The Communications Authority of Kenya (CA) has dismissed reports that new SIM card registration rules require subscribers to submit DNA, fingerprints, retinal scans or other sensitive biometric data.

The regulator described the concerns as unfounded and said it has not issued any directive to collect such information.

In a statement released on Tuesday, November 18, 2025, the CA said the revised SIM card regulations published in May 2025 have been misunderstood. It explained that the aim of the new rules is to curb fraud linked to mobile lines, strengthen trust in the telecommunications sector, and support secure access to digital services such as mobile money, e-government and e-commerce.

According to the Authority, the rules do not contain any requirement for the collection of biometric data. The regulations define biometric data broadly, including DNA, fingerprints, blood typing and retinal scans, but the CA stressed that this definition does not translate into mandatory collection during SIM registration.

The CA said it has not instructed any operator to take such data from subscribers.

“The New Sim Card Regulations do not contain any provision for the collection of biometric data,” the authority stated.

“The regulations define biometric data as personal data derived from specific technical processing based on physical, physiological, or behavioural characteristics, including blood typing, DNA analysis, fingerprints, earlobe geometry, retinal scans, and voice recognition.”

“This definition does not mean that all this information will be collected from subscribers during SIM card registration. As a matter of fact, the Authority has not directed our licensees to collect this data.”

Data protection

The regulator also addressed concerns over privacy. It said telecommunications operators must handle and store subscriber information in line with the Kenya Information and Communications Act of 1998 and the Data Protection Act of 2019.

Operators are barred from sharing customer data without consent or a lawful order. The CA and the Office of the Data Protection Commissioner will carry out regular audits and issue penalties where they find misuse.

On service suspension, the Authority said operators may only suspend a SIM card after giving prior notice. Suspension will apply only when a subscriber provides false details or ignores registration requirements. The CA said operators must maintain clear and fair procedures in all dealings with consumers.

The statement also noted the growing frustration among Kenyans over spam messages, unsolicited subscriptions and the unauthorised use of phone numbers on premium services.

The CA said these issues form part of a wider effort to protect consumers and improve accountability across networks. The improved SIM registration process is one of the measures meant to reduce misuse.

The Authority added that it supports innovations that promote privacy, such as number masking on mobile payment platforms. It said such features help strengthen digital trust as more services move online.

The CA reaffirmed its commitment to digital transformation, saying it will continue working with industry players to improve safety, protect consumer rights and maintain transparent regulation in the ICT sector.