VPNs with servers in Kenya

In April 2026 the Bloggers Association of Kenya, with the Law Society of Kenya and two other groups, lodged a petition of appeal at the Supreme Court against the Court of Appeal’s judgment.. According to the association, it asks the court to strike down sections 27, 28, 37 and 48–53 of the 2018 Act, which include the interception and production powers.

A “service provider” is an entity that gives users the means to communicate by a computer system, or processes or stores data for it or its users (s. 2). Failing to comply carries a fine of up to five million shillings, up to three years’ imprisonment, or both (s. 54(1)). Sections 2, 50 to 52 and 54 are as enacted in 2018. Whether they reach a VPN operator is not established.

According to press reports, paragraph (ja) of section 6(1), added in 2025, let the National Computer and Cybercrimes Coordination Committee direct that websites, applications and other platforms be made inaccessible where they promoted unlawful activities, terrorism, religious extremism, cultism or indecent sexual content involving minors. On 2 July 2026 the High Court declared that paragraph unconstitutional.

Cyber harassment (section 27) carries a fine of up to twenty million shillings, up to ten years’ imprisonment, or both. As enacted, it covers wilfully communicating with a person where the communication is likely to cause fear of violence, detrimentally affects that person, or is indecent or grossly offensive and affects them. A court may order a service provider to supply subscriber information identifying the person complained of (s. 27(7)).

On 6 March 2026 the Court of Appeal struck sections 22 and 23, which criminalised publishing false, misleading or fictitious data; according to the Committee to Protect Journalists, it found section 27 clear and left it standing. On 2 July 2026 the High Court, ruling on the amended Act, declared section 27(1) unconstitutional; Kenyans.co.ke reports that it found the provision vague, overly broad and an unjustified limit on freedom of expression under Article 24.

On 19 April 2018 the High Court held unconstitutional a Communications Authority plan to install a system giving it access to mobile subscribers’ call data and device identities, finding it unlawful and disproportionate under the right to privacy in Article 31, and ordered the Authority not to implement it.

According to the Committee to Protect Journalists, in March 2026 the Court of Appeal rejected the argument that the 2018 Act gives the state unchecked powers of surveillance, search and seizure. The order of the rows is the security score, and a server’s location is not a recommendation.