Kenya’s proposed rules could change how telcos decide when your number is truly yours no longer
Kenya is proposing new safeguards for mobile number recycling, changing how telecommunications operators deactivate and reassign numbers that have gone unused.
The Communications Authority of Kenya (CA) draft framework introduces a longer, documented process before an inactive number can be recycled. It also requires operators to separate a previous subscriber’s personal data, services and marketing permissions from the number before it is assigned to someone else.
The proposal comes after a March 2026 High Court judgment that recognised a registered mobile telephone number as a digital identifier capable of linking an individual to information about their private affairs.
The CA is not proposing an end to number recycling. Kenya has a finite pool of numbering resources, and inactive numbers eventually need to return to circulation. The question is what must happen before that transition takes place, particularly when a number has accumulated connections to banking, mobile money, government services and online accounts.
The court ruling that changed how Kenya treats a phone number
The legal backdrop is a judgment delivered on March 19, 2026, in Erastus Ngura Odhiambo vs State Law, Constitutional Petition No. E290 of 2024.
The case challenged the reassignment and recycling of previously registered mobile numbers after prolonged inactivity. The petitioners argued that a registered number had become part of an individual’s digital identity and could connect that person to sensitive personal information.
The High Court agreed that a registered mobile telephone number constitutes a digital identifier linked to personal data relating to an individual’s private affairs and is therefore protected under Article 31(c) and (d) of the Constitution.
The court consequently directed the Office of the Attorney General to take measures within six months to safeguard the digital identity associated with a registered mobile number against unfettered deactivation and arbitrary reassignment or recycling.
That deadline falls on September 19, 2026, which is also the effective date stated in the CA’s draft document.
The distinction matters. A mobile number can stop generating activity on a telecom network while remaining active elsewhere as a recovery number, authentication channel, mobile money identifier or contact point for financial and government services.
In other words, telecom inactivity does not necessarily mean digital abandonment.
Six months of inactivity could now precede number recycling
Under the proposed framework, the process begins after a number records three consecutive months without revenue-generating activity.
The CA defines that activity to include making or receiving calls, sending or receiving SMS, using data, topping up airtime or using the number for a value-added service.
That means passive dependence on a number does not itself count as activity. A number sitting quietly on an online account, receiving authentication messages or remaining associated with a service may therefore still be vulnerable if the subscriber is not performing one of the activities recognised by the framework. TechWeez similarly highlights the distinction between telecom activity and passive uses such as OTP receipt or account recovery.
Once the three-month inactivity threshold is reached, the operator must begin efforts to notify the subscriber using contact information collected during KYC registration.
Notification continues for another three months unless the subscriber reactivates the number through qualifying activity.
Thirty days before that second three-month period expires, the operator must publish a list of numbers susceptible to deactivation and recycling. The framework also requires operators to publish a generic intention notice through their websites, other media and a daily nationwide newspaper on a quarterly basis.
Subscribers will be able to check the status of a number through *106#, with the status indicating whether it is active, suspended, under recycling or deactivated.
This is an important distinction from the shorthand description that an inactive number will simply be deactivated after three months. Three months is the trigger for the process, not necessarily the point at which the number reaches a new subscriber.
The proposed framework builds in another period of notification, public notice and an opportunity for the original subscriber to reactivate the number before recycling can proceed.
The real risk begins when a recycled number changes hands
The most consequential part of the proposal may happen after the number has been cleared for recycling.
Before making it available to a new subscriber, the operator must delink and securely archive the previous owner’s personal data, cached data and services associated with the number.
The objective is straightforward: the new subscriber should not inherit the previous owner’s digital footprint simply because they received the same number.
That matters because a number can remain connected to a bank account, mobile money service, loan account, government platform, email recovery system, social media account or other online service long after the original subscriber stops using it on the telecom network.
A recycled number therefore creates a handover problem that extends beyond the SIM card.
If a bank still treats the number as belonging to the previous customer, for example, a new subscriber could receive communications intended for that customer. If a platform still uses the number for account recovery, the consequences could be more serious.
This is why the CA’s requirement goes beyond deactivating the old SIM. The operator must separate the number from the information and services that belonged to its previous owner.
Telcos will have to build for the process, not simply announce it
The safeguards also create a substantial operational obligation for mobile operators.
Telcos will need systems capable of identifying the qualifying activity that determines whether a number has become inactive, triggering notification processes, recording attempts to reach subscribers and maintaining evidence that those processes were followed.
The *106# status mechanism also needs to reflect the actual state of a number throughout the process.
The more difficult task may be what happens around the number rather than inside the operator’s network. A number can function as a login credential, recovery channel, mobile money identifier or authentication mechanism across multiple services. Disconnecting those relationships requires more than switching off a SIM.
The CA also requires operators to retain records of their efforts to contact subscribers in accordance with the Data Protection Act, 2019. They must retain USSD consent records for B2C communications throughout the period a number remains active.
