‘Fake news’ offences struck down in Cybercrimes Act: What the ruling means for journalists and social media

thenamlola@gmail.com

The Court of Appeal on Friday struck down controversial “fake news” provisions in the Computer Misuse and Cybercrimes Act, in a landmark ruling expected to strengthen media freedom and online expression in Kenya.

A three-judge bench comprising Justices Patrick Kiage, Aggrey Muchelule and Weldon Korir declared sections 22 and 23 of the Computer Misuse and Cybercrimes Act, 2018 unconstitutional, saying they were overly broad and could criminalise ordinary online communication.

The decision followed an appeal by the Bloggers Association of Kenya (BAKE) challenging a 2020 High Court ruling by Justice James Makau, which had upheld the provisions.

The judges said the sections were “so broad, wide, untargeted, akin to unguided missiles and likely to net innocent citizens.”

The ruling has major implications for journalists, bloggers, social media users and digital rights in Kenya.

Who filed the case and why?

The case was filed by the Bloggers Association of Kenya (BAKE) shortly after the Cybercrimes Act came into force in 2018.

BAKE argued that some provisions of the law:

• violated freedom of expression
• were vague and overly broad
• could be used to arrest journalists, bloggers and social media users.

The respondents in the case included the Attorney General, the Director of Public Prosecutions, the Inspector General of Police and the Communications Authority of Kenya, who defended the law.

In 2020, the High Court dismissed BAKE’s petition, ruling that the provisions were constitutional.

BAKE later appealed the decision at the Court of Appeal, leading to the ruling delivered on March 6, 2026.

Which sections of the Cybercrimes Act were struck down?

The Court of Appeal invalidated sections 22 and 23 of the Act.

Section 22 – False publications

This provision criminalised publishing false, misleading or fictitious information online if it was intended to be treated as authentic.

Section 23 – False information

This section criminalised knowingly publishing false information likely to cause:

• panic
• violence
• public disorder
• damage to someone’s reputation

The judges ruled that the provisions were too broad and vague, meaning they could criminalise ordinary social media activity or journalism.

The court said such laws must respect Article 33 of the Constitution, which protects freedom of expression.

Which parts of the Cybercrimes Act remain in force?

The ruling did not invalidate the entire law. Several provisions remain valid, including offences related to:

• cyber harassment
• child pornography
• identity theft
• cybersquatting (bad-faith domain name registration)

Other provisions governing cybercrime investigations and digital surveillance also remain in place.

However, the Court emphasised that these powers must be exercised with strict judicial oversight and respect for constitutional rights.

What does the ruling mean for journalists and media freedom?

The judgment significantly strengthens protections for journalists, bloggers and digital publishers.

Key implications include:

• journalists cannot automatically face criminal charges for publishing inaccurate information
• sharing or forwarding content unknowingly is no longer criminalised under the struck-down provisions
• laws regulating online speech must be clear, specific, and proportionate.

The court also cited international jurisprudence, including decisions of the European Court of Human Rights and the U.S. Supreme Court, which recognise that even false speech may be protected unless deliberately harmful.

How does the ruling affect social media users?

The decision offers important protections for ordinary internet users.

Under the ruling:

Users cannot be criminalised for forwarding or sharing information unknowingly

Citizens can participate in online debate and political discussion without fear of vague criminal charges

However, deliberate falsehoods intended to incite violence, panic or hatred can still be prosecuted under other laws.

These include the National Cohesion and Integration Act, which criminalises hate speech and incitement.

What about privacy and digital surveillance?

The Court also clarified how authorities should use digital surveillance powers under the Cybercrimes Act.

The judges ruled that:

• surveillance must generally be authorised by a court
• data collection must be limited to what is necessary for investigations
• authorities must ensure secure storage and eventual deletion of collected data

These safeguards protect the constitutional right to privacy while allowing investigators to combat cybercrime.

The decision is one of the most important rulings on digital rights in Kenya.

The court emphasized that laws regulating cyberspace must protect citizens from harm without suppressing legitimate debate or journalism.

The judgment also sets a precedent on how courts should interpret laws affecting online speech and media freedom.