Mobile Number Rights in Kenya Collide With Telco Economics
A court ruling has turned an overlooked telecom routine into a question of identity, forcing networks to carry the weight of numbers that no longer behave like disposable lines
On March 19, 2026, the High Court placed a mobile number in the same legal space as personal data. Justice Lawrence Mugambi’s decision did not dwell on telecom engineering. It focused on how a phone number functions in everyday life. The outcome is blunt. Automatic recycling after 90 days is no longer acceptable without user consent.
That one change pulls a routine backend process into constitutional territory under Article 31. It also lands on operators with immediate effect. There is no transition period for the underlying logic. Networks built on turnover now have to accommodate permanence.
The case itself adds texture. It was filed on June 10, 2024 by Erastus Ngura Odhiambo, an inmate who lost access to his number while in custody. The court’s response is clear. Physical absence does not erase a digital identity. That principle now extends beyond prisons to anyone who goes offline for long periods.
The System Kenya Built Around a Phone Number
Kenya’s digital economy did not set out to make the phone number central. It happened step by step. M-Pesa tied financial activity to the SIM. Government platforms such as KRA, e-Citizen, and NTSA followed the same path. Two-factor authentication locked it in further.
The number became a stable reference point across systems that do not talk to each other in a coordinated way. Banks, apps, public services. Each treats the SIM as a reliable anchor.
Recycling breaks that continuity. A reassigned number can still carry residual links to its previous owner. Bank alerts, login codes, stray notifications. The court treated that as a privacy breach, not a technical glitch.
That interpretation reframes risk. It is no longer about isolated incidents. It is about a structural weakness in how identity has been layered onto telecom infrastructure.
Consent Is Now a Process, Not a Checkbox
The ruling introduces a stricter lifecycle for SIM cards. Operators must obtain informed and verifiable consent before reassigning a number. If a subscriber cannot be reached, the burden does not end there. The operator must demonstrate that all reasonable methods were used, including public notices.
This is not a small adjustment. It requires systems that can track outreach attempts, log responses, and store evidence. A dormant SIM now triggers a chain of actions rather than a countdown to deactivation.
There is also the requirement for what the court effectively describes as a “technical purge.” Before any reassignment, operators must ensure that no residual data flows to the new user. That includes financial alerts and authentication messages.
Failure carries weight. The Office of the Data Protection Commissioner can impose penalties of up to KES 5 million or 1% of annual turnover, whichever is lower. Civil claims add another layer. Courts have already awarded more than KES 30 million in damages for privacy violations in 2025. The threshold for liability is now easier to meet.
The Cost Problem That Doesn’t Go Away
Inactive SIMs are not free to maintain. Each one occupies space in routing tables and subscriber databases. Multiply that across millions of lines and the load becomes visible.
Recycling kept that load in check. Without it, the volume of dormant entries grows. Operators must expand storage, maintain indexing systems, and keep records ready for compliance checks.
Revenue does not follow the same trajectory. A dormant line generates nothing. Services such as Safaricom’s Daima, priced at KES 200 for 6 months, KES 500 for 1 year, and KES 1,000 for 2 years, attempted to bridge that gap. The legal footing of such services now looks uncertain. If a number is tied to a right, charging to preserve it invites scrutiny.
The imbalance sits in plain view. Costs accumulate. Income does not keep pace.
Privacy Engineering Moves From Theory to Deadline
Operators have not waited for formal regulations. Safaricom begins rolling out number masking on March 24, 2026 for peer-to-peer M-Pesa transactions. Parts of the sender’s number will be hidden in SMS alerts. By the end of 2026, the same approach extends to merchant payments and bank transfers.
The intent is straightforward. Reduce exposure of personal identifiers in routine transactions. Cut off a common route for spam and social engineering.
There are trade-offs. Small merchants using Pochi La Biashara or basic till numbers lose a quick way to verify payments. Safaricom’s workaround involves forwarding a transaction SMS to 334, which then prompts the sender to approve sharing their details. If the sender declines, the merchant has limited recourse at the point of sale.
This is how privacy engineering tends to unfold. One risk is reduced. Another friction point appears.
Airtel’s Technical Route to Compliance
Airtel’s response leans on architecture. Its mobile money platform moved to a microservices model in early 2026. That allows segments of user data to be isolated from the core SIM layer.
In practice, this makes the required “technical purge” more feasible. Data linked to Airtel Money or third-party services can be separated and cleared without disrupting network signaling. It is not a perfect solution, but it aligns with the court’s demand for clean separation before any reassignment.
Airtel is also pushing new number ranges. The 0100, 0101, and 0102 prefixes provide fresh inventory that avoids the complications of recycling older numbers. It is a pragmatic move. If reclaiming dormant lines becomes legally complex, issuing new ones is simpler.
Scarcity Moves From Theory to Constraint
Numbering plans have limits. Kenya has managed this through recycling and expansion of prefixes over time. The ruling constrains one of those levers.
If more numbers remain parked for longer periods, availability tightens. Demand does not slow. New users continue to enter the system. Existing users often hold multiple lines.
Regulators now face a familiar set of choices. Expand number ranges again. Introduce alternative identifiers. Tighten rules on multiple SIM ownership. None of these options is frictionless.
The timeline is tight. The Attorney General and the Communications Authority have until September 19, 2026 to put a formal framework in place. That is 6 months to translate a court ruling into operational rules for an entire sector.
The Broader Compliance Net Tightens
The ruling does not exist in isolation. Since January 1, 2026, telecom systems classified as critical infrastructure must use licensed digital certificates. Failure to secure these systems can lead to suspension of operating licenses.
Alongside that, the Communications Authority maintains a national database of tax-compliant devices. Phones that fall outside this system can be gray-listed and eventually blacklisted if taxes are not regularized.
These layers add up. SIM management, device compliance, data protection. Each comes with its own requirements. Together, they form a tighter regulatory environment that leaves less room for informal workarounds.
A Different Kind of Customer Relationship
The practical effect of the ruling extends to how subscribers interact with their operators. By September 2026, it is plausible that telco apps will include dashboards showing which services are linked to a SIM. Consent may become something users manage actively rather than grant once and forget.
Account recovery flows across platforms such as email and social media also stand to become more stable. If numbers are no longer recycled without strict conditions, the risk of a new user inheriting access pathways diminishes.
There is a subtle change in perception here. The SIM begins to look less like a service and more like a long-term identifier. That alters expectations on both sides.
The Tension That Remains
The court has drawn a firm line on privacy and identity. The network still operates under physical and economic constraints. Those two realities do not align neatly.
Operators can build new systems, expand capacity, and adjust pricing. Regulators can refine rules and extend numbering plans. None of that removes the underlying tension between permanence and scale.
What used to be a background process is now visible. A phone number carries more weight than it did a decade ago. The infrastructure is catching up, under pressure, with no simple endpoint.
Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.
Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to editorial@techtrendsmedia.co.ke
