It usually starts as banter. A friend takes a screenshot of your selfie, trims it into a sticker and suddenly your face is popping up in WhatsApp chats you weren’t even part of.
It will elicit a few laughs, but what may seem like harmless fun can, however, raise serious questions about privacy, consent and the law.
In Kenya, a person’s face is considered personal data under the Data Protection Act, 2019.
“Processing personal data includes collection, storage, sharing, use, and publication,” explains Mary Audi, Senior Associate Advocate at Muri Mwaniki Thige & Kageni Advocates.
“A photograph or image that identifies a person is treated as personal data, and turning it into a meme or sticker is processing that data. Without legal basis, this can be unlawful.”
Even private WhatsApp groups are not exempt. Fridah Muriithi, Associate Advocate at the same firm, notes that while public platforms like Facebook or TikTok carry greater risk due to visibility, “if the image is shared in a private group, it's still processing personal data. The obligation to obtain consent remains.”
She adds that consent must be “clear, informed, specific and freely given. Implied or assumed consent generally does not satisfy the legal standard.
Intent does not absolve the sharer. Muriithi emphasises that even a sticker created as a joke can violate privacy if it harms the person whose image is used. Audi says the unauthorised circulation of someone’s face can interfere with personal autonomy and dignity, particularly when it spreads widely.
“Article 31 of the Constitution safeguards individuals from unnecessary or unlawful intrusion into private affairs. Sharing images without consent can breach this right,” she explains.
Legal remedies are available and individuals can lodge complaints with the Office of the Data Protection Commissioner (ODPC), which can issue enforcement or penalty notices, order compensation or demand removal of offending content. Recent ODPC cases show awards ranging from Sh200,000 to Sh5 million for unauthorised use of images. In some situations, High Court petitions are possible, particularly when privacy violations intersect with human rights concerns.
Liability is not limited to the creator. Muriithi explains that those who knowingly share or redistribute a sticker or meme may also bear responsibility. Platforms hosting the content, once notified, are also expected to remove it or face potential liability. When memes portray someone falsely or humiliatingly, Audi says the case can cross into defamation territory, and repeated sharing intended to mock or intimidate may constitute cyber harassment under the Computer Misuse and Cybercrimes Act (CMCA).
For everyday Kenyans, taking action can be challenging because digital content spreads quickly and sources are not always clear.
“The first step is to document the evidence,” advises Audi.
“Take screenshots, save the content, request removal from the sharer, report the content to the platform, and, if necessary, lodge a complaint with the ODPC.”
Muriithi adds that the law is evolving to keep pace with meme culture, but it “provides a foundation for protecting privacy and dignity in digital interactions.”
The Nation also reached out to WhatsApp's Privacy Operations Team for clarification on whether users are protected if their images are used in stickers or memes without consent, and the steps users can take to report or remove the content. The Meta-owned social media network had not resonded by press time.
