Kenya’s newly enacted Cybercrime Law has ignited a nationwide debate, dividing opinion between those who view it as a threat to free expression and those who see it as a crucial step toward protecting citizens in an increasingly digital world. Building upon the country’s 2018 framework, the legislation seeks to strengthen Kenya’s capacity to prevent, investigate, and prosecute cybercrimes amid a significant rise in online incidents.

Kenya’s rapid digital transformation, characterized by millions of citizens conducting daily online transactions for services and businesses has, unfortunately, also triggered a surge in online fraud, impersonation, identity theft, cyberbullying, and data breaches. Reported cyber incidents in Kenya more than doubled between 2022 and 2024, rising from 153 million to over 353 million. Many of these attacks targeted vulnerable systems in schools, hospitals, and small enterprises. The new law is therefore designed to close existing security gaps and protect the country’s digital infrastructure.

Key updates in the Cybercrime Law include stronger safeguards for evidence handling, requiring court authorization for any tracing of online activities or digital forensics. This ensures that investigations remain lawful and uphold the right to privacy. The Act also introduces a structured approach to managing harmful online content, mandating that any request to remove digital material or suspend an account must be supported by a court order, an important check against misuse or censorship.

In addition, the law establishes new standards for online safety, particularly for minors and vulnerable users. It criminalizes online grooming, exploitation, and bullying, while compelling digital platforms to enhance their safety tools. It also designates critical infrastructure such as hospitals, power grids, and government data systems, as protected assets under national law, imposing harsher penalties for attacks on these systems. The legislation extends its reach to digital assets and financial fraud, empowering regulators to trace cryptocurrency-related crimes and tackle impersonation, phishing, and online scams that have defrauded many citizens.

For the average Kenyan, the law is presented not as a restriction on internet use, but as a mechanism to enhance safety in vital digital spaces. It outlines clear legal procedures for victims of online defamation, hacking, or scams to seek redress and aims to reinforce consumer confidence. Small businesses, especially those involved in mobile money and e-commerce, are expected to benefit from stronger protections against cyberattacks. Parents can look forward to greater accountability from digital platforms, while public institutions gain improved tools for data security. On a broader level, the law seeks to elevate Kenya’s reputation as a credible digital economy aligned with international cybersecurity standards, an essential factor for attracting investors and global partners.

Despite these intentions, concerns persist that the law could be exploited to suppress dissent or monitor online expression. Legal experts, however, emphasize that judicial oversight is built into the law as a safeguard. No agency or officer can independently order a takedown or access user data; every step must be sanctioned by a judge. This mechanism mirrors protections found in the European Union’s Digital Services Act and South Africa’s Cybercrimes Act, designed to preserve freedom of speech and privacy while promoting online safety.

Nevertheless, President William Ruto’s administration has encountered a significant legal challenge. The High Court in Nairobi has suspended the implementation of key provisions of the Computer Misuse and Cybercrimes (Amendment) Act, 2025. Justice Lawrence Mugambi issued conservatory orders halting the enforcement of Sections 27(1)(b), 27(1)(c), and 27(2) of the amended law pending the hearing of a petition filed by activist and musician Reuben Kigame and the Kenya Human Rights Commission (KHRC).

The petitioners argue that the contested sections are overbroad and vague, creating avenues for the criminalization of dissent, whistleblowing, satire, and online criticism of public officials and government policies. They warn that if enforced, these provisions would have a chilling effect on public interest journalism and digital activism and could be weaponized against journalists, bloggers, and citizens expressing dissent. Section 27 of the original Act had already faced backlash for criminalizing the publication of “false,” “misleading,” or “disturbing” online content, terms criticized as subjective and open to abuse.

Moreover, the petitioners contend that the government and Members of Parliament rushed the Computer Misuse and Cybercrimes (Amendment) Bill, 2024, securing its assent from President Ruto on October 25, 2025, in violation of constitutional procedure. They claim that the bill bypassed referral to the Senate, contrary to Article 110 of the Constitution, rendering the process “fatally flawed” and unconstitutional. Specifically, they challenge the criminalization of publishing “false, misleading, or fictitious data” as excessively broad and unclear, which could lead to arbitrary enforcement and restrictions on free speech. The High Court has directed all respondents, including the Attorney General and the Speaker of the National Assembly—to respond within seven days, with further proceedings scheduled for November 5, 2025.

Adding another dimension to the public debate, Kenyan socialite and influencer Amberay publicly endorsed the Cybercrime Amendment Bill. In a viral Instagram post, she declared, “Freedom of speech should never be an excuse for cruelty, defamation, or disrespect.” Her remarks, inspired by her personal experiences with online harassment and cyberbullying, drew mixed reactions, some praised her advocacy for digital accountability, while others accused her of supporting a bill that could restrict free expression. Several public figures echoed her sentiment, calling for boundaries between free speech and abuse, while digital rights activists warned that vaguely worded sections could be exploited for censorship.

Kenya’s internet economy has grown faster than the systems designed to protect it. The Cybercrime Law represents an attempt to sustain innovation while instituting safeguards against exploitation, fraud, and digital harm. Though not a flawless piece of legislation, its success will depend on fair implementation and balanced enforcement. Ultimately, the law signals Kenya’s determination to evolve with technology rather than lag behind it, addressing the crucial question of how justice, security, and freedom can coexist in an era where cyberattacks pose real and devastating threats. The effectiveness of this law will hinge on how well Kenya manages to uphold both a free and safe internet, building trust among its digital citizens.