Kenya ‘cautiously’ Tightens Cyber Café Rules to curb cybercrime

Under the new rules, PCAC operators will be required to verify customers, display applicable charges, issue receipts for paid services, and maintain basic records necessary to demonstrate compliance with licences.

By Eunice Wawuda Last updated Aug 21, 2026

The Communications Authority of Kenya has clarified that the new licensing requirements for cyber cafes and other public internet centres are aimed at strengthening accountability and security without restricting access to digital services.

“The Authority would like to clarify that the public communications access centres remain an important gateway to the internet for Kenyans without personal computers, reliable connectivity, or other digital resources,’ it noted in a statement.

The new licence conditions were published in the Kenya Gazette Notice Vol. CXXVIII No. 135 on August 7, 2026, and will take effect on September 7, following the statutory 30-day period.

Records will provide an audit trail where a public internet facility is linked to unlawful activity, amid growing cyber-enabled fraud, online scams, identity related offences and other forms of cybercrime.

However, the Authority stressed that the requirements do not mean that cyber cafes will be required to keep customers’ browsing histories. In stead, operators will only be required to maintain basic session information, comparising the terminal identification and the start and end times of a customer session.

“The requirement for PCACs to maintain basic user logs does not extend to a customer’s browsing history,” the Authority said.

The new licence conditions do not prescribe a particular customer identification system or CCTV solution, and operators may, however, introduce additional Know Your Customer (KYC) measures as part of their security and operational controls, provided the measures comply with applicable laws.

The clarification follows a public uproar which had raised questions over the extent of monitoring and identification requirements imposed on cyber cafés.

“The regulatory approach seeks to strike a balance between access to digital services, consumer protection, privacy, and security,” it said.

Cyber cafés continue to play a role in enabling Kenyans to undertake online transactions, apply for government services, and participate in the digital economy, particularly among users who lack access to personal digital devices or dependable internet connections.

“The Authority will continue engaging cyber café operators and other stakeholders to promote understanding and compliance with the new requirements,” sad CA.