Safaricom

Kenya's National Assembly Public Petitions Committee formally received, on October 3, 2026, a petition challenging Safaricom's practice of deactivating SIM cards after roughly six months of inactivity and later reassigning the numbers, which leaves M-Pesa mobile-money balances difficult or impossible for customers and - in several cited cases - deceased subscribers' estates to recover. The petition questions whether the practice complies with Kenya's Law of Succession Act (which bars unauthorized intermeddling with a deceased person's property) and the Unclaimed Financial Assets Act, and whether unrecovered balances are properly remitted to the Unclaimed Financial Assets Authority (UFAA). On October 6, 2026, Communications Authority of Kenya Director-General David Mugonyi appeared before the committee; as of the most recent hearing no new recovery mechanism had been established. The committee's inquiry is expected to also hear from Safaricom, the Central Bank of Kenya, UFAA, and consumer representatives.

In Matey v Safaricom PLC [2026] KEHC 13624 (KLR), the High Court of Kenya ruled on September 18, 2026 that a Safaricom customer has a constitutional right to know who accessed her personal data, after the company resisted disclosure for months. Justice David Mburu ordered Safaricom to provide certified subscriber details, access logs, audit trails and disclosure records covering two phone numbers for the period March 2024-January 2025, within 21 days, citing Article 35 of Kenya's Constitution and the Data Protection Act. The court noted it could not compel production of records that do not exist or were lawfully deleted under retention policies. The ruling follows a separate, still-pending petition by the Law Society of Kenya against Safaricom, the Directorate of Criminal Investigations and 42 other respondents alleging a systemic, warrantless data-sharing arrangement with investigative agencies.

On September 15, 2026, a three-judge bench of Kenya's High Court (Justices Francis Gikonyo, Roselyn Aburili and Teresia Wanjiku) declared null and void the Kenyan government's sale of a 15% Safaricom stake to Vodacom for KES 204.3 billion (plus KES 40.2 billion paid in advance against future dividends), part of the June 30, 2026 transaction that raised Vodacom's Safaricom ownership from roughly 35% to 55%. The court found the transaction violated the Constitution through inadequate public participation, concealment of material information from the public and Parliament, an arbitrary pricing process, failure to address national-security concerns, and mischaracterizing what was effectively a takeover as a partial divestiture. Kenya's Court of Appeal fast-tracked the government/Vodacom's substantive appeal on October 13, 2026 rather than ruling separately on a stay request; as of the sweep date, Vodafone Kenya remains the registered shareholder and the purchase money remains held pending the appeal, so the July 31, 2026 governance changes handing Vodacom expanded board and CEO-nomination control remain in place but legally unresolved.

Following Vodacom's June 30, 2026 completion of a deal buying a controlling 55% stake in Safaricom (KES 204bn/EUR1.36bn for 15% from the Kenyan government plus KES 68bn/EUR450m for 5% from Vodafone), Safaricom sought and won shareholder approval on July 31, 2026 to remove long-standing governance protections tied to Kenyan-government ownership. The changes give Vodafone/Vodacom the right to nominate the CEO and all executive and shareholder-appointed directors (previously requiring board/government input), remove the requirement for government approval before regional expansion including into Ethiopia, eliminate the requirement that the executive committee be 'predominantly Kenyan', replace prior 10%/40% ownership-threshold protections with a single 50% threshold, and drop the mandatory dividend policy. Vodacom subsequently appointed two South African executives to Safaricom's board, increasing its board representation to 5 seats while Kenyan-government ownership fell from 35% to 20%.

On July 13, 2026 Justice Asenath Ongeri ruled that Safaricom and Diamond Trust Bank must compensate a customer who lost KES 4.4 million to SIM-swap fraud, apportioning 60% of liability (about KES 2.63 million) to Safaricom and 40% to the bank. The court found that permitting the fraudulent SIM swap was 'a direct and proximate cause of the loss', rejected the argument that a correctly entered PIN absolves the providers, and dismissed Safaricom's cross-appeal against its liability share. The ruling sets a consumer-protection precedent for Kenya's mobile-money ecosystem.

