SMS Marketing Law in Kenya: CA Rules, DPA and ODPC Awards

SMS marketing in Kenya is legal, but only to people who opted in, with a free and simple way to opt out in every message, and with your data-protection house in order. Three sets of rules apply together: the CA Consumer Protection Regulations, 2010, the Data Protection Act, 2019 with its 2021 General Regulations, and the operator rules Safaricom applies to promotional sender IDs.

Last reviewed: 27 October 2026

This article goes through each source in detail, summarises what the Office of the Data Protection Commissioner (ODPC) has decided in unsolicited-message complaints, and ends with a practical compliance checklist. It is written for marketers and founders, not as legal advice. For a specific campaign or an unusual data source, talk to a Kenyan data protection lawyer or the regulator.

1. The CA Consumer Protection Regulations, 2010

The Kenya Information and Communications (Consumer Protection) Regulations, 2010, issued under the Kenya Information and Communications Act, contain the oldest Kenyan rule on marketing messages. Regulation 17, headed "Unsolicited communications", says:

Using automated calling systems, fax or electronic mail for direct marketing without the subscriber's prior consent is an offence (reg 17(1)).
Sending direct-marketing messages that disguise the sender, or that give no valid address where the recipient can ask for messages to stop, is an offence (reg 17(2)).
A business that obtained contact details from customers in the course of a sale may market its own similar products to them, if it gives them a free, simple chance to object when the details are collected and in every message (reg 17(3)).
"All automated direct-marketing schemes to be used in Kenya shall be based on an opt-in principle", giving potential subscribers the chance to accept or reject inclusion in a marketer's mailing list (reg 17(4)).

Bulk SMS campaigns sent from a platform are automated direct-marketing schemes in any ordinary reading, so the opt-in principle in regulation 17(4) is the starting point.

2. The Data Protection Act, 2019

The Data Protection Act applies to anyone processing personal data of people in Kenya, and a phone number tied to a person is personal data. For marketers, the key points are:

Rights of data subjects (section 26) include the right to object to processing of their personal data.
Commercial use of personal data (section 37) is restricted: personal data may not be used for commercial purposes unless the person consented or the use is authorised by law.
Registration. Data controllers and processors must register with the ODPC unless exempt, and some activities must register whatever the size of the business. The ODPC's registration guidance lists direct marketing among them, alongside education, health, hospitality, financial services, telecommunications and transport.
Enforcement. The ODPC can issue enforcement notices and penalty notices, and it hears complaints from individuals and can award compensation.

3. The Data Protection (General) Regulations, 2021

The General Regulations turn the Act into specific direct-marketing duties. As summarised by Afriwise:

Regulation 8 recognises the right to object to processing for direct marketing. Once someone objects, that processing must stop.
Regulation 14 defines direct marketing as commercial use of personal data and includes electronic messages sent using personal data. It is direct marketing when personal data is used to identify or target the individual.
Regulation 15 sets the conditions for using non-sensitive personal data for direct marketing: broadly, the data was collected from the person, they were told it would be used for marketing, they consented, a simplified opt-out is provided and they have not opted out.
Regulation 16 requires the opt-out to be free, clear, quick, easily accessible and usable by persons with disabilities.
Regulation 17 describes acceptable opt-out methods, such as a single-word reply, a prominent link to a subscription preference page or following instructions in each message, and lets people choose which marketing to receive or opt out of everything.

Children's data gets extra protection: regulation 13 bars using a child's profile for direct marketing. Sensitive personal data, which under the Act includes health status and religious belief, needs more than these conditions, so do not build marketing lists from it.

4. What the ODPC has decided

ODPC decisions show how the rules are applied in practice. Two complaints about unsolicited messages are widely cited:

Decision	What went wrong	Outcome
David Owuor & 2 others v Ceres Tech Limited t/a Rocketpesa (ODPC Complaints 1994, 1998 and 2298 of 2023)	Promotional messages and calls without consent, no opt-out, objections ignored. The company had already received an enforcement notice in an earlier complaint.	KES 2,600,000 in total compensation to the three complainants
Dennis Gathara v Goodtimes Africa (ODPC Complaint 762 of 2024, August 2024)	Promotional messages without consent and despite an objection, no opt-out, and an erasure request not honoured	KES 700,000 compensation

The pattern is consistent: the complainants did not consent, could not opt out and were ignored when they objected. Each of those is avoidable with basic list hygiene.

