The threat of a decade behind bars for a forwarded WhatsApp message or a controversial tweet is officially over. On Friday, 6 March 2026, the Court of Appeal delivered a historic, albeit highly nuanced, judgment on Kenya’s digital landscape. A three-judge bench partially overturned a 2020 High Court decision, striking down the heavily weaponised Sections 22 and 23 of the Computer Misuse and Cybercrimes Act (2018).
For the coalition of petitioners; including the Bloggers Association of Kenya (BAKE), Article19 Eastern Africa, the Kenya Union of Journalists, and the Law Society of Kenya, it is a monumental victory for free expression.
But before we declare the Kenyan internet liberated, there is a significant catch. The very same ruling silently cemented the state’s power to harvest real-time data and seize computer equipment.
Here is a critical breakdown of exactly what the Court of Appeal gave Kenyan digital citizens, and what it kept for the state.
Why Sections 22 and 23 Fell
For years, Section 22 (False Publications) and Section 23 (Publication of False Information) have hung over Kenyan content creators, journalists, and activists. These clauses criminalised the sharing of data deemed “false” or “fake news” that could supposedly cause panic or damage reputations.
Justices Patrick O. Kiage, Aggrey Muchelule, and Weldon Kipyegon Korir categorised these sections as constitutional failures. They described the laws as “unguided missiles,” so broad that they could easily ensnare innocent citizens who unknowingly forward false messages.
In a striking defence of free thought, the judges noted the fluidity of truth, pointing out that what is considered “false” today; much like Galileo’s theories of the solar system, might be proven “true” tomorrow. Criminalising falsity, the court ruled, risks silencing legitimate satire, opinion, and standard journalistic errors, directly violating Articles 33 and 34 of the Constitution.
Mercy Mutemi, legal counsel for BAKE, was unequivocal in her response: “We urge the Office of the Director of Public Prosecutions to immediately discharge any Kenyan who has been charged under the now unconstitutional Sections 22 and 23”. Any further prosecution under these clauses is now strictly illegal.
The Catch: Warrants, Surveillance, and the “Gatekeepers”
While the court dismantled the state’s ability to police the truth, it entirely upheld the state’s ability to police you.
The Court of Appeal dismissed the petitioners’ arguments that the investigative procedures outlined in the Act amount to mass surveillance. Consequently, Sections 48 through 53 remain fully intact. This means the police retain the power to:
- Apply for search and seizure warrants for your computer data.
- Force service providers to hand over subscriber information via production orders.
- Conduct real-time collection of your digital data for up to six months.
The judiciary’s safeguard against this? Themselves. The judges argued that because these actions require a court warrant, they are not “unchecked” powers. They emphasised that judges must act as rigorous “gatekeepers” to prevent the police from abusing these tools for political intimidation.
The Internet is Not the Wild West
The ruling also clarified that the internet remains a heavily regulated space. The court upheld several other controversial sections, establishing clear boundaries for online behaviour:
- The Necessity of a “Guilty Mind” (Mens Rea): BAKE argued the law was too vague regarding criminal intent. The court disagreed, ruling that terms like “knowingly” and “intentionally” are sufficient. If you accidentally stumble into a restricted server or file, you are not a criminal; the state must prove you intended to break the law.
- Strict Rules on Cybersquatting (Section 28): Registering someone else’s trademark or name as a domain in bad faith remains a criminal offence. The court explicitly noted that the internet is not a “Wild West,” and digital property rights must be rigorously protected.
- Child Pornography (Section 24): The court maintained strict penalties for child exploitation material, rejecting arguments that the wording was too broad and could unfairly target adult content. The protection of minors outweighed the raised privacy concerns.
What Next? The Ambiguity of Section 27
If you are a content creator, the immediate takeaway is a relief: you will no longer face a prison sentence purely for sharing unverified “fake news.” However, the legal war is entering a new, highly perilous phase.
Demas Kiprono, Executive Director of ICJ Kenya, called the ruling “bittersweet,” specifically pointing to the court’s refusal to strike down Section 27 of the Act.
Section 27 outlines the offence of “Cyber Harassment.” Under this clause, anyone who sends a communication that “detrimentally affects” the recipient or is deemed “grossly offensive” can face a staggering fine of up to 20 million KES, or 10 years in prison, or both.
The danger lies in the ambiguity. What defines “detrimentally affects”? If a tech reviewer publishes a scathing but factual critique of a new startup, and the founder claims the review caused them emotional distress, Section 27 can theoretically be weaponised to arrest the journalist.
With sweeping surveillance clauses intact and the vague, heavy-handed penalties of Section 27 surviving the appeal, BAKE, Article19, and their allies are already reviewing the judgment. The ‘fake news’ battle has been won, but the broader war over the soul of Kenya’s digital civic space is almost certainly heading to the Supreme Court.
