Kenya is making it harder for telcos to recycle inactive phone numbers

Kenya’s telecom operators will have to change how they deactivate and recycle inactive phone numbers from September 19, when new rules from the Communications Authority of Kenya (CA) take effect. 

The rules will give subscribers more time to recover dormant numbers and require operators to remove data and services associated with previous owners before assigning those numbers to new owners.

The framework, published by the CA and seen by TechCabal, addresses a problem created by the growing role of phone numbers in everyday financial and digital life. While operators treat an unused number as a scarce telecom resource that needs to be returned to circulation, banks, lenders, government services, and online platforms can continue to treat the same number as a way to identify its previous owner. The new rules shift more responsibility for resolving that conflict onto telecom operators.

Kenya’s six-month recycling window sits between South Africa’s 90-day timeline and Nigeria’s one-year horizon. South Africa, however, exempts postpaid lines from its deactivation rules. Kenya takes a more targeted approach to protecting vulnerable subscribers, allowing formal whitelisting for inmates and remandees through prison authorities, as well as a renewable one-year exemption for caregivers of medically indisposed people. 

Kenya is also taking a stricter approach to unsolicited marketing. Unlike the largely opt-out systems used in South Africa and Nigeria, Kenya’s rules require consumers to actively opt in to business-to-consumer messages on new and recycled numbers through a business-specific USSD code.

The CA’s rationale goes beyond telecom management. It argues that mobile numbers now serve as gateways to financial services, digital authentication, and digital identity, so recycling them can pose risks spanning banking, government services, privacy, and fraud.

“Management of numbering resources, therefore, impacts the country’s financial integrity, social stability, and security,” the regulator says, pointing specifically to risks including SIM swap activity and identity theft.

The guidelines also stem from a March 2026 High Court judgment on the privacy risks of recycling mobile numbers. Advocate of the High Court of Kenya, Olukoye Micheal, told TechCabal on Wednesday that the CA’s move followed the court’s finding that a mobile number is a digital identifier linked to a subscriber’s identity. 

“When a digital identifier is lost through reallocation or recycling without interrogating the reasons behind the long period of non-use or inactivity, it creates an avenue for unauthorised disclosure of delicate information,” Olukoye said. 

The framework does not prevent operators from recycling numbers, which remains necessary because numbered resources are finite and unused numbers must eventually return to circulation. Instead, it creates a longer process before a dormant number can reach another subscriber, requiring operators to establish that the number has genuinely been abandoned rather than simply assuming that three months of silence means the owner has walked away.

A longer road back to the market

Under the new framework, a phone number can only be deactivated after three consecutive months without revenue-generating activity, such as calls, SMS, data usage, airtime top-ups, or value-added services. The operator must then spend another three months trying to reach the subscriber through SMS and other contact details provided during KYC registration.

Clauses 4.3 and 4.6 require operators to continue these notifications for three months and, 30 days before the deadline, to publish lists of numbers still at risk of being deactivated and recycled. The lists must appear in national newspapers, broadcast media and on the operators’ websites. For operators with millions of subscribers, that could become a high recurring cost. A quarter- to half-page advert in newspapers such as Daily Nation or The Standard can cost KES 400,000–800,000 ($3,000–$6,000) per placement, meaning quarterly publication of large lists could add a substantial compliance bill.

The rules also require operators to keep records of their notification efforts and subscribers’ USSD marketing consents for as long as the number remains active. Clauses 4.11 and 6.4 require that these records be maintained in accordance with Kenya’s Data Protection Act, 2019. For operators processing millions of numbers and potentially huge volumes of opt-in and opt-out requests, this means investing in storage, indexing, and secure archiving systems that can preserve and retrieve records when needed for regulatory audits or consumer disputes.

The number is only part of the problem

The bigger change is that the CA no longer treats the phone number itself as the end of the operator’s responsibility. 

Before a recycled number is assigned to a new subscriber, operators must “de-link and securely archive the personal data, cached data, and services associated with the previous owner.” The aim is to ensure the new user does not inherit access to accounts or services linked to the previous owner.

That matters because a number can be inactive on a telecom network while remaining tied to a bank account, loan, government service, or online platform. Simply assigning the number to someone else does not automatically remove those connections, creating a risk that the new owner could receive sensitive messages or gain access to services meant for the previous subscriber.

To reduce that risk, the CA plans to establish a centralised database of deactivated and recycled numbers. Operators will submit updated lists every quarter, allowing banks, lenders, government agencies and other third parties to update their records before contacting customers. The database will not be operational when the new rules take effect on September 19; the CA says those requirements will apply once the system is established.

Safaricom, Airtel Kenya and other operators will need systems that track inactivity, trigger attempts to contact subscribers and keep records of those efforts. The operators must also ensure old data and services do not follow a number to its new owner.

The CA has also made room for people whose numbers may remain unused for reasons other than abandonment, including prisoners serving more than six months and people who are indisposed and unable to use their numbers for an extended period. Caregivers can request that such numbers be whitelisted for one year at a time, with renewals possible as long as the conditions remain in place.

The shift is therefore less about ending number recycling than changing who carries the risk when it happens. Operators still need access to a finite pool of numbers, but from September 19, they will have to spend more time verifying that a number is ready to be recycled and take greater responsibility for separating the number from the personal data, services, and permissions associated with it.

True scale demands moving beyond surface-level integrations to robust execution. We’ve filtered the noise out of Moonshot 2026, optimising the conference strictly for high-calibre connections between startup founders, global financial operators, enterprise leaders, and individuals rewiring Africa’s technical frameworks. Get 20% off Early Bird tickets for a limited time.