If you sell online from Kenya, on Shopify, WooCommerce or a site with M-PESA checkout, your store almost certainly loads more than you think: Google Analytics, a Meta or TikTok pixel, a chat widget, embedded videos. So what does cookie consent for online shops in Kenya actually require?
The short answer: Kenya has no cookie law as such, but the Data Protection Act, 2019 still reaches most of the trackers on a typical store. Here is why, what the Office of the Data Protection Commissioner (ODPC) says valid consent looks like, and a checklist for this week. This is a plain guide, not legal advice.
Does Kenyan law say anything about cookies?
Not directly. The DLA Piper data protection guide for Kenya notes that Kenyan law does not specifically regulate online privacy, and the Data Protection (General) Regulations, 2021 set no cookie rules of their own.
That is not the end of it. The Act covers any information relating to an identified or identifiable person. A cart cookie that only remembers what is in the basket is one thing. A pixel that follows a visitor across sites, builds an advertising audience or links browsing to a customer’s phone number and order history is handling personal data. Once that happens, the Act’s general rules apply to your cookies like everything else:
- A lawful basis for each use of the data (section 30). For advertising and most analytics, that basis is usually consent.
- Conditions for consent (section 32): you carry the burden of proving consent was given, and people can withdraw it at any time.
- A duty to inform people what you collect, why and who you share it with (section 29).
- Consent before commercial use, such as marketing, of someone’s personal data (section 37).
What valid consent looks like, according to the ODPC
The ODPC adopted its Guidance Notes on Consent in November 2023. Explaining consent to the Nation, the Data Commissioner’s office set out four tests. Consent must be:
- Freely given: no pressure, and the service should not be held hostage to it.
- Specific: tied to a stated purpose. A new purpose needs new consent.
- Informed: backed by a clear notice of what is collected, why, and who to contact.
- Unambiguous: an express, clear indication of the person’s wishes. In the office’s words, “silence is not consent”.
Two more points matter for a cookie banner: the person can withdraw consent at any time, and it is the business, not the customer, who must prove that consent was given.
Common cookie banners, held up against those tests
| What the banner does | How it sits with the ODPC tests |
|---|---|
| “By using this site you agree to cookies”, with only an OK button | Weak. Carrying on browsing is close to silence, and the visitor has no real choice. |
| Pre-ticked boxes for analytics and marketing | Weak. A box the visitor never ticked is not a clear indication of their wishes. |
| Big “Accept all”, with “Reject” hidden two screens deep | Questionable. Hard to call consent freely given when saying no takes far more effort. |
| A banner, but the pixels fire before anyone clicks | The banner says one thing and the site does another. The data has already gone. |
| Accept and Reject equally easy, choice by category, trackers held until a choice, a “Cookie settings” link to change your mind | Much closer to what the Act and the ODPC describe, especially if you keep a record of each choice. |
The trackers a typical Kenyan online shop loads
These are the usual groups:
- Strictly necessary: cart, checkout session, login, fraud checks, the payment step. Your shop cannot work without these, so they do not need a consent click, but you should still explain them in your privacy notice.
- Analytics: Google Analytics, Hotjar-style heatmaps, plugin statistics.
- Advertising: Meta Pixel, TikTok Pixel, Google Ads tags. These are the ones most likely to involve personal data and sharing with a third party.
- Embedded content and widgets: YouTube videos, chat bubbles, review widgets and some theme add-ons, which can set their own cookies.
A common surprise: a theme or plugin you installed months ago may be loading trackers nobody on your team remembers adding.
An 8-step cookie consent checklist for your store
| Step | What to do |
|---|---|
| 1. List what loads | Scan the live store. Note every cookie, pixel and script, and who it sends data to. |
| 2. Sort it | Strictly necessary, analytics, advertising, embedded content. Remove anything you no longer use. |
| 3. Hold non-essential trackers | Analytics and advertising tags should wait until the visitor says yes. |
| 4. Make Accept and Reject equal | Same size, same screen, plain words. Offer choice by category. |
| 5. Update your privacy notice | Name the trackers, what they collect, why, where the data goes and how to contact you. |
| 6. Keep a record | The burden of proof is yours. Keep a record of what each visitor chose and when. |
| 7. Let people change their minds | Put a “Cookie settings” link in your footer so withdrawing is as easy as agreeing. |
| 8. Re-check regularly | Every new plugin, theme update or ad campaign can add a tracker. Scan again after changes. |
While you are at it, check whether you need to register with the ODPC as a data controller. In June 2026 the Commissioner reminded businesses that registration is mandatory for eligible entities. According to DLA Piper, businesses with an annual turnover below KES 5 million and fewer than 10 employees are exempt, unless they work in a listed sector such as education, health, financial services or gambling. Kenyans.co.ke lists registration fees from KES 4,000 for micro and small entities, with a certificate valid for two years.
