NAIROBI, Kenya — The Communications Authority of Kenya (CA) has clarified new licensing conditions for cyber cafés and other public internet centres, saying the requirements are intended to strengthen security and combat cybercrime rather than restrict access to digital services.
Under the new conditions, operators of Public Communications Access Centres (PCACs) will be required to verify customers, display applicable charges, issue receipts for paid services and maintain basic records demonstrating compliance with their licences.
The Authority said operators will also be required to maintain limited information about customer sessions, including the identification number of the terminal used and the time a session begins and ends.
However, the CA stressed that the requirement does not extend to customers’ browsing histories.
“The requirement for PCACs to maintain basic user logs does not extend to a customer’s browsing history,” the Authority said.
New rules take effect in September
The licensing conditions were published in Kenya Gazette Notice Vol. CXXVIII No. 135 on August 7, 2026, and are scheduled to take effect on September 7, 2026.
The clarification follows public debate and media reports over the extent to which the new requirements could affect privacy and access to the internet at cyber cafés.
The CA said the rules are designed to establish basic accountability for public internet access points while maintaining safeguards around customers’ online activities.
Also Read: Kenya introduces new licence rules for mobile phone importers
Operators will have the option of introducing additional Know Your Customer (KYC) measures as part of their security and operational controls.
However, the Authority said any additional measures must comply with applicable laws.
Cyber cafés face hefty penalties
The new licensing conditions also introduce financial penalties for operators who breach the requirements.
Businesses found in violation will face a fine equivalent to 0.2 per cent of their annual turnover, subject to a minimum penalty of KSh500,000.
The measures come as authorities continue to focus on the role of publicly accessible internet facilities in preventing cybercrime and ensuring that businesses providing digital access operate within established regulatory requirements.
The CA said its clarification was necessary following questions raised by the public and media over whether the new rules would give operators or authorities access to customers’ browsing activity.
The Authority’s position is that the new licensing framework requires basic session information, not browsing histories, while allowing operators to adopt additional security measures within the limits of the law.
