Kenya Treats Your Phone Number As A Digital Identity: What the Proposed SIM Recycling Rules Mean

Imagine waking up to discover that the phone number you have used for years now belongs to a stranger. Your bank may still send security codes to it. A school may send an update about your child. KRA may send a tax notice. A relative may share a private message. The SIM card has changed hands, but the rest of your digital life has not received the memo.

That danger is the reason Kenya is being forced to rethink the casual way inactive phone numbers are taken back and issued to new subscribers. A mobile number is no longer just a tool for making calls. It is the key used to enter M-PESA, bank accounts, email, social media, insurance, hospitals, government portals and countless business records. When that key is handed to someone else without proper safeguards, the loss is not merely a disconnected line. It can become a loss of privacy, access and identity.

The turning point came on March 19, 2026, when the High Court delivered a landmark judgment in Erastus Ngura Odhiambo and another v State Law Office and others, Petition E290 of 2024. The dispute arose from the experience of prisoners whose lines became inactive because they were legally unable to use personal phones while incarcerated. Their numbers could be deactivated and reassigned even though their absence from the network was not a voluntary decision to abandon their digital lives.

Justice Lawrence N. Mugambi recognised the larger truth behind their complaint. A registered mobile phone number is a digital identifier linked to a person’s private information and therefore falls under the protection of Article 31(c) and (d) of the Constitution. The court did not grant permanent ownership of a number or unrestricted phone use in prison. It held that a number linked to private life cannot be handed to a stranger through a mechanical process that ignores consent, notice and data protection.

The court gave the Attorney General six months to work with the Communications Authority of Kenya, the Office of the Data Protection Commissioner and other relevant agencies to build safeguards. If the measures are not in place by midnight on September 19, 2026, the court ordered that reassignment and recycling of previously registered numbers should stop. That deadline explains the urgency.

The Communications Authority has since published proposed procedural and technical safeguards for public participation. This distinction is important. As at September 2, 2026, the document is still a draft and the public has been invited to submit views by September 11, 2026. September 19 is the draft’s intended effective date and the court deadline, but the proposals are not final rules until consultation and formal adoption are completed.

Under the proposed system, the clock begins when a number records no revenue-generating activity for three months. Activity includes making or receiving a call, sending or receiving an SMS, using mobile data, topping up airtime or using the number for a value-added service. The practical meaning is simple: three months of silence would trigger the protection process, not immediate recycling.

Once the first three months pass, the service provider would have to make genuine efforts to reach the registered owner using information collected during SIM registration and Know Your Customer checks. The provider could send an SMS to the affected line and use other contact details linked to the subscriber. Those notification efforts would continue for another three months, unless the owner carries out a qualifying activity and brings the number back to life.

This creates a minimum six-month journey from inactivity to possible recycling: three months before the number is flagged, followed by another three months of warnings and opportunity to reactivate it. Thirty days before the second period expires, and if the line remains silent, the provider would have to publish the number among those at risk of deactivation and recycling. The subscriber would then have 30 days from publication to act.

The warning cannot be hidden in an internal system that ordinary customers never see. Providers would be expected to place a general notice on their websites, publicise it through other media and publish it in a daily newspaper with nationwide circulation every quarter. The notice would also carry the *106# option through which a subscriber can check whether a number is active, suspended, under recycling or already deactivated.

If all the notice periods expire and the number remains inactive, the operator still cannot simply wipe the owner’s name from one screen and sell the line the next morning. It must first separate the number from the former subscriber’s personal data, cached information and connected services. That information must be securely archived so that it cannot be accessed by or inherited by the next subscriber, while records that the law requires must still be retained.

The operator would then send a quarterly list of deactivated and recycled numbers to a centralised system. The purpose is to help banks, lenders, schools, hospitals, government agencies and other third parties update their records before they call or send messages about obligations connected to the old owner. Only after the required separation and reporting steps are completed would the number return to the pool and become available to a new subscriber.

This central record could be one of the most important protections in the entire framework. A telecom operator can clean its own database, but it cannot by itself erase an old number from every bank, app, business and institution that has stored it. Without a reliable alert that ownership has changed, a cleaned SIM can still receive somebody else’s password reset, debt reminder, health message or private communication.

The proposals also try to stop a recycled number from inheriting the previous owner’s marketing history. Before recycling, the operator would have to remove the number from all business-to-customer messages to which the former owner had subscribed. Newly issued and recycled numbers would begin with no marketing consent. A business wishing to send promotional messages would need the new subscriber to dial a business-specific USSD code. Consent given to one business would not open the door to every advertiser, and providers would have to retain proof of that consent for as long as the number remains active.

The framework further recognises that inactivity does not always mean abandonment. A person may be in hospital, living with a disability, recovering from an accident, travelling without access to the line or otherwise unable to use it for more than six months. The subscriber, a caregiver or another person acting on their behalf would be able to notify the service provider and request that the number be whitelisted after the necessary identity and supporting-document checks.

Prisoners receive a specific safeguard because their circumstances exposed the weakness in the old system. For a person serving a sentence of more than six months after exhausting appeal options, the Commissioner General of Prisons would have to submit the prisoner’s telephone number, national identification number and length of sentence to the relevant provider for whitelisting, and notify the prisoner. The point is not to permit unlawful phone use in prison. It is to ensure that a lawful restriction on physical access does not erase a person’s digital identity or transfer it to a stranger.

For ordinary subscribers, the lesson is immediate. If a number matters to your banking, business, family or government services, do not assume that owning the old SIM card is enough. Use the line within every three-month period, keep the alternative contacts in your registration records current, pay attention to warnings and check its status through *106# once the framework becomes operational. If you expect to be unable to use the number for more than six months, contact the provider early and ask about whitelisting rather than waiting for the final notice.

Anyone who genuinely intends to give up a number should first remove it from bank accounts, mobile-money services, email recovery settings, social-media accounts, insurance records, school contacts and government platforms. Businesses and public institutions should also stop treating it as a permanent identity marker once the central record shows that it has been recycled.

The proposals are a major improvement, but their strength will depend on implementation. Kenyans should use the consultation period to ask hard questions. How will published lists protect numbers from unnecessary exposure? What evidence will prove that a provider genuinely tried to locate an owner? How quickly will institutions act on recycling alerts? Who will audit the separation of old data, and what remedy will exist if private information still reaches a stranger?

Kenya’s digital economy has outgrown the idea that a phone number is a disposable string of digits. The State, telcos, banks and platforms have made it a gateway to money, identity and private life. Moving that gateway to another person is not an ordinary stock-management exercise.

A recycled number should arrive in the hands of its new owner clean, silent and free of another Kenyan’s secrets. The former owner should receive real notice, a fair chance to act and proof that their digital trail has been severed. The court has made the constitutional principle clear. The final rules must now protect people in practice, not only on paper.

Read Also: How Fake Agents and Copy-Paste Till Numbers Are Stealing Trust — and the Four Checks That Can Protect Your M-PESA