Introduction

On 4 November 2025, the Computer Misuse and Cybercrimes (Amendment) Act, 2025 (“the Amendment Act”) will come into force. The law, which amends the 2018 parent statute, has triggered renewed debate on the delicate balance between national security and constitutional freedoms in Kenya’s digital space.

While the stated aim is to combat terrorism, child exploitation, and online extremism, several new provisions significantly expand the State’s powers to surveil, block, and shut down digital platforms. The implications for data privacy, freedom of expression, and online entrepreneurship are far-reaching.

Expanded Powers to Block and Remove Online Content

Perhaps the most consequential amendment is the insertion of a new Section 46A, empowering “authorised persons” to seek court orders to remove or deactivate websites, computer systems, or digital devices suspected of promoting terrorism, unlawful activities, or “religious extremism and cultism.”

More controversially, the amended Section 6(1)(ja) allows authorities to directly render websites or applications inaccessible if they are found to promote such content. This effectively gives government agencies the ability to block websites, a power previously confined to judicial oversight under the Constitution.

Cyber Harassment

The Amendment Act broadens Section 27 on cyber harassment to include conduct “likely to cause another person to commit suicide.” This expands the offence to cover psychological and mental harm resulting from online activity.

However, in Law Society of Kenya v Attorney General & Communications Authority of Kenya & 2 others, Petition E671 of 2025, the High Court issued conservatory orders suspending the operation of Section 27(1)(b), (c), and (2).

The Quiet Expansion of Surveillance Powers

Amendments to Section 2 redefine “access” to include entry “through a program or device,” broadening what may constitute unauthorized use and potentially legitimizing deeper forms of State monitoring.

The introduction of an undefined “authorised person” further raises concerns, as multiple agencies may exercise these powers without clear oversight mechanisms.

These developments must be considered against constitutional protections, particularly the right to privacy under Article 31 and fair administrative action under Article 47.

Implications for the Private Sector and Digital Economy

The Act introduces significant compliance uncertainty for internet service providers, social media platforms, and fintech operators. Directives to block platforms may inadvertently disrupt legitimate services hosting user-generated content.

For influencers and content creators, the law creates a new risk environment where even non-political content may fall within vague regulatory categories.

• Potential exposure to content takedowns;
• Increased platform-level moderation without notice;
• Uncertainty in brand partnerships and monetization strategies.

Influencers and digital businesses may now need to adopt compliance practices similar to regulated entities, including record-keeping, legal review, and proactive risk management.

Conclusion