Does Kenya’s AI Strategy 2025-2030 hit the mark on child protection?

The Ministry of Information, Communications, and Digital Economy (MICDE) launched the Kenya Artificial Intelligence (AI) Strategy 2025-2030 on March 27, 2025.[1] Like many other African nations, Kenya is at the forefront of leveraging AI to enhance education, agriculture, and healthcare. However, one critical demographic remains overlooked: the African child. This blog assesses elements of Kenya’s recently released AI strategy as it relates to its coverage of child protection and why, though Kenya is a leader in AI innovation and governance within Africa, its regulatory framework remains inadequate in addressing child-specific AI risks. The blog conducts a comparative assessment of Kenya and the USA’s child protection policies in the age of AI.

AI and Child Protection in the USA

Despite the global gap in AI-specific child protection laws, some countries have implemented legal measures to safeguard children online. In the United States, the Children’s Online Privacy Protection Act (COPPA) of 1998 provides a framework for regulating companies that handle children’s data.[2] Under COPPA, beginning in 2025, violations could result in civil penalties of up to US$ 53,088 per infraction, reinforcing strict compliance requirements for AI-driven platforms processing children’s data (under 13 years old).[3]

To comply with COPPA, AI companies must provide a clear and accessible privacy notice explaining how they collect, use, and share children’s data. They must also obtain verifiable parental consent before collecting any personal information from children, ensuring that parents have control over their child’s data. Additionally, companies are required to have data retention policies outlining how long children’s data is stored and ensuring it is deleted when no longer needed. Strong security measures must be implemented to prevent data breaches and misuse, and any third-party partners handling children’s data must adhere to strict compliance standards.

COPPA grants parents the right to review or delete their child’s personal data at any time. It also strictly prohibits targeted advertising to children, ensuring that companies cannot exploit children’s data for marketing purposes.

AI and Child Protection in Kenya

Kenya lacks a specific AI law to regulate the collection and use of children’s data. Instead, Section 33 of the Data Protection Act (2019) serves as the primary legal provision governing children's data protection.[4]. Under this Act, data controllers and processors must obtain parental or guardian consent before handling a child’s personal data. Additionally, all data processing must align with the best interests of the child.

To ensure compliance, the law mandates that organizations implement age verification and security measures. However, the effectiveness of these mechanisms is subject to factors such as available technology, the volume of data processed, the proportion of child-related data, and potential risks of harm. These mechanisms are overseen by the Data Commissioner, but enforcement remains a challenge.

Finally, Kenya exempts organizations providing counseling or child protection services from obtaining parental consent. This allows child welfare organizations to assist children without bureaucratic barriers but also raises concerns about the potential for misuse of children’s data.

Comparison: COPPA vs. Kenya’s Data Protection Act

Both COPPA and Kenya’s Data Protection Act require parental consent before the collection and processing of children’s personal data. However, COPPA imposes stricter requirements by demanding verifiable parental consent, whereas the Kenyan Act does not specify how consent should be obtained, leaving room for interpretation.

Another key difference is in data retention policies. COPPA mandates that companies clearly define how long children’s data will be stored and when it will be deleted. The Kenyan law lacks such explicit provisions, meaning there is no clear limit on how long children’s data can be retained.

Additionally, COPPA explicitly bans targeted advertising to children, preventing companies from using their data for marketing. Kenya’s Data Protection Act does not include such a provision, leaving children vulnerable to AI-driven profiling and advertising.

Finally, COPPA does not exempt child protection services from obtaining parental consent, ensuring consistent data protection across all sectors. Kenya, on the other hand, allows child protection services to bypass parental consent requirements, which, while beneficial in some cases, could also lead to gaps in oversight and accountability.

Conclusion

As it relates to child protection, Kenya lacks a comprehensive legal framework to protect children interacting with AI. While the Data Protection Act (2019) provides some safeguards, it falls short in addressing AI-specific risks, such as AI-driven exploitation, data retention policies, and targeted advertising. The USA’s COPPA includes more detail and is robust, but is in itself not without flaws. It only protects children under 13, leaving teenagers unprotected from AI-driven threats. For Kenya to adequately protect children in the AI era, it must develop clearer regulations, explicitly addressing AI-related risks, data retention, and advertising practices. Only then can it ensure that technological progress does not come at the cost of children's safety and privacy.

References

Author's bio

Shelley Jane Nyonje is an advocate of the High Court of Kenya, a legal writer, and a policy researcher with a keen interest in Law and Artificial Intelligence. She currently volunteers at the DPO Africa Network as a policy reviewer on data protection matters and serves as a Global Youth Network Member at UNICEF Innocenti. A Nasser Leadership Fellow, graduate of Strathmore University & the Kenya School of Law, Shelley is passionate about law and justice. This article honors the life and legacy of her father, a Kiswahili academic and author, who sadly passed away on April 03, 2025.

ECONOLICY AFRICA