Communications Authority Clarifies New Licensing Rules for Cyber Cafés
The Communications Authority of Kenya (CA) has clarified new licensing requirements for cyber cafés and other public internet access centres, saying the rules are intended to strengthen accountability and security without limiting access to digital services.
The Authority said public communications access centres (PCACs) remain an important gateway to the internet for Kenyans who lack personal computers, reliable connectivity or other digital resources.
The new licence conditions were published in Kenya Gazette Notice Vol. CXXVIII No. 135 on August 7, 2026, and will take effect on September 7, 2026, following the statutory 30-day period.
Under the new requirements, operators of PCACs will be required to verify customers, display applicable charges, issue receipts for paid services and maintain basic records demonstrating compliance with their licences.
The Authority said the records would provide an audit trail in cases where a public internet facility is linked to unlawful activities, particularly amid the rise in cyber-enabled fraud, online scams, identity-related offences and other forms of cybercrime.
Cyber cafés not required to keep browsing history
The CA, however, clarified that the new requirements do not require cyber cafés to record or retain customers’ browsing histories.
Instead, operators will only be required to maintain basic session information, including the identification of the terminal used and the start and end times of a customer’s session.
“The requirement for PCACs to maintain basic user logs does not extend to a customer’s browsing history,” the Authority said.
The new licence conditions also do not prescribe a specific customer identification system or CCTV solution for cyber cafés.
Operators may, however, introduce additional Know Your Customer (KYC) measures as part of their security and operational controls, provided such measures comply with applicable laws.
CA seeks to balance security and privacy
The clarification follows public discussions and media reports on the new licensing conditions, particularly concerns over the extent of monitoring and customer identification requirements imposed on cyber cafés.
The Authority said its regulatory approach seeks to strike a balance between access to digital services, consumer protection, privacy and security.
Cyber cafés continue to play an important role in enabling Kenyans to access online services, conduct digital transactions, apply for government services and participate in the digital economy.
The facilities are particularly important for people who do not have access to personal digital devices or dependable internet connections.
The CA said it would continue engaging cyber café operators and other stakeholders to promote understanding and compliance with the new requirements.
Operators and members of the public have been encouraged to consult Kenya Gazette Notice Vol. CXXVIII No. 135, published on August 7, 2026, for the full licence conditions and applicable requirements.