Kenya’s proposed rules could change how telcos decide when your number is truly yours no longer

Kenya is proposing new safeguards for mobile number recycling, setting out a longer process for deactivating inactive numbers and new requirements for protecting the personal information associated with them.

The Communications Authority of Kenya (CA) has published draft procedural and technical safeguards for public consultation, responding to a High Court ruling that recognised a registered mobile number as more than a communications resource: it can also function as a digital identifier tied to a person’s private information.

The proposed framework addresses what should happen before an inactive number is returned to the pool and issued to someone else. It covers notification, public notice, data separation, third-party records, marketing consent and special circumstances in which a subscriber may need to keep a number from being recycled.

The timing is significant. The High Court judgment in Erastus Ngura Odhiambo vs State Law, delivered by Justice Lawrence N. Mugambi on March 19, 2026, gave the Office of the Attorney General six months to take appropriate measures to protect the digital identity associated with registered mobile numbers from unfettered deactivation and arbitrary reassignment.

The CA’s draft document carries an effective date of September 19, 2026, exactly six months after that judgment. Because the document is currently a proposed framework under consultation, however, its provisions should be understood as the Authority’s proposed approach rather than final rules.

The court ruling that changed how Kenya treats a phone number

The underlying court case exposed a problem that is easy to miss when a mobile number is treated simply as a line that has stopped being used.

The petition concerned the deactivation and subsequent reassignment of previously registered mobile numbers after extended periods of inactivity. The petitioners argued that a registered number can become closely connected to a person’s digital identity, linking them to services and information that go well beyond voice calls and text messages.

The High Court agreed with the broader privacy concern. It found that a registered mobile telephone number constitutes a digital identifier capable of linking personal data relating to an individual’s private affairs, bringing it within the protection of Article 31(c) and (d) of the Constitution.

That finding changes the regulatory question. Once a number can serve as a key connecting point between an individual and their private information, recycling it is no longer only a matter of making efficient use of scarce numbering resources.

There is a second person involved: the new subscriber who eventually receives the number.

A recycled number can still be associated with accounts, databases, messaging lists and services belonging to its previous owner. The risk is that information intended for one person follows the number to another person, either directly through a service or indirectly through a database that has not been updated.

The court therefore required safeguards around deactivation and reassignment, including informed and verifiable consent where applicable, reasonable notice and technical measures to prevent unauthorised exposure or transfer of personal information.

Six months of inactivity could now precede number recycling

The CA’s proposed process gives subscribers considerably more time before an inactive number can reach the recycling stage.

Under the draft, the process begins when a number records no revenue-generating activity for three months. The activities listed include making or receiving a call, sending or receiving an SMS, using mobile data, topping up airtime or using the number for a value-added service.

Once that period has elapsed, the service provider is required to make efforts to notify the subscriber using the contact information contained in its KYC records. That can include sending an SMS to the number as well as using other available contact details.

The notification process continues for another three months unless the subscriber resumes revenue-generating activity.

Thirty days before that additional three-month period ends, the provider is expected to publish a list of numbers that are susceptible to deactivation and recycling. The affected numbers would then have 30 days from publication to be activated.

Providers would also be required to publish a generic notice of their intention to deactivate and recycle numbers on their websites, publicise the notice through other media and publish it in a daily nationwide newspaper on a quarterly basis.

The proposed process therefore creates several opportunities for a subscriber to intervene before a number is finally released. It also introduces a degree of public visibility into a process that has traditionally been largely administrative and provider-driven.

The CA proposes that subscribers be able to use *106# to check the status of a number, including whether it is active, suspended, under recycling or deactivated.

The real risk begins when a recycled number changes hands

The most consequential part of the proposed framework may come after the old subscriber has lost the number.

The CA says providers must delink and securely archive the previous owner’s personal data, cached data and services before the number is made available to another subscriber. Information that must be retained under law would remain subject to the applicable retention requirements, but it should not be accessible to or inherited by the person who receives the recycled number.

That distinction matters because a number can remain embedded in systems long after a subscriber stops actively using it.

A bank may have it on file. A mobile money service may have it associated with an account. A government platform may have retained it as a contact detail. Businesses may have stored it in customer databases. Online services may still recognise it as part of an account recovery process.

The new subscriber does not acquire those relationships simply by receiving the number.

The proposed safeguards recognise that technical separation therefore has to happen across more than the telecom operator’s own network.

The CA also proposes a centralised system containing lists of deactivated and recycled numbers. Providers would submit quarterly lists to the system, which would be used by third parties to update their records before sending calls or SMS messages concerning obligations associated with a number.

That is an important addition because a telecom operator can protect information within its own systems while having limited control over what an unrelated organisation does with an outdated customer record.

Telcos will have to account for what happens outside their networks

Number recycling exposes a weakness in treating telecommunications records as isolated from the wider digital ecosystem.

A telephone number has become a common identifier across different services. When ownership changes, every organisation that still treats that number as belonging to the previous subscriber has a potential data-quality and privacy problem.

