Kenya's Online Safety Bill 2026 Threatens Platforms With Ksh500 Million Fines

Social media giants operating in Kenya face fines of up to Ksh. 500 million, or 10 percent of their global annual turnover, under the newly introduced Online Safety Bill 2026. The proposed law, sponsored by Embakasi West MP Mark Mwenje, is now before Parliament. It targets Facebook, TikTok and other digital service providers that fail to shield users under 18 from harmful online material.

The Bill gives the Communications Authority of Kenya (CA) sweeping enforcement powers. The regulator can track compliance, issue formal notices and penalise non-compliant platforms. Its scope covers illegal content and online threats already criminalised under Kenya's Computer Misuse and Cybercrimes Act, the Prevention of Terrorism Act, and serious offences involving child sexual abuse material (CSAM).

What does the Bill require of platforms?

The legislation rests on two pillars: parental consent and age verification. Children under 18 must secure explicit parental approval before creating accounts or accessing social media services. Parents keep the legal right to revoke that approval at any point. Platforms would then have to cut off the child's access within a designated timeframe.

The Bill sets out the consent mechanism in precise terms. It states: "A parent or a person who exercises parental responsibility shall be responsible for giving or withholding consent to the access to, or use of, a regulated service by a child, having regard to the age, maturity and best interests of the child."

To enforce these boundaries, tech platforms must deploy robust age-verification or age-estimation systems. Providers must also confirm that the person granting permission actually holds legal parental authority over the minor. That verification duty applies before a child can access any regulated service.

How would the fines work?

Enforcement begins with the Communications Authority of Kenya. If the regulator suspects a platform of ignoring its statutory duties, it can issue a formal compliance notice. The Bill specifies what that notice must contain.

"A compliance notice shall specify the provision of this Act alleged to have been breached, the facts constituting the breach, the measures required to remedy the breach, and the period within which the measures shall be implemented," the Bill reads in part.

Failure to remedy carries heavy financial consequences. Platforms that violate the rules face fines reaching up to Ksh. 500 million, or 10 percent of their global annual turnover, whichever sum is higher. The global-turnover benchmark mirrors the penalty structure used in other jurisdictions for large technology firms, and it means the effective ceiling for multinationals could far exceed the headline figure.

Could executives go to prison?

Yes. The Bill holds corporate leadership directly accountable for systemic failures. It creates personal criminal liability for senior executives who consent to, connive in, or negligently allow breaches.

"Where an offence under this section is committed with the consent or connivance of, or is attributable to any gross negligence on the part of, a senior executive officer of the provider, that officer commits an offence and is liable on conviction to a fine not exceeding ten million shillings or to imprisonment for a term not exceeding five years, or to both," the Bill states.

That provision puts Kenya among a growing number of jurisdictions considering individual accountability for tech executives over online safety failures.

What does this mean for practitioners?

For platforms targeting Kenyan users, the Bill signals a compliance overhaul across three areas. Companies will need to re-evaluate their onboarding workflows to build parental consent checks into account creation. Content moderation systems will require adjustment to address the specific categories of illegal content the Bill targets, including CSAM and material linked to terrorism offences. User data protections will also need review to support age verification and parental authority checks.

The stakes are substantial. A platform with global revenues in the tens of billions could face a penalty far above Ksh. 500 million if the turnover-based calculation applies. Legal teams advising technology clients with Kenyan operations should track the Bill's progress through Parliament and prepare compliance gap assessments now.

The proposal remains at the review stage. Parliament has yet to debate and vote on the legislation, and its provisions could change before enactment. But the direction of travel is clear: Kenya intends to follow other jurisdictions in imposing statutory duties of care on digital platforms, backed by penalties calculated to sting even the largest operators.