Kitany’s Internet-Meter Bill Leaves Kenya Guessing What, Exactly, Will Be Measured.

Marianne Kitany's four-clause proposal would identify every internet customer, monitor usage and produce consumption-based invoices. It leaves pricing, privacy, enforcement, and implementation to inference.

Kenya's proposed internet-meter law is four clauses long. The operative one, inserted into section 27A of the Kenya Information and Communications Act by the Amendment Bill, 2025, reads:

"(3C) An internet service provider shall operate a meter billing system which shall — (a) assign to each customer a unique and identifiable meter number; (b) monitor customer usage; (c) convert customer usage into readable details; (d) create invoices based on consumption; and (e) allow for user verification of invoices."

A second subsection requires providers to submit information on the billing system to the Communications Authority at least annually, "including internet meter numbers issued to subscribers." A third preserves existing licenses until expiry.

The Bill does not define "meter", "customer usage", "readable details", "consumption" or "user verification". It sets no unit of measurement, no pricing formula, no accuracy standard and no commencement date. A short Bill is not necessarily a poor one. This one is short precisely where precision matters.

The problem it does not solve.

Kitany's public defence begins with a grievance many Kenyans share. When criticism erupted in May 2025, the Aldai MP described a customer who buys a time-limited bundle and fails to exhaust it before it expires. The remainder, she argued, should carry forward. "I am saving this Kenyan from being exploited by the ISP," she said.

The Bill does not require providers to roll over unused data. It does not prohibit bundle expiry, mandate refunds, prescribe a minimum validity period, or address unused prepaid balances at all.

A dispute about expiring mobile bundles has become a proposed billing architecture for internet services generally, and the memorandum does not explain the expansion. It invokes Article 46 of the Constitution, promises to mitigate exploitation, and says billing metrics should correspond with the value customers receive. The operative clauses create no measure of value. They provide for usage, consumption, invoices, and identifiers.

What "based on consumption" does not settle.

Clause 3 requires invoices "based on consumption." That points towards consumption-linked pricing without establishing it.

The Bill prescribes no price per gigabyte, does not say the amount payable must rise with each unit consumed, does not prohibit flat-rate, speed-based or unlimited packages, and does not say whether a fixed access charge may sit alongside usage charges. A narrow reading preserves unlimited packages provided usage is measured and displayed. A stricter reading requires the price itself to vary with consumption, which would make most current fixed-broadband packages non-compliant.

Operators, the regulator, and eventually the courts are left to decide what Parliament meant. Providers cannot design products, price infrastructure, or sign long-term contracts while the legality of a common billing model is unresolved. Prepaid creates a further gap, since the Bill refers throughout to invoices without explaining how bundles, hourly packages, and top-ups produce one.

A gigabyte is not a kilowatt-hour.

The utility analogy is easy to grasp. A meter counts units, and the customer pays for what is consumed. Broadband economics work differently. Most ISP costs are incurred before a customer downloads a single byte. These include fibre deployment, spectrum or wholesale capacity, poles and ducts, routers, power, financing and support. The cost of carrying one additional gigabyte is usually modest until traffic creates congestion or requires a capacity upgrade. Even then, scarcity depends on place and time. Data moving overnight through spare capacity does not burden a network in the same way as an equal volume crossing an overloaded neighborhood link at eight in the evening. The OECD’s analysis of fixed networks found no linear relationship between data consumption and the cost of providing fixed broadband.

A subscriber also buys more than bytes. The monthly fee purchases availability, speed and the freedom to use a connection without costing every video call, and a volume meter cannot say which traffic was actively requested or how much value a household received.

Flat pricing supplies certainty. A household knows its maximum bill, a school can budget for online learning, and a small business can use cloud services without discovering at month-end that productive work generated an unaffordable invoice. That certainty matters most to the 18.1 million Kenyans in informal employment, roughly 83.8 percent of all jobs, who are paid when a fare is completed rather than on the twenty-fifth.

Where the clause has been put.

Section 27A is titled "Duties of telecommunications operators". Its opening subsections require operators to collect a customer's full name, identity-card number, date of birth, gender and addresses before providing service, and to hold them confidentially. Subsection (3) then permits disclosure of a subscriber's registration particulars for the Authority's statutory functions, for criminal investigations, and for proceedings under the Act.

That is the section into which metering would be inserted. Not the tariff provisions, not a consumer-protection part, but the subscriber-identity section, three subsections below a standing disclosure gateway. Clause 2 reinforces the point by amending the Act-wide definition of "telecommunication operator" to include internet service providers, which removes any doubt that a meter number can sit beside a statutory record containing a name, an identity number and an address.

The Bill then declines to define "internet service provider" at all. On the face of the amended definition, a hotel offering guest WiFi, a landlord reselling bandwidth, a café, a school or a satellite operator serving Kenyan customers would each be required to run a meter billing system and issue identifiable numbers.

