Quick answer
In Kenya, marketing by SMS, WhatsApp or email should be opt-in: the person must agree before you send promotions. The Data Protection Act requires express consent for commercial use of personal data, and the CA Consumer Protection Regulations apply an opt-in principle to automated direct marketing. Every promotion must also offer a free, simple opt-out, such as replying STOP, honoured before your next campaign.
Key takeaways
- Promotions on any channel need opt-in. A past purchase is not the same as agreeing to marketing.
- The Data Protection Act, 2019 (section 37) requires express consent to use personal data for commercial purposes.
- The CA's Consumer Protection Regulations set an opt-in principle for automated direct-marketing schemes.
- Every promotion needs a free, simple opt-out; replying STOP is an accepted method.
- Keep a record of when and how each person opted in, and remove opt-outs before every campaign, on every channel.
Opt-in is a person's clear agreement to receive messages from your business, given before you send them. Opt-out is the reverse: the free, simple way for that person to stop receiving them at any time. Together they decide who you are allowed to market to, and they are the main thing standing between a business and a complaint to the data regulator.
This explainer sets out the rules that apply in Kenya, how opt-in and opt-out work on SMS, WhatsApp and email, and a worked example of a business doing it properly. It is general information, not legal advice.
Which rules govern opt-in and opt-out in Kenya?
Three sets of rules matter for most businesses: the Data Protection Act, the Communications Authority of Kenya's consumer protection regulations, and the rules of the channels themselves.
The Data Protection Act, 2019. Section 37 says personal data may not be used for commercial purposes unless the person has given express consent, or the use is authorised by law and the person was told when the data was collected. Section 36 gives people the right to object to processing. The Data Protection (General) Regulations, 2021 add that a direct-marketing opt-out must be free, clear and simple, and that replying with a single word such as STOP is an accepted way to opt out.
The Kenya Information and Communications (Consumer Protection) Regulations, 2010. Regulation 17 deals with unsolicited communications. Regulation 17(4) says that all automated direct-marketing schemes used in Kenya shall be based on an opt-in principle. Regulation 17(3) allows marketing of similar products to existing customers if they are given a free, simple way to opt out when their details are collected and in each message. Parts of regulation 17 are worded for email, but the opt-in principle in 17(4) covers automated direct marketing generally and is widely applied to SMS. The regulations are published by the Communications Authority of Kenya.
Channel rules. Mobile networks require registered sender IDs and, on Safaricom, separate sender IDs for promotional and transactional SMS. Meta requires businesses to collect opt-in before messaging people on WhatsApp.
Our page on bulk SMS rules in Kenya covers the penalties and the ODPC's decisions on unsolicited messages in detail.
Does opt-in apply to every message?
No. The strict opt-in rules are aimed at marketing. Service messages about a person's own account, such as a fee balance, loan instalment, appointment or delivery, are part of an existing relationship. You should still tell people at collection that you will send them, and respect a request to stop messages that are not essential. The article on transactional vs promotional SMS explains how to tell the two apart.
How do opt-in and opt-out work on each channel?
The principle is the same everywhere; the mechanics differ.
| Channel | Good opt-in | Opt-out method | What else applies |
|---|---|---|---|
| SMS | Tick box or verbal yes at till, form or website, recorded with date | "Opt out: WhatsApp STOP to 07XX..." in every promotion, because sender IDs cannot receive replies | Safaricom subscribers can block promotional SMS via the *456# menu |
| Customer messages you first, ticks a box on your site, or agrees in a chat | "Stop promotions" button or reply STOP; customers can also block you | Meta's opt-in policy; blocks lower your quality rating | |
| Sign-up form with a clear purpose | One-click unsubscribe link in every campaign | Bounced addresses should be removed |
Safaricom introduced the free code 4569*5# in 2021 to let subscribers stop promotional messages from all senders or a specific sender. Menu numbers can change, so *456# is the safest starting point to mention to customers. In October 2026 the CA directed networks to deliver official government emergency and early-warning alerts to everyone, including people who opted out of promotions; that directive does not cover commercial messages.
What counts as valid opt-in?
Valid opt-in is specific, informed, freely given and recorded. In practice:
- Specific: "Can we send you offers and new stock alerts by SMS and WhatsApp?" is clear. "I agree to the terms" is not consent to marketing.
- Informed: say who will message them, about what, and how they can stop.
- Freely given: no pre-ticked boxes, and buying something must not depend on agreeing to marketing.
- Recorded: the Act puts the burden of proving consent on the business, so note the date, channel and source.
Numbers from bought lists, M-Pesa statements, directories or WhatsApp groups you belong to do not come with opt-in for your marketing, however they were obtained.
A worked example: a supermarket loyalty programme
Imagine a family supermarket in Kisumu launching a loyalty programme. At the till, cashiers ask: "Would you like points, and can we send you weekly offers by SMS or WhatsApp?" The customer's number is entered with one of two tags: "offers-yes" or "points-only". The sign-up slip says how to stop: reply STOP on WhatsApp.
Each Thursday, the supermarket sends its weekend offer only to "offers-yes" contacts: by WhatsApp broadcast to those who use WhatsApp and by SMS to the rest. The SMS ends with "Opt out: WhatsApp STOP to 07XX XXX XXX". Points statements go to everyone in the programme from a separate transactional sender ID, because they are account information.
When a customer replies STOP, they are moved out of the offers list the same day and confirmed with a short "You will no longer receive offers from us." Their points statements continue, because those are about their own account. If they later ask for their data to be deleted, the supermarket removes it and confirms.
How does chat.or.ke handle opt-in and opt-out?
chat.or.ke keeps consent and opt-out status on each contact, so the same rules apply across channels. You tag opted-in contacts in the CRM and send promotions only to those tags with bulk SMS or a WhatsApp broadcast. Contacts who send STOP to your WhatsApp or SMS line, or whom you mark as opted out, are skipped in every future SMS and WhatsApp campaign, and you are not charged for them. Every email campaign includes a one-click unsubscribe link, and unsubscribed contacts are left out of future sends.
For a step-by-step compliance process, read how to comply with the Data Protection Act when messaging customers. To grow a WhatsApp list the right way, see how to build a WhatsApp opt-in list.
Published 20 October 2026 Updated 20 October 2026 Plain-text version
