The Communications Authority of Kenya (CA) has moved to clarify new licensing requirements for cyber cafes and other public internet centres, saying the rules are aimed at strengthening accountability and security without restricting access to digital services.
In a statement after uproar from a section of Kenyans, the Authority clarified that the public communications access centres (PCAC) remain an important gateway to the internet for Kenyans without personal computers, reliable connectivity, or other digital resources.
It noted that the new licence conditions were published in the Kenya Gazette Notice Vol. CXXVIII No. 135 on August 7, 2026, and will take effect on September 7, following the statutory 30-day period.
What cyber cafe operators will be required to do under new rules
Under the new rules, PCAC operators will be required to verify customers, display applicable charges, issue receipts for paid services, and maintain basic records necessary to demonstrate compliance with licences.
Records will provide an audit trail where a public internet facility is linked to unlawful activity, amid growing cyber-enabled fraud, online scams, identity-related offences and other forms of cybercrime.
However, the Authority stressed that the requirements do not mean that cyber cafes will be required to keep customers’ browsing histories. Instead, operators will only be required to maintain basic session information, comprising the terminal identification and the start and end times of a customer session.
“The requirement for PCACs to maintain basic user logs does not extend to a customer’s browsing history,” the Authority said, adding that “The new licence conditions do not prescribe a particular customer identification system or CCTV solution.”
Operators may, however, introduce additional Know Your Customer (KYC) measures as part of their security and operational controls, provided the measures comply with applicable laws.
The clarification follows public discussion and media coverage of the new conditions, which have raised questions over the extent of monitoring and identification requirements imposed on cyber cafés.
Why CA introduced new rules for cyber cafes
According to CA, the regulatory approach seeks to strike a balance between access to digital services, consumer protection, privacy, and security.
“Cyber cafés continue to play a role in enabling Kenyans to undertake online transactions, apply for government services, and participate in the digital economy, particularly among users who lack access to personal digital devices or dependable internet connections,” the authority said.
Moreover, CA said it will continue engaging cyber café operators and other stakeholders to promote understanding and compliance with the new requirements.
Additionally, it challenged operators and members of the public to consult Kenya Gazette Notice Vol. CXXVIII No. 135, published on August 7, for the full licence conditions and applicable requirements.
