Recent enforcement actions by the Office of the Data Protection Commissioner (ODPC) against businesses sending unsolicited marketing messages have sparked animated debate across Kenya’s SME ecosystem.
On one side are those who argue that the regulator is simply upholding the law. On the other, businesses argue they are being misunderstood, asserting that consent is implicitly granted during routine mobile money transactions.
This tension is understandable. But it risks obscuring the more important reality: compliance is the gateway to a more sustainable, trusted, and effective digital marketing ecosystem.
The Myth of Implicit Consent
I agree with the regulator’s position that payment interactions do not constitute “express, unequivocal, free, specific and informed” consent. This is supported by how people actually behave.
When a consumer is settling a bill, buying airtime, or completing a transaction, their cognitive focus is on the fulfillment, not future marketing engagement. Treating this moment as implicit permission for promotional messaging is wrong.
Global privacy norms have drawn a clear boundary between the two, and Kenya is aligning with that direction. Importantly, this clarity benefits businesses. Ambiguous consent creates legal risk and customer resentment; clear standards create predictability.