The Court of Appeal in Nairobi has handed social media users and digital rights advocates a major legal victory by striking down key provisions criminalising online publication of “false or misleading information or fictitious data”.
In a landmark decision, the three-judge bench on Friday unanimously declared Sections 22 and 23 of the Computer Misuse and Cybercrimes Act, 2018, unconstitutional.
The court ruled the two provisions were vague and risked punishing legitimate speech on the internet. Persons found guilty of contravening the two sections faced a fine of up to Sh5 million or imprisonment for a term not exceeding ten years, or both.
The invalidated provisions had outlawed the publication of false or misleading information likely to cause panic, chaos, or reputational harm.
However, the appellate court found them excessively broad, noting they unjustifiably infringed on constitutional free speech protections.
“These provisions risk criminalising satire, opinions and journalistic inaccuracies. We are aware that some obnoxious characters would be better taken care of by the impugned provisions; however, the risk posed by the provisions to innocent citizens is enhanced and the provisions as drafted cannot be allowed to stand,” said the judges.
The ruling overturns a 2020 High Court decision that had upheld the contentious sections, granting the state broad authority to police online expression.
Since then, dozens of individuals, particularly young social media users critical of government and political leaders, have faced arrests and prosecutions under the law. The arrests increased after the June 2024 anti-government protests, where the youth criticised President William Ruto’s administration over hiked taxes.
In some instances, enforcement of the Act led to deaths, such as the case of teacher Albert Ojwang, who died in June 2025 at Nairobi’s Central Police Station after being arrested over an alleged offensive social media post.
A photo of teacher and blogger Albert Ojwang, who died while in police custody.
Photo credit: Pool
The surge in online speech-related charges coincided with Kenya’s rapid technological expansion, including increased internet access and smartphone adoption, amplifying the impact of digital discourse.
The legal challenge was initiated by the Bloggers Association of Kenya (BAKE), which contested multiple sections of the 2018 cybercrime law.
BAKE argued that the provisions stifled free expression and subjected bloggers, journalists, and ordinary users to undue legal jeopardy. Civil society groups led by Katiba Institute, media organisations, and legal experts joined the case as interested parties. The law had introduced harsh penalties for publishing information deemed false or misleading online.
In its judgment, the appellate court emphasised that criminalising speech demands precise legal language. It criticised the disputed sections for relying on undefined terms such as "false," "misleading," "panic," and "chaos," warning that such vagueness could enable arbitrary enforcement against routine online commentary.
"The lack of clear definitions delegates excessive discretion to authorities in determining criminal conduct," the court observed.
“If the intention of the legislature was to criminalise the genre of speech prohibited in Article 33(2) of the Constitution, then we are of the view that the impugned provisions, as drafted, have not succeeded in achieving that purpose,” said the bench.
It noted that during the hearing of the appeal, appellants’ advocates submitted, without much resistance by those opposed to the appeal, that the National Cohesion and Integration Act, 2008, has already criminalised what was sought to be criminalised by the two provisions.
“We therefore find that sections 22 and 23 of the Act have failed to pass constitutional muster,” said the judges.
However, the court upheld most other provisions of the cybercrime law with the judges saying that the broader statute still plays an important role in combating cybercrime.
The upheld sections include Sections 16, 17, 27, 28, 37 and investigative powers under Sections 48, 50, 51, 52 and 53, which create offences such as unauthorised interference with computer systems, unlawful interception of data, cyber harassment, cybersquatting and the wrongful distribution of intimate images.
The Act prescribes penalties ranging from fines of up to Sh20 million and prison terms of up to 10 years for serious cyber offences like system interference and unlawful interception. Other listed offences, such as cyber harassment and sharing intimate images, attract fines of up to Sh200,000 or imprisonment of up to two years, or both.
In upholding the provisions, the court ruled that they serve a legitimate purpose in combating cybercrime and protecting victims of online abuse, noting that the offences are clearly defined and contain elements such as “knowingly”, “intentionally” or acting “without authorisation,” which establish criminal intent.
The court concluded that such provisions were justified limits under the Constitution, stating that “the impugned provisions are reasonable and justifiable in an open and democratic society” and are necessary tools for investigating and prosecuting cybercrime.
Enacted in 2018 to tackle escalating online fraud, hacking, and abuse, the Computer Misuse and Cybercrimes Act has faced staunch opposition from bloggers, activists, and media advocates since its inception. Critics long warned that its ambiguous speech restrictions could suppress dissent and investigative journalism.
Digital rights groups hailed the appellate decision as a watershed moment for online freedom, reinforcing constitutional safeguards for digital publishers. "A law limiting fundamental rights must be clear and precise," the court underscored.