Al Jazeera's 'Invisible Eyes' documentary (May 2026) exposed that Safaricom allowed Kenyan security agencies access to subscriber location data, call records, and M-Pesa financial transactions -- often without court orders -- to surveil, locate, and track activists and protesters. A Safaricom employee admitted in court to complying with a government data request without a court order. The Law Society of Kenya filed a constitutional petition seeking a court audit of all data requests from June 2024 to December 2025.

On May 18, 2026 the High Court of Kenya ordered Safaricom to pay 9.9 million Kenyan shillings to a customer over a client data breach, holding that Safaricom could not escape liability by blaming individual employees. The judgment established that companies bear institutional responsibility for documented access controls, monitoring systems, and breach detection. Local commentary described the ruling as exposing systemic failures in Safaricom's customer-data protection regime.

Kenya's High Court (Constitutional Petition E095 of 2026, Justice Bahati Mwamuye) ruled on May 13, 2026 that Safaricom violated the constitutional data-privacy rights of 11 subscribers whose personal information was harvested and offered for sale by a Safaricom employee in 2019. The employee, who had unrestricted access to subscriber records, extracted data on roughly 11.5 million betting-platform customers (names, IDs, mobile numbers, gambling activity, device identifiers, and location data) and attempted to sell it to a rival betting company before informants exposed the scheme. Court records showed Safaricom's litigation team initially denied any breach occurred in a 2019 affidavit, only admitting the incident three months later. The court awarded each of the 11 petitioners KES 900,000 (total KES 9.9 million) and established that data controllers owe a 'positive and non-delegable' constitutional duty to safeguard customer data that cannot be shifted onto individual 'rogue' employees, and that harm need not be financial to be compensable.

In Muoki & another v Safaricom PLC & another [2026] KEHC 6326 (KLR), the Kenyan High Court found that Safaricom copied software developer Peter Nthei Muoki's 'M-Teen Mobile Wallet USSD Code' to launch its own nearly identical 'Manage Child Account' / 'Manage Junior Account' feature (USSD code *334#) without license or compensation. The court awarded KES 1,400,067,000 (~$10.8M) in general damages plus interest, and ordered Safaricom to pay an ongoing royalty of 0.5% of gross M-Pesa revenue annually, starting from the financial year ended March 31, 2025, for as long as it operates the infringing or substantially similar functionality.

Kenyan petitioner Victor Odhiambo sued Safaricom in April 2026, alleging its deployment of AI systems - including the Zuri customer-service chatbot, automated fraud detection, and M-Pesa transaction/credit decisions - violates constitutional consumer-protection and data-rights guarantees because the systems lack meaningful human review, transparency, or published risk assessments. The petition seeks declarations that the AI systems are unlawful and court orders compelling Safaricom to introduce human review mechanisms, improve transparency, and publish risk assessments, plus regulatory directions for state agencies to strengthen AI oversight. As of filing, Safaricom had not filed a response and the case was pending directions for hearing.

After Safaricom's billing system failed to charge daily Fuliza overdraft fees between February 26 and March 20, 2026, the company applied a single lump-sum 'catch-up adjustment' deducting the accumulated unbilled fees from affected M-Pesa accounts simultaneously, without itemized statements or advance customer consent. Affected customers, including a Nairobi law firm partner who called the deduction 'theft,' said they received no forewarning before funds were withdrawn. Safaricom confirmed the one-time adjustment covered all affected accounts and said no further adjustments would follow, but did not offer itemized billing or an opt-out. The episode adds to a pattern of customer complaints about non-consensual Fuliza-linked deductions from M-Pesa balances.

In March 2026, Safaricom introduced mandatory masking of sender mobile numbers displayed in M-Pesa transaction messages, a data-minimization measure intended to curb fraud and unwanted contact enabled by exposed phone numbers. The company said the change was part of a wider privacy-by-design push, alongside its ISO/IEC 27701:2019 privacy certification. The feature applies broadly to P2P transactions and cannot be opted out of, though transaction verification and reversal mechanisms remain in place.