Online safety must become Kenya’s new civic literacy

The Kenya Music Festival has given the country a lesson that should move from the stage into national policy. Learners are using music, poetry, theatre and public speaking to educate communities about responsible internet use, cyberbullying, misinformation, password safety, online strangers, screen-time balance and data protection.

The media reported that schools such as St Joseph’s Girls Kibwezi and Evojo Primary School used performances to warn learners against sharing passwords, family information and personal details online, while also urging them to verify information before forwarding it and to report cyberbullying.

That should not be dismissed as children’s entertainment. It is civic education in its most practical form.

Kenya has spent years measuring digital progress through infrastructure, mobile penetration, online services, artificial intelligence strategies and broadband expansion. Yet the country now needs a more human measure of digital maturity: whether a child can go online without being bullied, deceived, profiled, exploited, manipulated or permanently harmed.

A child who can access the internet but cannot recognise manipulation, protect personal data, question misinformation, report abuse or resist cyberbullying has not been digitally empowered. They have merely been connected.

Online safety must now become Kenya’s new civic literacy.

The urgency is clear. DataReportal’s Digital 2026 Kenya estimates that Kenya had 23.4 million internet users at the end of 2025 and 18.4 million social media user identities in October 2025.

The Communications Authority of Kenya data also shows how deeply mobile and broadband access are now embedded in daily life, with mobile broadband uptake on the rise in recent reporting periods. These numbers are not just connectivity statistics. They describe an environment in which children learn, play, communicate, imitate, experiment and become vulnerable.

The risks facing children have also changed. The old advice -“do not talk to strangers online”- remains useful, but it is no longer enough.

Children now face cyberbullying, grooming, financial sextortion, misinformation, image-based abuse, impersonation, deepfakes, AI-generated sexualised content, addictive platform design, privacy invasion, algorithmic profiling, online harassment and harmful content that can travel through a school community within minutes.

The global evidence is disturbing. WeProtect Global Alliance’s 2025 Global Threat Assessment warns that technology-facilitated child sexual exploitation and abuse is becoming more sophisticated and is outpacing existing safeguards, driven by encrypted spaces, financial sexual extortion and emerging technologies.

The Internet Watch Foundation’s 2025 Annual Data and Insights Report assessed 451,210 reports and confirmed 311,610 reports containing or leading to child sexual abuse material, while adding 317,101 new images and videos to its hash list. Artificial intelligence has made the danger more complex.

The IWF reported that AI-generated child sexual abuse material is an emerging and significant risk, while UK authorities recently warned parents that publicly shared images of children can be misused by AI “nudification” and image-manipulation tools. NCMEC released new data in June 2026 warning that it received more than 100 reports of child financial sextortion every day in 2025.

This is the new child-safety reality: a school photo, a voice note, a WhatsApp message or an innocent social media post can become raw material for harm.

Kenya cannot treat these risks as foreign problems. Digital harm crosses borders more easily than regulation does. A child in Kibwezi, Kakamega, Kisumu, Garissa, Eldoret, Mombasa or Nairobi may use the same apps, games, messaging platforms and social media services as children in London, Lagos, Mumbai or Los Angeles.

The strongest cybersecurity education does not begin with fear. It starts with agency.

Children should not be taught that the internet is only dangerous. That message is incomplete. The internet is also a learning space, a library, a creative studio, a career gateway, an innovation environment and a civic platform.

The goal is not to frighten children away from technology. The goal is to prepare them to use it wisely.

Kenya already has important foundations. The Communications Authority has a Child Online Protection programme that recognises children as vulnerable users of cyberspace and promotes safer internet use among children, parents and guardians.

In November 2025, the Authority hosted a stakeholder forum on a national child online protection survey, noting concerns such as cyberbullying, harmful content and emerging online threats that require a more coordinated, proactive and data-driven response. The Directorate of Children Services also notes that children have been trained on online child sexual exploitation and abuse and legal provisions on online child protection under the Children Act, 2022.

The legal foundation is equally important. Kenya’s Data Protection Act, 2019 requires that personal data relating to a child should not be processed unless consent is given by the child’s parent or guardian and the processing protects and advances the child’s rights and best interests. It also requires appropriate mechanisms for age verification and consent.

The Office of the Data Protection Commissioner’s guidance on processing children’s data reinforces the need for specific, informed and freely given consent, and places responsibility on data handlers to demonstrate that valid consent was obtained.

This matters because schools, churches, clubs, sports teams, tuition centres, transport providers, photographers, examination systems and EdTech platforms often collect children’s names, images, grades, locations, medical details, parent contacts and performance records. They may see this as ordinary administration. In law and in cybersecurity, it is children’s personal data.

Privacy is not an adult concept. A child’s dignity also has data attached to it.

The Computer Misuse and Cybercrimes Act also matters because online harm is not merely bad manners. Kenyan law criminalises conduct such as wrongful distribution of obscene or intimate images, certain forms of electronic-message abuse, cybercrime and harmful digital conduct. This legal framework should be translated into age-appropriate education. Children do not need legal jargon, but they need to understand consent, evidence, reporting, dignity, consequences and help-seeking.

