Kenya tightens rules for deactivating and recycling inactive mobile numbers

Kenya’s telecom operators will face stricter requirements for deactivating and recycling inactive mobile numbers from September 19, when new safeguards issued by the Communications Authority of Kenya (CA) take effect.

The new framework gives subscribers more time to recover dormant numbers and introduces additional obligations for operators to separate personal data and services linked to previous users before the numbers are assigned to new subscribers.

The regulatory changes reflect the growing importance of mobile numbers beyond basic telecommunications. As phone numbers increasingly serve as identifiers for banking, digital payments, government services and online accounts, their reassignment can create privacy, fraud and identity-related risks.

CA extends process for recycling inactive numbers

Under the new framework, a number cannot be deactivated until it has remained inactive for three consecutive months without revenue-generating activity.

This includes activities such as calls, SMS, data usage, airtime top-ups and value-added services.

Once the three-month inactivity period has elapsed, the operator must make further efforts to contact the subscriber for another three months using SMS and other contact information supplied during the Know Your Customer (KYC) registration process.

The framework also requires operators to publish lists of numbers at risk of deactivation and recycling 30 days before the deadline. These notices must be made available through national newspapers, broadcast media and the operators’ websites.

The extended process effectively creates a six-month window before an inactive number can be returned to circulation, giving subscribers additional opportunities to reclaim numbers that may have become dormant for reasons other than abandonment.

Operators face additional compliance obligations

The new rules also introduce record-keeping requirements for telecom operators.

Operators must maintain evidence of their attempts to notify subscribers, as well as records of consent provided by customers for business-to-consumer marketing messages. These records must be retained for as long as the number remains active and managed in accordance with Kenya’s Data Protection Act, 2019.

For operators managing millions of subscribers, the requirements could increase investments in data storage, indexing, secure archiving and compliance monitoring systems.

The framework also introduces stricter rules for unsolicited marketing. Unlike opt-out approaches used in some other markets, Kenya will require customers to actively opt in to business-to-consumer messages on new and recycled numbers through a business-specific USSD code.

This adds another layer of consent management for operators and businesses using mobile numbers for customer communications.

Recycled numbers must be separated from previous users’ data

A key change under the framework is that telecom operators will have responsibilities that extend beyond determining whether a number is inactive.

Before assigning a recycled number to a new subscriber, operators must “de-link and securely archive the personal data, cached data, and services associated with the previous owner.”

The measure is intended to prevent a new subscriber from inheriting access to accounts, services or information that remains associated with the previous user.

This is increasingly important because mobile numbers can remain linked to bank accounts, loan platforms, government services, social media accounts and other digital platforms even after a subscriber stops using the number.

Simply reallocating the number therefore does not necessarily sever its digital connections with the previous owner.

Central database planned for recycled numbers

To further reduce the risks associated with number recycling, the CA plans to establish a centralised database containing deactivated and recycled mobile numbers.

Telecom operators will be required to submit updated lists to the database every quarter. The information is intended to help banks, lenders, government agencies and other third parties update their records before sending communications to customers.

However, the database will not be operational when the new rules come into force on September 19. The relevant requirements will take effect once the system has been established.

Operators such as Safaricom and Airtel Kenya will consequently need systems capable of monitoring inactivity, initiating subscriber notifications, recording compliance efforts and ensuring that personal data and services linked to previous users are not carried over to new subscribers.

New safeguards address privacy and fraud risks

The CA’s approach is driven partly by the recognition that mobile numbers have evolved into important components of digital identity and financial access.

The regulator has warned that number management can have implications beyond telecommunications, including for financial integrity, social stability, security and consumer protection.

It specifically identified risks such as SIM-swap fraud and identity theft that can arise when recycled numbers remain connected to the previous owner’s digital services.

The framework also follows a March 2026 High Court judgment concerning the privacy implications of mobile number recycling. The court found that a mobile number can function as a digital identifier linked to a subscriber’s identity.

Advocate of the High Court of Kenya, Olukoye Micheal, said the regulatory response reflects the privacy concerns arising when identifiers are reassigned without adequately considering the reasons behind prolonged inactivity.

“When a digital identifier is lost through reallocation or recycling without interrogating the reasons behind the long period of non-use or inactivity, it creates an avenue for unauthorised disclosure of delicate information,” Olukoye said.

Vulnerable subscribers receive additional protection

The new framework does not eliminate mobile number recycling. The CA recognises that numbering resources are finite and that inactive numbers must eventually return to circulation.

Instead, it introduces additional safeguards to establish whether a number has genuinely been abandoned before it is reassigned.

The rules also provide exemptions for subscribers whose numbers may remain unused because of circumstances beyond their control.

Prisoners serving sentences of more than six months and remandees can have their numbers formally whitelisted through prison authorities. Caregivers of people who are medically indisposed can also request exemptions, with the protection available for one year at a time and renewable where the circumstances continue.

Telecom operators assume greater responsibility

Kenya’s new approach represents a broader shift in how mobile number recycling is regulated.

Rather than treating an inactive number simply as a telecom resource that can be returned to circulation, the framework recognises the wider digital ecosystem attached to that number.

From September 19, operators will have to spend more time verifying subscriber inactivity, demonstrate that reasonable notification efforts have been made, maintain evidence of compliance and ensure that personal data, services and permissions linked to previous users are properly separated.

The reforms therefore place greater responsibility on telecom operators to manage the risks created by number recycling while preserving access to a finite numbering resource.

For Kenya’s increasingly digital economy, the changes underscore a wider regulatory challenge: ensuring that the infrastructure supporting digital identity, financial services and communications remains secure even when ownership of the underlying mobile number changes.