OPINION: World Social Media Day: Are We Telling Stories That Matter?

World Social Media Day prompts a critical examination of Kenya's evolving legal framework governing online expression. While the Constitution guarantees freedom of expression, this right is balanced against laws addressing cybercrimes, data protection, and defamation. Recent judicial pronouncements, particularly the Court of Appeal's striking down of certain 'false publication' provisions in the Computer Misuse and Cybercrimes Act, underscore the ongoing tension between regulating harmful online content and safeguarding fundamental freedoms. Legal professionals must navigate this dynamic landscape, advising clients on compliance with data privacy obligations, defamation risks, and the nuances of cybercrime legislation, all while anticipating further legislative and judicial developments.

World Social Media Day serves as a timely reminder to reflect on the profound impact of digital platforms on society and, crucially, on the legal landscape. In Kenya, the rapid proliferation of social media has transformed communication, commerce, and civic engagement, creating both unprecedented opportunities and complex legal challenges. The question, 'Are We Telling Stories That Matter?' extends beyond mere content to encompass the legal responsibilities and liabilities associated with digital narratives. This article delves into Kenya's legal and regulatory responses to the disruptive innovations of social media, highlighting the intricate balance between fostering a vibrant digital space and mitigating its inherent risks.

Kenya's legal framework for social media is primarily anchored in the Constitution of Kenya, 2010, which enshrines fundamental rights such as freedom of expression (Article 33) and the right to privacy (Article 31). However, these rights are not absolute and are subject to limitations, particularly concerning incitement to violence, hate speech, and advocacy of hatred. Complementing the constitutional provisions are several key statutes. The Computer Misuse and Cybercrimes Act, 2018 (CMCA), enacted to combat various online offenses, has been a cornerstone of cyber regulation, criminalizing acts like cyber harassment, false publication of data, and identity theft. The Data Protection Act, 2019 (DPA), gives effect to the constitutional right to privacy by regulating the collection, processing, storage, and sharing of personal data. Furthermore, the Defamation Act (Cap. 36) provides civil remedies for reputational harm caused by false statements, including those disseminated online. The National Cohesion and Integration Act, 2008 (NCIC Act), specifically addresses hate speech, a pervasive concern amplified by social media. These statutes are overseen by regulatory bodies such as the Communications Authority of Kenya (CAK) and the Office of the Data Protection Commissioner (ODPC), which play crucial roles in enforcement and policy formulation.

The application of these laws to social media has been a dynamic and often contentious area. The CMCA, for instance, has been central to prosecuting online offenses. However, its provisions on 'false publications' have faced significant legal challenges. On March 6, 2026, the Kenyan Court of Appeal, in a landmark decision following a petition by the Bloggers Association of Kenya (BAKE), declared Sections 22 and 23 of the CMCA, which criminalized publishing 'false' or misleading information, unconstitutional. The Court found these provisions overly broad and vague, posing an unjustifiable limitation on freedom of expression and media freedom. This ruling is critical, as it recognizes the difficulty of determining absolute truth in the fast-paced digital environment and shifts responsibility for addressing misinformation towards platform governance and moderation policies. Separately, Sections 27(1)(b), (c), and (2) of the CMCA, pertaining to cyber harassment and false information causing public panic, were suspended by the High Court on October 22, 2025, pending a constitutional petition, further illustrating the judiciary's role in refining cybercrime legislation.

In the realm of civil liability, online defamation remains a significant concern. Kenyan courts have consistently applied the principles of the Defamation Act to social media posts, recognizing that online statements can inflict substantial harm to an individual's or entity's reputation. Cases such as *Nation Media Group Limited v Alfred N Mutua* affirmed that the law of defamation protects reputation against false publications, a principle equally applicable to online content. More recently, in *Dasani v Ochieng [2025] KEHC 3776 (KLR)*, the High Court awarded KSh 20 million for defamatory Facebook posts and WhatsApp screenshots, underscoring the severe financial implications of online slander and highlighting social media's global accessibility and permanence. This is particularly relevant given that criminal defamation was declared unconstitutional in *Jacqueline Okuta & Another v Attorney General [2017] eKLR*, shifting the focus to civil remedies and other cybercrime provisions.

The Data Protection Act, 2019, has introduced stringent obligations for content creators and platforms. It mandates explicit, informed consent before processing personal data, including images or videos of non-participating individuals. The Office of the Data Protection Commissioner (ODPC) actively enforces these provisions, with a reported 96 complaints determined and 76 fines issued in 2025, some reaching KES 1.5 million. This highlights the need for meticulous compliance, especially for businesses engaged in direct marketing or content creation. Furthermore, the proposed Kenya Information and Communication (Amendment) Bill, 2019, often dubbed the 'Social Media Bill,' sought to introduce mandatory licensing for bloggers and social media platforms, along with user obligations. However, this Bill faced strong opposition for infringing on freedom of expression and privacy, with the Parliamentary Departmental Committee on Communication, Information and Innovation agreeing that its provisions contravened the Constitution and were largely superseded by the DPA. This demonstrates a critical legislative awareness of the need to balance regulation with constitutional rights.

The legal landscape surrounding social media in Kenya is in a constant state of flux, characterized by a delicate interplay between constitutional rights, statutory provisions, and judicial interpretation. While the recent Court of Appeal decision on the CMCA offers a significant victory for freedom of expression, legal practitioners must remain vigilant regarding other existing and evolving regulations, including the DPA, Defamation Act, and NCIC Act. The emphasis on data privacy and the potential for substantial damages in defamation cases underscore the need for proactive legal advice and robust compliance strategies. As digital platforms continue to evolve, legal professionals are tasked with guiding clients through this complex terrain, ensuring that 'stories that matter' are told responsibly, ethically, and within the bounds of the law, while advocating for a regulatory environment that fosters innovation without stifling fundamental freedoms. Continuous engagement with legislative developments and judicial precedents will be paramount for effective practice in this critical area.