The curious thing about Kenya’s proposed internet-billing rules is that the technology they seek to mandate is already being used.

By Muturi Githae

Faiba customers can see how much data they consume. The network can measure usage. Bills can be verified. Yet Parliament is considering legislation that could push internet providers towards a consumption-based model—and require them to hand over detailed subscriber information to the state.

Jamii Telecommunications, the operator of Faiba, thinks this is unnecessary and potentially expensive.

It also thinks it could be dangerous.

The company made its case on August 13th before the National Assembly’s Departmental Committee on Communication, Information and Innovation, which is considering amendments to the Kenya Information and Communications Act. At issue is Section 27A(3C) of the Kenya Information and Communications (Amendment) Bill, 2025, which proposes that internet services be billed according to consumption.

JTL’s chief executive, Dr C.K. Joshua, does not object to customers knowing what they consume. Quite the contrary.

“They can be able to see their consumption, but they can choose the model that they would want,” he told MPs.

That last bit is the dispute.

The Bill, JTL argues, could effectively squeeze out unlimited and speed-tiered packages used by households, businesses, schools and other institutions. The company wants Parliament to preserve those options provided customers receive proper information.

“The Bill should preserve diverse, lawful billing models, including unlimited and speed-tiered packages, so long as customers receive clear, verifiable and accurate billing information,” Joshua said.

It is a reasonable distinction. Measurement is not the same thing as pricing.

Faiba already operates both systems. Its mobile customers purchase data bundles and pay according to usage. Its fixed broadband customers can instead buy unlimited connections priced according to speed. JTL says the infrastructure needed to measure consumption and provide verifiable billing is already in place.

“The capabilities contemplated by the Bill, accurate usage measurement, customer access to usage information and verifiable billing, are already operational within JTL’s network,” Joshua said.

So why legislate a particular billing model?

Part of the answer is consumer protection. Parliament wants customers to understand what they are paying for. Few would object to that. The more difficult question is whether the state should determine the commercial architecture through which every internet connection is sold.

There is a cost to that.

JTL says mandatory consumption billing could require operators to spend heavily on Deep Packet Inspection infrastructure and more sophisticated billing systems capable of tracking usage down to individual megabytes. Those costs, as costs usually do, would eventually find someone to pay them.

The customer, most likely.

Joshua put the company’s objection in distinctly economic terms:

“A requirement to invoice per unit of consumption would price the service on an input that no longer drives cost.”

That is the crux.

Fixed broadband is not electricity. An additional hour of streaming does not necessarily create a neat additional cost for the operator equivalent to another unit of electricity consumed by a household appliance. Much of the network’s cost is tied to capacity already installed.

Pricing by speed can therefore make more sense than pricing by every byte transferred.

The distinction is technical. Its consequences are not.

A small business may prefer an unlimited connection because it can budget for a predictable monthly charge. A school may want the same thing. A household with several users may value it differently from a customer who barely uses the internet. Forcing all of them into one model could produce greater transparency while reducing choice.

A curious bargain.

Then there is the more serious issue: data.

The proposed rules would require annual submission of subscriber-level usage information. JTL says collecting granular records of individual internet activity would create a potentially dangerous concentration of personal information.

Its warning is stark:

“Aggregating sensitive, personally identifiable usage data within a single State repository creates a high-value target for cybersecurity attacks and catastrophic data breaches.”

This is not merely a question of whether a database can be hacked. It is a question of what information needs to exist in the database in the first place.

JTL argues that annual regulatory returns should exclude sensitive personal information and identifiable subscriber-level usage records. The company says such a requirement could conflict with Kenya’s Data Protection Act and Article 31 of the Constitution, which protects privacy.

The regulator’s dilemma is familiar. To supervise a market effectively, it needs information. But the more information it collects, the more attractive the resulting repository becomes.

The State’s appetite for data has rarely been matched by an equally impressive appetite for explaining what happens to it afterwards.

Parliament’s committee chairman, John Kiarie, did not dismiss the concern. He pointed instead to an older Kenyan problem: enforcement.

“This committee has actually taken steps in the direction that you’re proposing. Enforcement might be an issue,” Kiarie said.

That may be the most consequential sentence of the hearing.

Kenya has no shortage of legislation covering cybersecurity, privacy and data protection. What it has less consistently demonstrated is the ability to enforce every obligation cleanly, quickly and without institutional overlap.

Adding another obligation to collect and transmit detailed subscriber information creates another system to secure, audit and police.

And another system can fail.

The committee says it wants stakeholder views before making recommendations on the Bill. JTL is asking for a relatively simple compromise: retain transparent measurement and billing, but allow customers to choose between lawful models rather than forcing everyone into consumption-based charging.

That should not be difficult to understand.

Nor should the privacy argument.

The state does not need to know everything merely because technology makes everything measurable. Sometimes the cleverer regulation is the regulation that asks for less.

Kenya’s digital economy is expanding rapidly. Internet access is no longer an optional extra for many businesses, schools and households. A law that makes connectivity more expensive would therefore have consequences beyond the telecoms industry.

So would a law that creates a vast new trove of information about what citizens do online.

Parliament has two objectives that are individually sensible: better consumer protection and better regulatory oversight. The trick is not to achieve one by quietly making the other more expensive.

Or less private.

The Bill is still being considered. That leaves Parliament with an opportunity to fix the problem before it becomes one—particularly the part nobody will be able to uncollect.