Kenya, the “Silicon Savannah”; a title that is well-deserved and worn with pride. It reflects the global success of M-Pesa in driving financial inclusion, the strength of our innovation ecosystem, the presence of regional technology headquarters, and the confidence with which Kenya shows up at global digital forums. Kenya sees herself, and is often seen, as a continental, nay global, innovation leader.
Yet nearly two years ago, the Worldcoin saga exposed a disquieting gap between this brand and the institutional machinery behind it. It was a moment that forced the country to stop, look in the mirror and ask, “Who, exactly, was in charge?”
Contrary to public memory, the story did not begin with the viral queues at KICC. It began a year earlier, when orb-like devices appeared in shopping malls; a kind of sci-fi décor that no one had ordered. While most people walked past with curiosity, the Office of the Data Protection Commissioner (ODPC) was already acting, issuing directives, and asking the questions no one else seemed to be asking: Who is this entity? What data is being collected? On what legal basis? There were no cameras then, no online outrage, just a small, thinly staffed regulator tracing an unfamiliar activity.
Once tokens-for-cash hit the scene and the KICC queues formed, the matter shifted from technical inquiry to national spectacle. Media descended, Parliament leapt into action, ministries contradicted one another, and Kenya realised that a global biometric token project had embedded itself in the country.
Claims flew, from exploitation to fears that iris capture could somehow “switch off our eyes.” Exaggerated? Maybe, but it resonated as no institution appeared visibly in control.
Much of the blame landed on the ODPC. Only a few acknowledged that the Data Protection Act was never designed to give the regulator sweeping powers over complex, cross-sector technology initiatives. The Act empowers enforcement; it does not grant authority over multi-domain projects touching finance, identity, security, and consumer protection.
As the public outcry grew, multiple agencies intervened. Parliament conducted hearings with dramatic flair. Later, the High Court upheld the government’s suspension of Worldcoin’s activities. The judgment offered legal clarity, but it also confirmed that the institutional fragmentation on display was not imagined. Regulators had acted; the system had not.
Two parallel realities had existed: early regulatory work conducted quietly, and a later, noisy political scramble. In between, speculation flourished. Concerns about surveillance, allegations of exploitation, and stories of eye discomfort filled the void left by the absence of coordinated, authoritative communication.
The narrative settled into the public imagination, remaining unresolved and unchallenged.
This saga revealed an uncomfortable truth: Kenya does not suffer from weak regulators; it suffers from a fragmented regulatory architecture.
To be clear, the relevant institutions did not fail to perform their role. However, if an objective grade were to be given based on singularity of purpose, the score would be an F.
Technology does not respect institutional boundaries. It does not pause while agencies negotiate jurisdiction, and citizens should not be left to guess which regulator is responsible at the very moment their rights, identity, or financial security may be affected.
Kenya urgently needs a permanent Cross-Regulator Digital Council, not a crisis-era taskforce, but a standing, well-resourced mechanism for horizon scanning, joint risk assessment, coordinated enforcement, and unified public communication.
Today, Kenya has no multi-agency sandbox for emerging technologies, no formal mechanism for managing cross-cutting digital risks, and no clear process for determining institutional leadership when innovations span several domains. Everyone has a mandate; no one has the mandate to connect them.
This is not only a governance problem; it is a business problem. Fragmented regulation undermines investor confidence, heightens compliance uncertainty, and exposes the country to reputational risk.
Kenya’s digital economy contributes nearly 10 percent of GDP and continues to attract significant domestic and international capital.
For the Silicon Savannah to retain its credibility, the next breakthrough technology must encounter a coordinated state, not one navigating its digital future in the dark and discovering the scale of the challenge only after Kenyans begin queuing.
The writer is Data Protection and Cyber Security Expert Advisor to the East African Community
Unlock a world of exclusive content today!Unlock a world of exclusive content today!
