Bulk SMS rules in Kenya

The short answer

You can send bulk SMS in Kenya to people who agreed to receive it. Marketing messages must be opt-in and must give people a simple, free way to stop. Service messages to your own customers, such as fee reminders or appointment alerts, are part of an existing relationship but should still respect a request to stop.

You also need a registered sender ID, and on Safaricom promotional and transactional messages go on separate sender IDs.

It helps to sort your messages into two groups. Service (transactional) messages tell existing customers about their own account or appointment: a fee balance, a loan instalment, a payment confirmation, a delivery. Marketing (promotional) messages try to sell something: an offer, a new product, an event. The strictest rules apply to marketing, and that is where most complaints come from.

The Data Protection Act 2019

Phone numbers and names are personal data. The Data Protection Act sets the main rules for using them in SMS.

• Section 37: you may not use personal data for commercial purposes unless you have the person's express consent, or you are authorised by law and told them when you collected it.
• Section 36: people have the right to object to the processing of their data.
• Section 63: the ODPC can impose a penalty of up to KES 5 million or, for a business, up to 1% of the previous year's annual turnover, whichever is lower.
• Section 65: a person who suffers damage because of a breach is entitled to compensation. Most SMS complaints so far have ended in compensation orders.

The Data Protection (General) Regulations, 2021 add detail on direct marketing: the opt-out must be free, clear and simple, and replying with a single word such as STOP is an accepted way to opt out.

CA Consumer Protection Regulations

The Kenya Information and Communications (Consumer Protection) Regulations, 2010 deal with unsolicited communications in regulation 17. Regulation 17(4) says: "All automated direct-marketing schemes to be used in Kenya shall be based on an opt-in principle".

Regulation 17(3) allows marketing of similar products to existing customers, as long as they are offered a free, simple way to opt out when their details are collected and in each message. Parts of regulation 17 refer specifically to email; the opt-in principle in 17(4) is worded for all automated direct-marketing schemes.

Offences under these regulations carry a fine of up to KES 300,000, imprisonment of up to three years, or both.

CA guidelines on short codes and premium-rate SMS

The CA's guidelines on short codes and premium-rate numbers apply to services where people text in or pay for content. They also set a general standard for SMS content:

• Service providers must make sure no unauthorised or unsolicited content is sent to consumers, for marketing or any other purpose. Continued violations can lead to the short code being withdrawn.
• Consumers must be able to unsubscribe from each service easily and separately.
• The unsubscribe procedure and all charges must be disclosed before someone subscribes.
• Providers must keep records of sent and received messages for at least six months.

The CA also has separate guidelines on political bulk SMS, which apply to networks and content providers during campaigns.

What the ODPC has ordered

The Office of the Data Protection Commissioner (ODPC) has decided several complaints about unsolicited marketing messages. These were compensation orders to the people who complained, not fines.

• Each case started with one person complaining. You do not need to send millions of messages to be at risk.
• Marketing to people who never agreed was the common thread, especially loan marketing.
• Ignoring a request to stop, or to delete data, made matters worse.
• A clear opt-out in every promotion, honoured quickly, is the simplest protection.

Opt-outs: STOP and Safaricom's *456*9*5#

Every promotional SMS should tell people how to stop. Because no one can reply to an alphanumeric sender ID, give another route, such as "Opt out: WhatsApp STOP to 07XX XXX XXX", and remove those contacts before your next campaign.

Safaricom subscribers can also block promotional SMS themselves. In March 2021 Safaricom launched the free code *456*9*5#, which lets a subscriber stop promotional messages from all senders or from one sender. Menu numbers may have changed since; *456# is the starting point. Promotional messages to subscribers who have opted out are generally not delivered.

• If someone complains, stop messaging them at once and mark them as opted out.
• Reply politely, explain where you got their number, and confirm they will not be contacted again.
• If they ask, tell them what data you hold about them, and delete it when you have no reason to keep it.
• Find out how they got onto the list, and fix the form or process that caused it.

In chat.or.ke, contacts who send STOP to your WhatsApp or SMS line are marked as opted out and skipped in every future SMS and WhatsApp campaign.

Network rules for sender IDs

• Sender IDs are registered with each network through a licensed provider, and on Safaricom with only one provider at a time.
• On Safaricom, promotional and transactional traffic need separate sender IDs.
• The name must relate to your business, product or brand; generic and misleading names are rejected.
• Betting and lottery senders need a BCLB licence. Political senders need an extra form.

October 2026: emergency alerts reach everyone

On 1 October 2026 the CA directed Safaricom, Airtel, Telkom and Jamii to deliver government emergency and early-warning SMS, including the National Early Warning System and short code 1590, to all subscribers, even those who have opted out of promotional messages. The directive covers official alerts only. Commercial bulk SMS must still respect opt-outs.

Bulk SMS compliance checklist

• Collect consent when you collect the number, and record when and how it was given.
• Send promotions only to people who opted in; never buy or borrow lists.
• Use a registered sender ID, with separate IDs for promotions and service messages on Safaricom.
• Include a free, simple opt-out in every promotional SMS.
• Remove opted-out contacts before every campaign, on SMS and WhatsApp.
• Keep sensitive details, such as health information, out of SMS.
• Send at reasonable daytime hours.
• Limit who in your team can export contact lists.
• Respond promptly when someone asks what data you hold or asks to be deleted.

This guide is general information, not legal advice. For advice on your situation, speak to a lawyer or contact the ODPC.