5. Operator rules on Safaricom

Separately from the law, Safaricom applies its own rules to bulk SMS. Its 2020 notice to providers split sender IDs into promotional and transactional categories. Promotional messages must include opt-out instructions and can only be sent between 08:00 and 18:00; transactional messages are not time-restricted. One sender ID should not carry both. Safaricom subscribers can also block all promotional messages by dialling *456*9*5#.

The Nation has reported a Communications Authority proposal to stop promotional texts after 19:00. Check the CA website for whether any such rule is final.

6. Political messages

The CA's guidelines on political bulk messages add rules for parties and aspirants. Messages must be submitted to the network for vetting at least 48 hours before sending, be in English or Kiswahili only, be sent between 08:00 and 17:00 and go only to recipients who have expressly opted in, with a working opt-out. Political canvassing is also a mandatory ODPC registration activity.

What counts as consent in practice

Consent should be specific, recorded and easy to prove. Good sources of SMS marketing consent:

A separate, unticked checkbox at online checkout or account sign-up: "Send me offers by SMS".
A signed loyalty or membership form with a clear SMS marketing option.
A keyword sent to your two-way short code, for example "JOIN", followed by a confirmation message.

Weak or unlawful sources:

Bought or rented number lists.
Numbers scraped from websites, WhatsApp groups or social media.
Contacts harvested from a user's phone book through app permissions.
Pre-ticked boxes, or consent buried in terms and conditions.

Keep the date, the source, the wording the person agreed to and, where possible, an IP address or form reference. If a complaint reaches the ODPC, this record is your defence.

A compliance checklist for Kenyan SMS marketing

Check your ODPC registration covers direct marketing.
Send promotions only to people who opted in, and keep the consent record.
Use a registered promotional sender ID for offers and a transactional one for service messages.
Name your business in every message.
Include a free opt-out that works on the channel you use. On a one-way sender ID, that means a short unsubscribe link or a keyword to a two-way number, not "reply STOP".
Process opt-outs promptly and suppress those numbers across every campaign. eSMS Africa blocks sends to numbers on your opt-out list automatically.
Send promotions on Safaricom between 08:00 and 18:00 only.
Never market to children or use sensitive data such as health or religion to target people.
Respond to objections and erasure requests, and document how you did.
Review your lists at least yearly and remove people who have not engaged.

For industry examples of compliant messages, see retail and e-commerce, hotels and travel and government and NGOs. Sender ID rules are explained in promotional vs transactional sender IDs on Safaricom.

Frequently asked questions

Is bulk SMS marketing legal in Kenya?

Yes, if you follow the rules. Send promotions only to people who opted in, include a free and simple opt-out in every message, stop when someone objects and register with the ODPC. On Safaricom, use a promotional sender ID and send between 08:00 and 18:00.

Can I market to my existing customers without asking first?

Regulation 17(3) of the CA Consumer Protection Regulations allows marketing of similar products to customers whose details you obtained in a sale, if you offered a free way to object at collection and in every message. The data protection regulations still require an opt-out and respect for objections, so asking for clear consent is the safer route.

What happens if someone complains to the ODPC?

The ODPC investigates and can issue enforcement notices, penalty notices or compensation awards. In the published decisions above, businesses paid KES 700,000 and KES 2.6 million in compensation after sending promotions without consent and ignoring objections.

Does the law apply to transactional SMS?

The direct-marketing rules apply to marketing. Transactional messages such as receipts and OTPs still involve personal data, so the Data Protection Act's general duties apply: a lawful basis, security, accuracy and respect for data subjects' rights.

Sources

Run compliant campaigns with consent records, opt-out blocking and scheduled sending built in. See bulk SMS in Kenya, then create a free eSMS Africa account.