Children under 18 will need a parent’s consent to access social media and other online services in Kenya, and platforms that breach their duties under the law could face fines of up to Sh500 million.
This is according to a Bill that has been tabled in the National Assembly by Embakasi West MP Mark Mwenje, which will make age verification mandatory for most online platforms.
The Online Safety Bill, 2026 requires providers of “regulated services”, meaning user-to-user platforms and search services, to use age verification or age estimation to determine whether a user is a child. It bars them from letting a child use the service without parental consent.
“A provider of a regulated service shall not permit a child to access or use the service unless the provider has obtained the consent of a parent of a child or a person who exercises parental responsibility over the child,” reads part of the Bill.
“The provider shall, upon withdrawal, restrict the child's access to the service within such period as may be prescribed,” the Bill states.
Although the Bill does not name any platforms, services such as Facebook, Instagram, TikTok, YouTube and X fit its definition of a user-to-user service.
It states that the categories of regulated services will be set through regulations by the ICT Cabinet Secretary on the recommendation of the Communications Authority of Kenya (CA).
Providers may verify parental consent through credit card verification, secure cross-referencing of a parent’s or guardian’s identity, decentralised verification of a digital identity, or any other method approved by CA.
The Bill requires the measures to be “highly effective”, and providers must take reasonable steps to confirm that the person giving consent has parental responsibility.
A provider that fails to comply with a duty of care under the Bill commits an offence. If convicted, it is liable to a fine of up to Sh500 million or 10 percent of its annual global turnover, whichever is higher.
Embakasi West MP Mark Mwenje
Photo credit: File I Nation Media Group
Where the offence was committed with the consent or connivance of a senior executive officer, or is attributable to that officer’s gross negligence, the officer is personally liable to a fine of up to Sh10 million, imprisonment of up to five years, or both.
The Bill also gives CA the power to issue compliance notices and impose civil penalties, whose maximum amounts the Cabinet Secretary can set in regulations. A provider can appeal to the Communications and Multimedia Appeals Tribunal within 30 days, but an appeal does not automatically suspend a penalty.
Providers must carry out an illegal content risk assessment at least once every 12 months. User-to-user services likely to be accessed by children must also carry out a separate children’s risk assessment at least annually, and again before any significant change to the service. CA has been given the powers to order an assessment at any time.
In creating the children’s assessment, the platform is required to examine the number of children using the service in different age groups, the effect of its algorithms, the features that let adults search for or contact children; features such as “autoplay” that affect time spent on the service, how easily harmful content spreads, among others.
The Bill requires providers to prevent children of any age from encountering pornography and content promoting suicide, self-harm or eating disorders.
Other categories it treats as harmful to children include bullying, hate speech, graphic violence, dangerous challenges and the self-administration of harmful substances.
The Bill also places duties on parents. It requires them to take reasonable steps to protect children from online harm, guide them on safe internet use, including the risks of interacting with strangers and sharing personal information, and supervise their use appropriately for their age and maturity.
“Where the child is exposed to online abuse or exploitation, [the parent should] take appropriate action, including reporting the matter to the provider of the service, CA, the National Council for Children Services or the National Police Service,” says the Bill.
The Communications Authority of Kenya.
Photo credit: File | Nation Media Group
However, the Bill says parents commit no offence and incur no liability solely because a child accesses harmful content. It also requires them to respect their child’s privacy and not subject the child’s communications to arbitrary or unlawful interference.
The Bill acknowledges that it limits freedom of expression, access to information and privacy, which are protected under Articles 33, 35 and 31 of the Constitution. It argues the limits are justified under Article 24 of the supreme law.
The drafter argues that the Bill does not require platforms to scan private communications, and where they choose to, the use must be necessary, proportionate, disclosed in their terms of service and compliant with the Data Protection Act. Users whose content or access is restricted by such technology are entitled to have complaints reviewed by a human.
In the memorandum of objects and reasons, Mr Mwenje explains the rationale of the proposed law.
“The principal object of the Bill is to establish a legal framework for online safety in Kenya to prevent children from exposure to pornographic material and to create a duty of care for the safety of children from user-to-user internet platforms, social media intermediaries and search services in Kenya,” he states.
Children under 18 will need a parent’s consent to access social media and other online services in Kenya, according to new Bill.
Photo credit: Shutterstock
“The Bill addresses predatory contact and harassment through risk assessment, parental responsibility and reporting and complaints systems and contains provisions that provide accessible reporting and redress pathways for predatory contact, online grooming and peer cyberbullying,” adds Mr Mwenye. “The Bill provides for corporate liability, penalties and civil penalties which effect turnover-based penalties and business disruption orders as deterrent corporate sanctions.”
Kenya’s approach differs from the outright bans emerging elsewhere. Australia’s ban on social media for under-16s came into force on December 10, 2025. Elsewhere, the UK government announced a ban for under-16s on June 15, 2026, expected to take effect from late spring 2027.
The European Union’s Digital Services Act also imposes obligations on platforms to protect minors. In its current form, Mr Mwenje’s Bill sets the age at 18 but allows access with parental consent.