Neither panic nor complacency.

A meter number is not an IP address or a tracking code sent to every website a person visits. It identifies an account, and a family, office, café or apartment block may sit behind one subscription, so meter ownership does not establish who did anything. Claims that the Bill hands the State every subscriber's browsing history go beyond the text: Clause 3D requires annual information about billing systems, not URLs, message content or application histories. Standard network accounting already counts session duration and bytes entering and leaving an account, and deep-packet inspection becomes relevant only if "readable details" is read to include applications or destinations. The Bill neither requires that reading nor forbids it.

The meter number is not a wiretap. It is a database key. The risk begins if that key is allowed to unlock more than a bill, and the Bill sets no purpose limitation, retention period, access rule, security standard or prohibition on linking meter numbers to other datasets.

The memorandum states that the Bill "does not delegate legislative powers nor does it limit fundamental rights and freedoms". That declaration has a procedural consequence: Article 24 requires a limitation of rights to be justified as reasonable in an open and democratic society, weighing purpose, extent and less restrictive alternatives, and a bill that limits no rights is never put to that test. In April 2024 the High Court held mandatory collection of device IMEI numbers unconstitutional, finding such identifiers to be personal data engaging Article 31. A mandatory internet identifier belongs to the same class, and the memorandum answers the question in six words.

A penalty before a standard.

The new duties would enter section 27A immediately above its enforcement provision, which makes contravention of the section an offence carrying a fine not exceeding KSh5 million. On an ordinary reading, a provider that fails to operate a compliant meter billing system would be exposed to it.

The Bill does not say whether the fine applies per system, per reporting failure, per billing period or per subscriber, and provides no warning process, cure period or protection for a provider disputing the regulator's construction of an undefined term. Clause 4 preserves existing licences until expiry but grants no equivalent transition for the metering duties and requires no technical regulations before enforcement. Providers would face criminal liability for failing a standard that has not been written.

Those costs fall unevenly. Kenya had 2,656,653 fixed-internet subscriptions in March 2026, with Safaricom on 35.4 percent, Jamii Telecommunications 19.5 percent, Wananchi 10.4 percent, and Poa Internet 9.7 percent, the four largest holding 75 percent between them. Invoice-grade metering, system integration, customer portals and regulatory reporting are fixed costs that large operators spread across hundreds of thousands of accounts and small, rural and community providers cannot. A mandate framed as discipline for dominant providers could entrench them.

The Bill Parliament should write

Kitany's underlying principle is sound. Customers deserve to know what they bought, what they used and whether the provider delivered what it promised. Four changes would deliver that. Address expiry directly, through minimum validity periods, rollover, or refunds, which is the problem the sponsor actually described. Preserve tariff choice, leaving unlimited, speed-based, capped, prepaid and consumption-based packages lawful. Define the measurement so that "usage" means aggregate upload and download volumes and not websites, applications, destinations or content. And require a standard broadband label disclosing price, expected speed, allowance, fair-use limits and overage charges in a comparable format.

Transparency is a disclosure rule. Metering is a measurement method. Consumption billing is a pricing model. The Bill treats all three as interchangeable.

Being heard.

The Bill sits with the National Assembly's Departmental Committee on Communication, Information and Innovation, which has invited memoranda under Article 118 and Standing Order 127(3). Committee stage is where a private member's bill is most amenable to change, and a submission addressing the drafting has more purchase than one addressing the motive. Written views, giving the name and contact details of the person or organisation, go to the Clerk of the National Assembly, Main Parliament Buildings, Nairobi, marked for the committee. Confirm the closing date at parliament.go.ke.

The question before the committee.

Nothing in the record suggests that Marianne Kitany intends to build a surveillance system. Her stated concern is a customer whose bundle expires unused, and that customer exists in their millions.

Intent is not the variable that matters. The Device Management System was intended to find counterfeit handsets, and the High Court found it would reach call data records. Laws are not read by the people who wrote them. They are read, years later, by officials the drafter never met, under pressures the drafter did not anticipate, using infrastructure the drafter built and did not fence.

What Parliament is being asked to create is a compulsory, permanent, unique identifier for every internet customer in Kenya, reported annually to a regulator that has twice been found by the High Court to have overreached on identifiers, held by providers whose disclosure practices are the subject of a pending petition by the Law Society, in a country where 82 people were recorded as abducted or disappeared in seven months, and supervised by a data-protection office that did not investigate when it was asked to. The election is next August.

Against all of that, the Bill offers a single sentence of assurance: that it does not limit fundamental rights and freedoms. That assurance has not been tested against Article 24, because declaring that no right is limited is what avoids the test.

Kenya needs a law that audits the provider without turning the subscriber into the object of the audit. This one, as drafted, cannot tell the difference.