Running WordPress or WooCommerce? There is a plugin for that
Most Kenyan online shops we see run on WordPress with WooCommerce. For them, steps 3, 4 and 7 can be handled by a plugin rather than custom code. The Lexiscript Consent & Privacy plugin is now listed in the WordPress.org plugin directory, which means it went through WordPress’s own plugin review before being published.
- It adds the Lexiscript consent banner, loading before your other scripts so trackers wait for a choice.
- “Reject all” is as prominent as “Accept”, and there are no pre-ticked boxes.
- Global Privacy Control signals are respected, and it works with page caching and Multisite.
- Install from Plugins → Add New in your dashboard, search for “Lexiscript” and paste your site key. Full steps are on our WordPress plugin page.
It needs WordPress 6.0 or newer and PHP 7.4 or newer. Scanning is free; the consent banner itself needs a paid Lexiscript plan.
What is at stake
Under section 63 of the Act, the ODPC can impose an administrative fine of up to KES 5 million or 1% of the previous year’s annual turnover, whichever is lower. The office has used that power: in April 2023 it fined two companies KES 5 million each, as Citizen Digital reported. Those cases were about unsolicited messages, not cookies, but they show that customer complaints reach the ODPC and get acted on.
How Lexiscript helps
Lexiscript is our privacy-compliance scanner for online stores, built here in Nairobi. It does the slow part of steps 1, 2 and 8 for you: it scans your store, lists what loads, and maps each tracker to the privacy law that applies. You can read more on how it works and in our guide to cookie consent and the Kenya Data Protection Act.
- Free scans during launch: the full report, no card required.
- PRO, KES 2,500 a month: automatic monthly re-scans with the report emailed to you, published notices, a consent widget and an audit trail of consent choices. All charges are in KES.
- WordPress: the Lexiscript plugin puts the consent banner on your WordPress or WooCommerce store without touching code.
Two honest notes. Lexiscript is a tool to help you see and fix problems, not a guarantee that your store complies with the law. And the notices it generates are starting drafts, not legal advice: have a lawyer review them before you rely on them. If you need a new store built with privacy in mind from day one, our web design team in Nairobi can help.
Cookie consent in Kenya: questions online sellers ask
Does my online shop need a cookie banner in Kenya?
Kenya has no cookie-specific law, but if your store uses analytics or advertising trackers that handle personal data, the Data Protection Act's consent and notice rules apply. A banner that asks for clear consent before those trackers load is the practical way to meet them.
Is “by using this site you agree” enough?
It is unlikely to be. The Data Commissioner's office has said that silence is not consent, and consent must be an express, clear indication of the person's wishes.
What is the fine for breaking the Data Protection Act?
The ODPC can impose an administrative fine of up to KES 5 million or 1% of the previous year's annual turnover, whichever is lower.
I run my shop on WordPress or WooCommerce. Is there a plugin?
Yes. The Lexiscript Consent & Privacy plugin is listed in the WordPress.org plugin directory. It adds the Lexiscript consent banner and holds trackers until the visitor chooses. Scanning is free; the consent banner needs a paid Lexiscript plan.
Does Lexiscript make my store compliant?
No tool can promise that. Lexiscript scans your store, maps each tracker to the law that applies and, on PRO, adds a consent widget, monthly re-scans and an audit trail. Its notices are generated starting drafts, not legal advice.
Sources
- DLA Piper, Data protection laws of the world: Kenya, accessed 21 October 2026
- Digital Policy Alert, ODPC adopts Guidance Notes on Consent, 30 November 2023
- Nation, Consent: Data Protection Commissioner breaks it down
- Kenyans.co.ke, ODPC directs entities handling people’s data to register or face Ksh5 million fine, 4 June 2026
- Kenyans.co.ke, ODPC explains registration process for businesses handling personal data, 8 June 2026
- Citizen Digital, Gov’t slaps two companies with Ksh.10M fine for abusing customer phone data, 11 April 2023
- Oraro & Company Advocates, What the Data Protection Act, 2019 means for you
- WordPress.org, Lexiscript Consent & Privacy plugin, accessed 21 October 2026
Find out what your store loads before your customers do
Run a free Lexiscript scan of your online shop: the full report, no card required. When you want monthly re-scans, a consent widget and an audit trail, PRO is KES 2,500 a month.
Run a free scan → See Lexiscript pricing