Betting website cookies and tracking: what consent the law requires

The provisions read do not mention cookies, but the Data Protection Act, 2019 covers any tracker tied to an identifiable person. Consent, where relied on, must be express, free, specific and informed, and the operator must prove it (ss.2, 32). Marketing use of gambling data needs prior consent (r.96(3)).

By WebTech Kenya Editorial (prepared with AI tools under our editorial policy) · Last updated 2026-11-13

Short answer: no cookie rule, but the consent rules still apply

None of the Kenyan provisions read for this guide uses the word cookie. That does not leave trackers outside the law. The Data Protection Act, 2019 defines an "identifiable natural person" as someone who can be identified directly or indirectly by an identifier such as "location data" or "an online identifier" (s.2), so a cookie, device identifier or similar tag linked to your account or device can be personal data.

Once data is personal data, the Act's rules on lawful processing, notice, consent and objection apply to it. The Gambling Control Act adds that an online operator's approved control system must include data protection measures under the Data Protection Act (s.68(2)(h)). The wider vocabulary is explained in the guide on personal data terms for gambling accounts.

What counts as valid consent

Section 2 defines consent as "any manifestation of express, unequivocal, free, specific and informed indication of the data subject's wishes by a statement or by a clear affirmative action". Section 32(1) puts the burden of proving consent on the controller, and s.32(2) lets you withdraw consent at any time. Withdrawal does not undo earlier processing that relied on it (s.32(3)).

The General Regulations add detail. Before seeking consent, the controller must tell you its identity, the purpose of each processing operation, the type of personal data collected, whether data is shared with third parties, your right to withdraw and the implications of giving, withholding or withdrawing consent (reg 4(1)). Under reg 4(4), consent is not considered free where it is presumed from silence, presented as a non-negotiable part of the terms, tied to a refusal that carries detriment, merged across several purposes, or ambiguous.

Consent is not the only lawful basis

Section 30(1) lets a controller process personal data if you consent for specified purposes, or if processing is necessary for a listed reason. The listed reasons include performance of a contract with you and compliance with a legal obligation. Regulation 5(2) says a controller may rely on only one legal basis for a processing activity at a time, set before the processing, and reg 5(3) says it must be demonstrable.

The Act does not say which basis suits which tracker. The table below is a reading aid: it matches common tracker purposes to the rules that bite, and it is not a list taken from the law.

Notice and transparency

Before collecting personal data, a controller must, so far as practicable, inform you of your rights, the fact and purpose of collection, third parties the data goes to, its contact details, the security measures taken, whether collection is voluntary or mandatory under a law, and the consequences of not providing the data (Act s.29(a) to (h)). A cookie banner is one way an operator might do this, but the Act prescribes no format for it.

Regulation 6(1)(d) of the General Regulations lists "information associated with web browsing" among the sources from which data may be collected indirectly. Where data is collected indirectly, the controller must inform you within fourteen days (reg 6(3)). Section 28(3) requires that personal data be collected for a purpose that is "lawful, specific and explicitly defined".

Marketing and advertising rules that sit on top

The Conduct of Gambling Operations Regulations, 2026 say data collected during gambling operations must comply with the Data Protection Act (r.96(1)), must be collected only for purposes directly related to administering the gambling operation (r.96(2)), and "shall not be used for any form of marketing without the prior consent of the participant" (r.96(3)). A tracker that feeds marketing therefore needs that prior consent whatever else the operator relies on.

Section 37(1) of the Act separately bars commercial use of personal data unless the person has obtained express consent or is authorised by a written law and told you at collection. Section 37(2) asks that data used commercially be anonymised where possible.

The Advertising Regulations govern what an advertisement may say, not how data is collected. Regulation 9 says an advertisement shall not have a call-to-action message, appeal to minors or use testimonials, among other limits, and the Act requires Authority approval for advertising (s.87(1)). They do not mention cookies, so the data side stays with the Data Protection Act.

Your rights against tracking

1. Ask what is collected and why: the right to be informed and to access your data (s.26(a), (b)).
2. Object to processing of all or part of your data (s.26(c), s.36). The controller must stop unless it shows a compelling legitimate interest or a legal-claim need.
3. For direct marketing, the right to object is absolute, including profiling related to it, and no fee may be charged. The controller must comply within fourteen days (General Regs r.8(3) to (5)).
4. Withdraw consent at any time (s.32(2)); the controller must restrict the part of processing concerned (General Regs r.4(5)).
5. Challenge automated decisions that significantly affect you (s.35), which may matter where profiling drives decisions about your account.

Illustrative example: you withdraw consent for marketing tracking on the 3rd. Fourteen days from the request is the 17th (3 + 14 = 17), so by that date the operator should have restricted that processing and told you in writing if it refuses (r.8(3), r.8(6)). Keep a dated copy of the request.

What to check on a betting site or app

Read the privacy notice for the items in s.29 and reg 4(1): the controller's identity, each purpose, third parties and how to withdraw. Check whether a choice to refuse tracking is as easy as accepting, because bundled or hidden choices cut against reg 4(4).

Phones add device-level controls, covered in betting app permissions explained and why a betting site checks your location. Saved logins sit in the browser, which is a separate risk, covered in saving betting logins on a phone browser. If tracker data is passed to outside companies, see whether a betting company can share your data.

If the operator does not comply

Write to the operator and keep the reply. Section 56 provides for complaints to the Data Commissioner, and s.63 allows penalty notices up to five million shillings or, for an undertaking, up to one per cent of annual turnover of the preceding year, whichever is lower. For marketing messages the practical steps are in how to stop betting marketing messages.

This guide is not legal advice and reflects only the provisions read on the date shown. Gambling is addictive: play responsibly, and only if you are 18 or over. Support is listed on the responsible gambling page.