That means the framework introduces an evidence and record-management burden alongside the technical deactivation process.
For operators handling millions of numbers, the challenge is not simply storing data. They will need to be able to establish what happened to a particular number, when the inactivity process began, how the subscriber was contacted, what consent existed and what was removed before the number was recycled.
Telcos will not be the only ones with work to do
The CA’s proposed centralised system is particularly important because the problem does not end inside the telecom network.
After numbers are deactivated or recycled, operators will submit quarterly lists to a centralised system. The system is intended to help third parties update their records before making calls or sending messages concerning obligations associated with those numbers.
That potentially brings banks, lenders, government agencies and other organisations into the recycling process.
The logic is important. A telco can securely separate its own systems from the previous subscriber, but it cannot independently rewrite every database in which that number appears.
The centralised system is therefore intended to address the wider ecosystem problem: making it easier for organisations outside the telecom network to recognise that the number no longer belongs to the person they previously associated it with.
The system will not necessarily be operational on the day the wider framework takes effect. TechCabal reports that the CA says the relevant requirements will apply once the centralised system has been established.
That creates another implementation question: how will banks, fintechs, government agencies and other services manage recycled numbers during the period before the centralised system is fully operational?
For organisations that rely heavily on phone numbers for authentication, the issue deserves particular attention. A recycled number should not automatically become a substitute identity for an old customer simply because the telecom operator has issued it to someone new.
New subscribers will not inherit old marketing consent
The CA’s proposal also changes what happens to marketing permissions attached to a number.
Newly issued and recycled numbers will not receive B2C marketing messages from the issuing provider or third parties by default.
Where a business wants to send B2C messages, the subscriber must provide explicit consent through a USSD process specific to that business.
One company’s consent will not automatically authorise messages from every other business.
The operator must retain records of that consent for the entire period that the number remains active. Before deactivation and recycling, the previous subscriber’s B2C marketing permissions must be delinked from the number.
This is an important privacy safeguard because consent does not automatically transfer simply because a telephone number does.
A person who receives a recycled number should not inherit the previous subscriber’s marketing relationships, just as they should not inherit their banking alerts, service accounts or private data.
Prisoners and incapacitated subscribers get a route to protection
The draft also recognises that prolonged inactivity can happen without abandonment.
The Commissioner General of Prisons can facilitate whitelisting for people serving prison sentences of more than six months, as well as certain suspects expected to remain in remand for more than six months.
The framework also allows another person, including a caregiver, to request whitelisting where a subscriber is indisposed and unable to use their number for an extended period.
That protection is available for one year at a time and can be renewed with updated information while the circumstances continue.
The provision matters because it directly challenges the assumption that silence means surrender.
A prisoner may not be able to use a phone in the same way as someone outside prison. A medically incapacitated person may be physically unable to use a number. Neither circumstance necessarily means that the person has abandoned the digital identity associated with it.
The High Court case itself arose partly from concerns around prisoners losing their digital identity because of prolonged inactivity.
The difficult question is what counts as giving up a number
The CA’s proposal solves one problem by making number recycling more structured, but it leaves an important legal question open.
The High Court’s reasoning places weight on informed and verifiable consent and on documented efforts to establish that the original owner can no longer be located or has unequivocally relinquished their rights.
The CA framework, meanwhile, establishes a process built around inactivity, notification, public notice and an opportunity to reactivate the number.
The two approaches are related, but they are not identical.
What happens when the original subscriber never responds?
Is failure to respond after the prescribed notices sufficient evidence of abandonment? Does public notification satisfy the requirement for informed and verifiable consent? How should the system deal with people who are unaware of the notices but still rely on the number elsewhere?
Those questions become more important as mobile numbers become embedded in financial services, authentication and digital identity.
The framework also makes clear that recycling itself remains necessary. Kenya cannot indefinitely quarantine every inactive number because the country’s numbering resources are finite. The regulatory challenge is therefore not to eliminate recycling but to make the transition safer.
The real test will be whether the safeguards can establish that a number is genuinely ready to change hands without allowing the previous owner’s digital identity to follow it.
That makes the CA proposal more than a telecom housekeeping exercise. It is an attempt to reconcile two realities: Kenya needs to reuse a finite numbering resource, while the same number may carry years of digital relationships that do not disappear when its owner stops making calls.
A recycled number may be new to its next subscriber. The digital history attached to it is not.
The success of the framework will ultimately depend on whether Kenya can make those two things truly separate before the number changes hands.
Real ESG impact doesn’t happen in panels alone, it happens in the rooms where financiers, operators, and policymakers actually align. Our GreenShift Forum 2026 cuts the noise, bringing together the people rewiring Africa’s sustainability and energy frameworks for one focused day in Nairobi. Secure your seat.
Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.
Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to editorial@techtrendsmedia.co.ke
