From 20 September, Uber, Bolt and Glovo must record what is inside your parcel

If you send a parcel through Bolt, Glovo, Little or Uber after 20 September, the app is required to record what is in it, who sent it and who received it. It also has to keep that record and hand it over when a government agency asks.

The requirement comes from new licence conditions issued by the Communications Authority of Kenya (CA), the regulator that licenses telecoms, broadcasting and postal and courier services. Business Daily reported the conditions and quoted the CA document as requiring platforms to keep records of every item they handle and make them available to the Authority “or any competent government agency upon request”.

What the apps have to do

Four things change for the platforms.

They must capture and verify who the sender and the recipient are, rather than accepting an order from an unnamed account.

They must let senders declare what is in the parcel, and let the rider or the receiving courier verify that declaration. Verification happens without opening the package, except where there is “suspicion that the postal courier item contains prohibited goods” or where KRA orders it opened.

They must keep an electronic record of the transaction and produce it on request.

They must display a list of prohibited items on the app and at any physical outlet.

Alongside that comes a consumer side. Platforms have to pay compensation for a lost, delayed or damaged parcel within 90 days of a complaint. They do not have to pay where the item was prohibited, where the contents were not declared when the parcel was accepted, where the recipient has already acknowledged receipt, or where the sender or recipient lied about what was inside. Customers also get real-time tracking and a way to check the identity of the rider carrying their parcel.

Why this is happening now

The CA created a licence category for these companies in July. Until then, Uber, Bolt, Glovo and Little ran their delivery arms on the National Courier Operator licence, the same one used by matatu saccos that move parcels between towns. The revised postal and courier market structure adds a Courier Hailing Service Provider licence for platforms that link customers with courier operators through an app. It runs for 10 years and costs KES 5,000 to apply for, KES 100,000 as an initial fee, then KES 100,000 a year or 0.4% of audited gross annual turnover, whichever is higher, plus a universal service levy of 0.5% of turnover. The National Courier Operator licence it replaces for these firms costs KES 30,000 initially and KES 30,000 a year.

The stated reason for the record-keeping is drugs and guns. That is not new either. Regulation 12 of the 2010 postal and courier regulations already tells licensees to combat postal crimes including illicit drug trafficking and firearms, and regulation 11 already tells them to make senders declare contents before accepting an item. The 2010 rules were written for Posta and for courier desks in bus offices. Nobody was applying them to a Bolt driver carrying a shoebox across Ngong Road.

Bolt’s Kenya support page tells riders not to carry food, alcohol, animals, banknotes, weapons, drugs or goods worth more than KES 15,000. In practice the driver usually has no idea what is in the bag. The new conditions make the platform responsible for knowing, and for keeping proof.

What the CA has not said

Three questions are open, and the CA has not published the licence conditions on the page where it posts this material.

How long the records are kept. Nothing in the reporting gives a retention period.

1. What a police request looks like: The reported wording says agencies can ask. It does not say whether a court order is needed. The Kenya Information and Communications Act separately says postal articles are not to be opened, and provides for interception only in a public emergency.
2. How the Data Protection Act applies: Parcel records tie a name, a phone number, an address and a purchase to a date. Under the 2019 Act, the platforms are data controllers and need a lawful basis for each disclosure. We have written about how thinly Kenyan personal data is already protected in practice, and about the same tension in the cyber café ID rules that took effect this month, where the CA required businesses to collect ID data without the Office of the Data Protection Commissioner saying how to store it.

What it means if you send parcels

Expect to be asked what is in the box, and expect the app to want a verified name and number at both ends. The 90-day compensation rule gives you a claim you did not have before, but only if you declared the contents.

The delivery market is also consolidating while this happens. Uber agreed in July to buy Delivery Hero, which owns Glovo, so two of the four named platforms may end up under one owner. Bolt has been pushing Bolt Send beyond Nairobi since last year. Parliament is separately considering the Competition (Amendment) Bill, 2026, which would give the competition regulator its own control on these platforms.