitimate interests, unless the processing is unwarranted given the harm to the person's rights; or historical, statistical, journalistic, artistic or scientific research. Strictly necessary cookies can rest on the service the visitor asked for. For analytics and advertising, three parts of the law point toward consent:

• The definition of consent. Section 2 requires an express, unequivocal, free, specific and informed indication, by a statement or a clear affirmative action. Section 32 puts the burden of proof on the controller, gives a right to withdraw at any time, and treats consent as not freely given when a service is made conditional on processing it does not need.
• Commercial use. Section 37 forbids using personal data for commercial purposes unless the person has given express consent or a written law authorizes it and the person was informed. Behavioral advertising is a commercial use of browsing data. The ODPC's first penalty notice, against Oppo Kenya in December 2022, cited the company's failure to show how it complied with section 37.
• The ODPC's guidance. The Guidance Notes on Consent say consent is valid only if the person has a genuine choice to accept or decline without detriment, that the request must be prominent, concise, separate from other terms and in plain language, that it must name the controller and any third party relying on it, cover every purpose, offer granular options for each separate type of processing, explain how to withdraw, and be obtained before processing starts. Controllers should keep records showing when consent was given and what the person was told.

The ODPC's Guidance Notes for Data Protection Policies (2026) address cookies directly. Under section 29, people have the right to be informed before their data is collected, so websites must tell visitors about cookies and implement a mechanism to inform them and, "where required, to obtain consent or enable user choice". The cookie policy should state what is captured, how it is handled and protected, its purposes, the types of cookies (session, persistent, first-party, third-party), whether third parties are involved, and how visitors can manage their settings and opt out.

Put together, the safe Kenyan setup is a banner that blocks analytics and advertising cookies until the visitor accepts them by category, offers a Reject option, links to a cookie policy with the elements above, and records each choice.

Can personal data leave Kenya?

Section 48 allows a transfer when the controller has given the Data Commissioner proof of appropriate safeguards, including transfers to jurisdictions with commensurate data protection laws, or when the transfer is necessary, for example for a contract with the person. Sensitive personal data can be transferred only with the person's consent and confirmed safeguards (section 49), and the Commissioner can suspend or prohibit transfers. The ODPC published guidance notes on cross-border transfers in 2026.

What are the penalties?

Section 63 lets the Data Commissioner issue a penalty notice of up to KES 5 million or, for an undertaking, up to 1% of its annual turnover in the preceding financial year, whichever is lower. Offenses without a specific penalty carry, on conviction, a fine of up to KES 3 million, up to ten years' imprisonment, or both (section 73), and data subjects can claim compensation.

The ODPC publishes its penalty notices. After Oppo Kenya's KES 5 million penalty in December 2022 for ignoring an enforcement notice over a customer photo used without consent, it announced three penalty notices on 26 September 2023 totaling KES 9,375,000: KES 2,975,000 against Mulla Pride, a digital lender that used contacts obtained from third parties to send threatening messages; KES 1,850,000 against Casa Vera Lounge for posting a customer's image without consent; and KES 4,550,000 against Roma School for posting pictures of minors without parental consent. No cookie-specific penalty has been published, but each case turned on consent.

How Cookiequiet fits

Kenya is not in Cookiequiet's preset list of regulated countries, so add it to a custom country list or show the banner everywhere; geo-targeting is included on every plan. The banner holds analytics and marketing scripts until the visitor chooses, offers Accept all, Reject all and per-category toggles, and the consent log stores each choice with its date, categories and banner version, which is the record the ODPC's consent guidance expects. Swahili is not one of the 24 built-in languages; the English strings can be edited. The cookie scanner lists the cookies and providers your cookie policy should describe, and how long to keep consent records covers retention. Not legal advice.