Is Cyberbullying a Crime in Kenya? What the Law Actually Says in 2026
Two courts have reshaped Kenya’s cyber harassment law in the past eight months. Here is what is still a criminal offence, what was struck down, what is under appeal, and what you can do right now.
Kenya has no offence called “cyberbullying”, but the conduct is covered by other laws. Cyber harassment remains an offence under Section 27 of the Computer Misuse and Cybercrimes Act, 2018, which the Court of Appeal upheld in March 2026. In July 2026 the High Court struck down the 2025 amendment that extended it to messages “likely to cause” suicide. Criminal defamation no longer exists, but you can sue for defamation and breach of privacy and dignity in civil court. Which route fits depends on the facts and the evidence you hold.
Why the answer keeps changing
Many articles still describe the October 2025 amendments as settled law. They are not. Between October 2025 and July 2026 the courts suspended, upheld and then struck down different parts of the cyber harassment framework. This page tracks the position as we understand it at the date below.
What is still a criminal offence
The cyber harassment offence in the original Section 27 of the 2018 Act remains in force after the Court of Appeal decision. In practical terms, repeated abusive, threatening or grossly offensive messages sent to a person, or communication that detrimentally affects them, can still be reported as a crime. Separately, the Act continues to cover related conduct such as unauthorised access to accounts, impersonation and identity-related offences, and sharing intimate images without consent.
What changed is the wider net. The amendment that would have criminalised messages “likely” to cause someone to take their own life was struck down as too vague. The court’s concern was that criminal liability cannot rest on a speculative, subjective standard.
Which route fits your situation
| Your situation | Likely route | Why |
|---|---|---|
| Threats, repeated abusive messages, stalking | Police and DCI report, plus evidence preservation | Falls within cyber harassment and related offences. Get an Occurrence Book (OB) number. |
| False statements damaging your reputation | Civil defamation claim (Defamation Act, Cap. 36) | Criminal defamation no longer exists. Courts can award damages and order takedown or retraction. |
| Private images or personal data shared without consent | Report to police; civil claim for breach of privacy and dignity; platform removal | Articles 28 and 31 of the Constitution and the Data Protection Act may apply alongside the Cybercrimes Act. |
| Fake account impersonating you | Platform report, evidence capture, then criminal and civil options | Identity of the operator usually needs to be established before a claim can be served. |
| Anonymous account, identity unknown | Forensic and open-source investigation, then court process | You cannot sue or serve someone you cannot name. |
The civil route: where most victims find leverage
Because criminal prosecution can be slow and the harassment law is still contested, many victims focus on the civil courts. A defamation claim does not depend on Section 27. It asks whether a false statement was published to others and damaged your reputation. Kenyan courts have awarded substantial sums in online cases, and in Nzibo v Nation Media Group [2024] the High Court awarded KES 11 million. An Eldoret court also ordered a law student to pay KES 7.5 million over a social media post about a church leader’s driver. See our guide to how much compensation you can claim for how courts approach quantum.
Civil courts can also grant interim injunctions restraining further publication and mandatory takedown orders, which matter when content keeps spreading while a case is pending. An advocate should advise on which remedies to plead.
What to do in the first 24 hours
- Do not delete anything. Even distressing content is evidence.
- Capture the content properly. Save URLs, usernames, profile links and timestamps, not just screenshots. Screenshots alone are easy to challenge.
- Secure your accounts. Change passwords and enable two-factor authentication before the harasser escalates.
- Report on the platform and note the report reference numbers.
- Make a police report where there are threats, intimate images or ongoing harassment, and keep the OB number.
- Get the evidence forensically preserved if you may litigate. Electronic evidence in Kenyan courts is governed by the Evidence Act (Cap. 80), sections 106A and 106B, which set conditions for admitting electronic records.
Reporting to the authorities and hiring a forensic investigator are not mutually exclusive. We compare the two in DCI vs private investigator for cyberbullying. For content in messaging groups, see WhatsApp message defamation in Kenya. If a child is involved, read our guide for parents and guardians.
Frequently asked questions
Is cyberbullying a crime in Kenya?
There is no offence labelled “cyberbullying”, but the conduct can be prosecuted as cyber harassment under Section 27 of the Computer Misuse and Cybercrimes Act, 2018, along with related offences such as impersonation, unauthorised access and sharing intimate images without consent. It can also support civil claims in defamation and privacy.
Is cyber harassment still an offence after the July 2026 High Court ruling?
Yes, the core Section 27 offence in the 2018 Act remains, and the Court of Appeal upheld it in March 2026. The July 2026 ruling struck down the 2025 amendment that extended the offence to communication “likely to cause” suicide, and the website-blocking power. Check whether any appeal has changed the position.
Can I sue someone for cyberbullying in Kenya?
You can sue for the harm the conduct causes, typically defamation, breach of privacy or breach of dignity, depending on the facts. There is no standalone civil claim called “cyberbullying”. An advocate can advise on the right cause of action and the limitation period that applies.
Is criminal defamation still an offence in Kenya?
No. Section 194 of the Penal Code was declared unconstitutional in 2017. Defamation is pursued as a civil claim under the Defamation Act, Cap. 36, and the Constitution protects reputation alongside freedom of expression.
Where do I report cyberbullying in Kenya?
You can report to the police or the DCI cybercrime unit, to the Communications Authority of Kenya, and to the platform where the abuse is happening. Keep the Occurrence Book number and any platform report references. Threats and intimate image abuse should be reported promptly.
How do I prove cyberbullying in court?
You need preserved, verifiable records: full URLs, account identifiers, dates and times, and original messages or files, ideally captured and documented by a forensic examiner so that the chain of custody and authenticity can be demonstrated. Screenshots on their own are often challenged.
Can the person behind an anonymous account be identified?
Often, but not always, and only by lawful methods. Open-source analysis, platform records obtained through proper process, and forensic review of material you already hold can all help. Anyone promising guaranteed identification should be treated with caution.
Being targeted online in Kenya or from abroad?
Ultimate Forensic Consultants is a PSRA-licensed, ODPC-registered forensic investigation firm. We preserve evidence to a court-ready standard and help identify who is behind abusive accounts, working with your advocate on the civil route.
Start a Confidential Assessment Call +254 100 177 094