The Kenya Music Festival is powerful because it translates law into culture. Learners are turning privacy into song, cyberbullying into drama, online safety into poetry, and responsible citizenship into language that children and parents can understand.

That is what serious digital literacy should look like. It should not be limited to operating a device, typing a document or searching the web.

Digital literacy must include privacy, password hygiene, misinformation detection, online etiquette, cyberbullying response, safe research, image consent, digital footprints, AI awareness, source verification, healthy screen habits and knowing when to ask a trusted adult for help.

Recent academic work supports this shift. A 2026 paper argues that dominant child online safety approaches too often rely on bans, age gates, monitoring and surveillance, instead of designing technologies around children’s wellbeing, privacy, safety, agency and rights. The authors call for “child-fit security,” where children are treated as legitimate users whose protection must be built into the design of digital systems.

That is the correct direction for Kenya. Banning phones may solve a classroom distraction for a few hours; it does not prepare a learner for a digital life. Parental controls may reduce exposure; they do not build judgment. Monitoring may detect some harm; it does not create trust. The country needs a child online safety model that combines protection, education, design, reporting, enforcement and participation.

UNESCO’s Global Education Monitoring work offers a useful warning. It notes that technology in education must be guided by evidence, equity, governance and teacher preparation, and warns that only 16 percent of countries explicitly guarantee data privacy in education by law, while one analysis found that 89 per cent of 163 education technology products recommended during the pandemic could survey children.

This should concern Kenya as schools adopt learning platforms, digital assessment tools, online classrooms, communication apps, biometric attendance systems and AI-assisted education tools.

EdTech is not automatically child-friendly simply because it is used in school. A 2023 academic study of 20,195 children’s and child-directed mobile apps found troubling privacy gaps, including trackers in many apps and location-permission requests in some children’s apps despite platform rules.

Educational technology must therefore be governed, not merely purchased.

Every Kenyan school should have a practical online safety and children’s data policy. It should cover how learners’ images are taken and shared, how parents give consent, how digital platforms are selected, how cyberbullying is reported, how evidence is preserved, how teachers respond to online harassment, how school WhatsApp groups are managed, how children’s data is stored, and how third-party technology providers are assessed.

This is not bureaucracy. It is child protection.

Parents also need support, not blame. Many parents are trying to raise children in a digital environment they themselves did not grow up in. They may know that online harm exists but not know how to discuss sextortion, deepfakes, gaming chats, disappearing messages, AI image manipulation or platform reporting.

A 2025 study of adolescents in Nigeria found that parents remained a primary support network for online safety, but that monitoring, communication and coping resources varied widely. African households need practical, culturally grounded online safety education that strengthens parent-child trust rather than turning technology into a battlefield.

The learner should not be left alone, the parent should not be left confused, and the teacher should not be left untrained.

The platform layer must also be addressed. WeProtect’s digital safety analysis notes that only 4 per cent of children report sexual extortion to the platform where it occurred, and that 60 per cent of the top 50 global content-sharing platforms publish no information on how they address child sexual exploitation.

That is a governance failure. Children cannot be expected to carry the full burden of online safety when platforms are designed to capture attention, recommend content, expand networks and monetise engagement.

Kenya should therefore ask harder questions of technology companies, telecom operators, schools and digital-service providers. Are safety settings child-friendly? Are reporting tools visible and usable? Are harmful accounts removed quickly? Are Kenyan languages and local contexts considered in content moderation? Are parents given clear controls? Are children’s complaints taken seriously? Are privacy notices understandable? Are AI systems tested for child-safety risks before deployment?

This is where cybersecurity, child protection, education policy and data governance must meet.

Kenya’s broader cyber environment makes awareness even more urgent. The National KE-CIRT/CC detected more than 3.3 billion cyber threat events between January and March 2026 and continued issuing millions of cyber threat advisories. Those threats may target infrastructure, institutions and businesses, but the same ecosystem also reaches children through phishing, account takeover, impersonation, scam links, fake promotions, manipulated content and social engineering.

The child is not outside the cybersecurity perimeter. The child is already inside it.

The country should now build a national child online safety compact involving the Ministry of Education, Communications Authority, ODPC, Directorate of Children Services, schools, parents, telecom operators, technology companies, civil society, media, religious institutions and learners themselves. Such a compact should not be another ceremonial document.

It should produce practical tools: school safety templates, parent guides, teacher training, learner reporting pathways, EdTech procurement checklists, child-data consent forms, cyberbullying response protocols and AI-safety guidance for schools.

Kenya’s Competency-Based Education provides a natural home for this agenda. Online safety belongs in life skills, language, creative arts, computer studies, social studies, religious education, career guidance and citizenship. The Kenya Music Festival has already shown that learners can teach these issues through performance. The education system should now make that creativity part of a national digital citizenship movement.

The most advanced digital society is not the one with the most connected children. It is the one with the safest, wisest and most empowered digital citizens.

Kenya’s children are not simply asking to be protected from the internet. They are asking to be prepared for it.

Online safety must be taught in classrooms, practised at home, demanded from platforms, enforced by regulators and carried proudly by learners themselves. In the AI age, this is no longer optional awareness. It is national civic literacy.

George Kariuki is the ICT and Cybersecurity Professional. 0721912978. [email protected].