Communications Authority of Kenya headquarters/ FILE
The Communications Authority of Kenya (CA) has clarified that new licensing requirements for cyber cafes do not require operators to keep customers’ browsing histories, amid public concern over probably privacy violation.
CA said operators of public communications access centres (PCACs), commonly known as cyber cafes, will instead be required to maintain basic session information to enable tracking in the event a facility is linked to unlawful activity.
The records will comprise the identification of the terminal used by a customer and the start and end times of the session.
“The requirement for PCACs to maintain basic user logs does not extend to a customer's browsing history,” the Authority said.
CA said the requirements are intended to strengthen accountability and security while ensuring that cyber cafes remain accessible to Kenyans who rely on public facilities to access digital services.
The clarification follows public discussion and media coverage of the new licensing conditions, with concerns raised over whether cyber cafe operators would be required to monitor or retain detailed information about customers’ online activities.
CA said the new requirements should not be interpreted as introducing a system for tracking customers’ browsing histories.
It said the basic records are intended to establish a limited audit trail that can assist investigations where a public internet facility is connected to unlawful activity like phishing.
The authority cited the growing threat of cyber-enabled fraud, online scams, identity-related offences and other forms of cybercrime as part of the reason for strengthening accountability at public internet access points.
Under the new conditions, cyber cafe operators will be required to verify customers, display applicable charges, issue receipts for paid services and maintain basic records necessary to demonstrate compliance with their licences.
CA said the new licence conditions do not prescribe a specific customer identification system or CCTV solution.
However, operators may introduce additional Know Your Customer (KYC) measures as part of their security and operational controls, provided such measures comply with applicable laws.
The new licence conditions were gazetted on August 7, 2026 but they will take effect on September 7 after the expiry of the statutory 30-day period.
Cyber cafes continue to facilitate access to a range of essential online services, including government services, online transactions and other activities that enable Kenyans to participate in the digital economy.
The facilities are particularly important for users who may lack personal digital devices or dependable internet connections, making them a key component of Kenya’s broader digital access infrastructure.
CA said the new rules are therefore not intended to restrict access to digital services, but to ensure that public internet facilities operate within a framework that promotes accountability and security.
The authority said operators would be expected to comply with the new conditions once they take effect.