The proposed centralised list is intended to create a mechanism for addressing that problem. Instead of expecting every new subscriber to discover and correct the previous owner’s digital footprint, third parties would have a way to identify numbers that have been deactivated or recycled and update their records.

The approach also places a continuing record-keeping obligation on providers. The CA proposes that providers retain records of their efforts to contact subscribers for a period consistent with the Data Protection Act, 2019.

That creates an evidentiary trail around the decision to deactivate a number. If a dispute arises later, the question should not simply be whether the number had been inactive. There should also be a record showing what the provider did to establish that the subscriber had been notified.

New subscribers will not inherit old marketing consent

The draft also addresses a less obvious consequence of recycled numbers: marketing consent.

A new subscriber should not suddenly start receiving promotional messages because the previous owner once opted into them.

Under the proposed technical safeguards, newly issued and recycled numbers would not receive marketing messages from the issuing provider or third parties by default.

For business-to-consumer messaging, the subscriber would have to explicitly dial a USSD code to consent to messages from a specific business. That consent would be business-specific, meaning that approving messages from one company would not amount to consent from every other business.

Providers would also be required to retain records of those USSD consent actions for the entire period that the number remains active.

Before a number is deactivated and recycled, the provider must delink it from B2C messaging services to which the previous subscriber had opted in.

This is a relatively straightforward technical safeguard, but it illustrates the larger principle behind the proposed framework: ownership of a number can change without ownership of the previous subscriber’s digital relationships changing with it.

Prisoners and incapacitated subscribers get a route to protection

The proposed rules also deal directly with situations in which inactivity does not necessarily mean that a subscriber has abandoned a number.

One of the clearest examples is incarceration.

Under the draft, the Commissioner General of Prisons would facilitate the whitelisting of telephone numbers belonging to people serving prison sentences of more than six months, subject to the conditions set out in the framework. A similar mechanism is proposed for suspects denied bail who are expected to remain in remand for more than six months.

The number can then be protected from the normal deactivation process for the relevant period. Once the applicable period ends, it becomes subject to the ordinary process under the draft guidelines.

The provision is closely connected to the circumstances that brought the issue before the High Court. The petitioners argued that prisoners could lose their digital identity simply because circumstances beyond their control prevented them from using their registered numbers.

The proposed framework also recognises people who are unable to use their numbers because they are indisposed.

A person, including a caregiver of an incapacitated subscriber, can notify the provider and seek to have the number whitelisted. The provider must verify the KYC information and supporting documentation before granting the protection, reducing the possibility that someone who is not entitled to the number uses the process to keep it active.

The proposed whitelist would last for one year in such cases and could be renewed annually if updated information is provided and the number remains inactive.

The difficult question is what counts as giving up a number

The CA’s draft addresses much of the practical problem identified by the High Court. It gives providers a longer process, requires multiple forms of notification, creates a public notice mechanism and puts technical safeguards around the transfer of a number to a new subscriber.

But one question deserves particular attention during the consultation: when does inactivity amount to a person giving up their digital identity associated with a number?

The distinction matters because the court’s ruling placed emphasis on informed and verifiable consent and on reasonable safeguards before reassignment. The CA’s proposed process, meanwhile, is built largely around inactivity, attempts at notification and the expiry of prescribed notice periods.

Those mechanisms may ultimately be capable of working together, but the final framework will need to make clear how they do so.

A subscriber who ignores several notifications may reasonably be treated differently from someone whose number has become inactive because they are imprisoned, incapacitated or otherwise unable to respond. The proposed whitelist provisions recognise some of those circumstances, but the broader question remains how a provider establishes that an absent subscriber has actually relinquished a number rather than simply being unreachable.

That is where the consultation becomes important.

The challenge for the regulator is to protect the integrity of Kenya’s numbering system without turning every inactive number into a permanent privacy obligation for telecommunications providers. Numbering resources have to be managed, numbers eventually have to be returned to circulation, and providers need a workable process for doing so.

At the same time, the fact that a person has stopped generating revenue on a number does not necessarily mean that the number has ceased to have value as part of their digital identity.

Kenya’s proposed framework is an attempt to reconcile those two realities. Its strongest provisions are the ones that recognise that recycling a number involves two separate transitions: ending the previous subscriber’s relationship with it and ensuring that the next subscriber does not inherit the previous subscriber’s data, services or permissions.

The final test will be whether the rules can make that separation reliable in practice.

If the framework survives consultation in substantially its proposed form, mobile number recycling in Kenya will become a more deliberate process, with providers expected to demonstrate how they notified subscribers, protect data associated with the old number and account for the number after it enters the recycling system.

The bigger principle established by the court, however, will remain: a phone number may be a telecommunications resource, but once it is registered to an individual and connected to their private information, giving that number to somebody else is also a digital identity question.

Real ESG impact doesn’t happen in panels alone, it happens in the rooms where financiers, operators, and policymakers actually align. Our GreenShift Forum 2026 cuts the noise, bringing together the people rewiring Africa’s sustainability and energy frameworks for one focused day in Nairobi. Secure your seat.

Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.

Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to editorial@techtrendsmedia.co.ke