Court Strikes Down Kenya’s Power to Block Websites Without Judicial Approval

Parliament put two routes to restricting an online service in the same cybercrime amendment. One allowed a government committee to direct that a website or application be made inaccessible. The other allowed an authorized person to ask a court to remove material or close a service. On 2 July 2026, the High Court struck down the committee's route and left the court route standing.

Payment providers and online marketplaces also operate through applications. A single app can carry merchants' orders, customers' payments and years of lawful records alongside material that authorities believe is unlawful. A direction against the whole application can interrupt every one of those functions. Under the invalidated provision, the National Computer and Cybercrimes Co-ordination Committee did not have to obtain a court order before issuing that direction.

Justice P.M Nyaundi also struck down an amendment to the cyber-harassment offence concerning communications deemed likely to cause another person to die by suicide. Her ruling did not remove Kenya's entire cybercrime law. Authorities may still investigate online harm and seek access restrictions through the surviving court route.

The committee's power.

The Computer Misuse and Cybercrimes Act dates from 2018. An amendment passed in 2025 added paragraph 6(1)(ja) to the functions of the National Computer and Cybercrimes Co-ordination Committee. It permitted the committee to issue a directive making a website or application inaccessible where it was proved that the service promoted unlawful activity, inappropriate sexual content involving a minor, terrorism, religious extremism or cultism.

The amended text did not say that a judge had to establish that proof before the committee acted. Nor did it set out a prior court process in which the operator of a site could contest the proposed block. Several of its triggers, including unlawful activities and cultism, did not identify a particular offence in the paragraph itself. The remedy applied to the website or application, not necessarily to the disputed material within it.

The government argued that the power was needed to protect children, prevent terrorism and suppress unlawful online activity. It said the word "proved" constrained the committee and could be read as requiring a judicial determination. Petitioners in six consolidated cases, including Kirinyaga Woman Representative Jane Njeri Maina, argued that the paragraph instead gave an administrative body a direct blocking power over digital services, with consequences for expression, media freedom and other constitutional rights.

Nyaundi rejected the government's reading. The same amendment had created section 46A, which explicitly requires an application to a court for removal or closure orders before conviction. Parliament knew how to provide for judicial scrutiny. It did so in one section and omitted it from the committee's separate power.

The judge found that the committee could determine that a service fell within the prohibited categories and then direct that it be made inaccessible without judicial supervision. The state had not justified that restriction under Article 24 of the Constitution or shown that the measure was necessary and the least restrictive means available. The court declared paragraph 6(1)(ja) unconstitutional.

The court's route.

Section 46A survived. After a conviction connected to the activities specified in the law, a court may order removal of material, closure or deactivation of a system, site or device, or another appropriate measure. Before conviction, an authorized person who believes a system, website or device is being used for those activities may apply to a court for such an order.

That pre-conviction route gives authorities a means to act before a criminal case ends. It also places a judge between an investigator's belief and an order affecting access. An application can identify the material at issue and the evidence connecting it to a service. The court can then decide whether removing that material is enough or whether the case supports a wider restriction.

Judicial involvement does not make every requested order proportionate. Section 46A also permits an application to close an entire website or system. The effect on lawful users remains relevant when a court decides how far an order should reach. A judge presented with one unlawful listing on a marketplace faces a different question from one presented with evidence that the service itself is organised to facilitate an offence.

The July judgment does not measure how quickly courts can deal with urgent applications. It does establish which institution must decide under the route that survived. Speed may matter when authorities confront child sexual exploitation material or an imminent threat of violence. The state still has to justify the scope of the intervention it seeks.

The service's users.

A full-service block reaches people who did not publish the material under investigation. A reader can lose access to an archive because of one contested page. A merchant can lose orders because of one unlawful listing. A customer can be unable to initiate a payment, check a balance or contact a provider because the application carrying those functions is inaccessible.

Those are foreseeable effects of a whole-site remedy, not findings that the invalidated committee power was used against a particular Kenyan service. The statutory design allowed the committee to move from an allegation about specified material to a directive against an entire site or application without first presenting the case to a judge.

The Constitution permits restrictions on expression in defined circumstances. It does not require the state to leave material involving child sexual exploitation or terrorism online while a criminal trial runs its course. But the gravity of an allegation cannot alone establish that every other function on the same service should disappear. A narrow removal order and a whole-application block carry different costs for users, businesses and public access to information.

For a digital financial provider, availability is part of the service sold to customers. Inaccessibility can affect transaction initiation and support even when the alleged wrongdoing concerns a small part of the platform. A court order gives the provider a defined decision to challenge and gives the public a record of the grounds on which access was restricted. It does not guarantee that the initial decision will be right. It requires the state to put its case before a body separate from the one seeking the restriction.

The harassment clause.

Section 27 of the 2018 Act already criminalized cyber harassment. In 2025, Parliament added wording to paragraph 27(1)(b) covering communications considered likely to cause another person to die by suicide.

The amendment attached criminal liability to a prediction about another person's possible response to a communication. Nyaundi found that the test lacked an objective standard by which a speaker could know when their conduct crossed the line. It also failed to define a sufficiently clear link between the communication and the predicted outcome. A criminal rule carrying a severe penalty must give people fair notice of what is prohibited.

The court's order declares the amended paragraph 27(1)(b) unconstitutional. The reasons concentrate on the newly added suicide test, but the order names paragraph (b), which also contained older wording about communication that detrimentally affects another person. A prosecution founded on that older wording would have to confront the breadth of the order. The judgment did not declare section 27 as a whole unconstitutional, and its other paragraphs were not the subject of the declaration.

The Court of Appeal had considered the 2018 version of section 27 in a separate case brought by the Bloggers Association of Kenya. In March 2026 it struck down sections 22 and 23, which dealt with false publications, but rejected the challenge to section 27. The July High Court case examined what Parliament added in 2025. Its order against paragraph (b) leaves a question about the older words in that paragraph that a later court may need to settle.

The state can still investigate threats, incitement and other conduct covered by operative law. Each charge must identify a valid provision and prove its elements. A complaint that a message was upsetting does not revive the suicide test the High Court rejected. Nor does the July ruling make every online communication lawful.

The appeal's stakes.

The National Assembly, its Speaker and Parliament filed a notice of appeal after the July judgment, according to a report published on 10 July. The notice signals their intention to challenge the decision. It is not a reversal of the judgment.

The High Court also rejected challenges to the 2025 amendment's legislative process. It found that the law did not concern county functions in a way that required Senate participation and that Parliament had provided a sufficient opportunity for public participation. The petitioners won on two substantive provisions, not on a finding that the whole Act had been passed unlawfully.

Those limits leave a substantial cybercrime framework in place. They also leave the state with section 46A when it wants a removal or closure order. The administrative shortcut failed because it put the decision to disable a digital service in the hands of the same committee authorised to issue the directive, without prior judicial scrutiny or a proportionate account of the rights being limited.

A publisher, marketplace or payment provider may still face a lawful court application. Its customers may still lose access if a judge finds that a broad order is justified. The July ruling changes who must make that decision and what the state must put before them. When an entire service is at stake, an administrative assertion of harm cannot stand in for a court's examination of the evidence and the reach of the proposed restriction.