Going to a cybercafé after August 14? Here’s what will change

Kenyans who rely on cybercafés for internet access, printing, scanning, online applications and other digital services will soon encounter a different experience when they walk into these facilities.

Beginning Friday, August 14, the Communications Authority of Kenya (CA) will require all licensed public communication access centres to keep basic customer session records as part of newly gazetted licensing conditions.

The changes mark one of the clearest shifts in how public internet facilities are regulated in Kenya, with operators now expected to maintain systems that can identify who used a terminal and when.

Under the new rules, cybercafé operators will be required to establish customer registration systems using identifying details.

The CA has not said that personal browsing history should be collected, but it wants operators to be able to link a customer to a specific session on a specific computer.

For many users, this means the anonymous walk-in experience that has traditionally characterised cybercafés is likely to become less common.

The authority says operators must maintain customer session logs that capture:

• The terminal or computer ID assigned to the customer

• The start time of the session

• The end time of the session

The CA has emphasised that personal browsing history will not be included in these logs. In other words, operators are not being directed to keep a record of the websites a customer visits during the session.

One of the most significant changes is the retention period. Cybercafés and other affected facilities will be required to keep records relevant to compliance with the directive for at least three years.

That creates a longer paper trail than many small cybercafés have traditionally maintained, and it may require some operators to invest in digital record-management systems.

The new licensing conditions extend beyond the neighbourhood cybercafé. They also apply to:

• Telephone bureaus

• Community payphones

• Other public communication services designated by the CA

This means a broader range of businesses that provide public access to communication services will fall under the same compliance framework.

The CA says the measures are intended to address concerns that public internet facilities can be used to facilitate cybercrime, including:

• Identity theft

• Document forgery

• Online fraud

• Other digital offences

Kenya has experienced a rise in cyber-related crimes in recent years, and regulators have increasingly focused on points where users access shared digital infrastructure.

The new conditions are not limited to monitoring requirements. Operators will also be expected to improve customer service and transparency.

Cybercafés must:

• Display their prices prominently

• Issue receipts for paid services

For customers, this could reduce disputes over charges for printing, photocopying, scanning or internet usage.

Operators will be required to establish mechanisms for handling customer complaints and feedback and to notify users when there are service disruptions.

Public communication centres must also put in place content-filtering measures aimed at preventing access to harmful or illegal material and comply with online safety guidelines issued by the regulator.

The CA will have powers to:

• Request records and reports from operators

• Access premises, systems and equipment

• Conduct inspections, audits and investigations

This gives the regulator a more direct oversight role than many cybercafé businesses have previously experienced.

Businesses that fail to meet the new licensing conditions could face suspension of their services after being notified of the breach and given time to correct the problem.

For smaller operators, compliance may involve additional administrative work, staff training and investment in approved communications equipment and authorised internet connectivity providers.

For most customers, the practical changes after August 14 are likely to be:

1. Providing identifying information before using a computer.

2. Having their session linked to a specific terminal and time period.

3. Receiving clearer pricing information and receipts for services.

4. Using facilities that may have stricter content controls and operational procedures.

The CA maintains that the rules are focused on basic usage logging rather than surveillance of personal browsing activity.