Is your betting ID selfie biometric data under Kenyan law?

The ODPC treats a photo of a person as personal data. Whether a registration selfie is also biometric data, which the ODPC lists as sensitive, depends on how the operator processes it. The statutory definition could not be read in this run, so this guide does not decide that for you.

By WebTech Kenya Editorial (prepared with AI tools under our editorial policy) · Last updated 2026-11-04

Short answer

The ODPC treats a photo of a person as personal data. It also lists biometric data among the kinds of sensitive data. Whether your registration selfie is only a photograph or has become biometric data depends on how it is processed, and the exact statutory wording of "biometric data" was not readable when this guide was prepared.

So this guide shows what the sources do say, where they stop, and what to look for in an operator's privacy statement. The gambling rules behind the selfie step are in the guide on selfie with ID at betting registration. Gambling is addictive, and online gambling is open only to adults aged 18 and over.

What the ODPC says about photos and biometrics

The ODPC publishes a list of frequently asked questions on its website. Two answers matter here.

The Act itself is listed on the ODPC's regulatory framework page, but the copy of the Act could not be opened in this run. For that reason no section number of the Data Protection Act is cited here, and the wording of its "biometric data" definition is not quoted.

Photograph versus face template

A photograph and a biometric template are different things in practice, even if the same camera produces both. The difference lies in what is done after the shutter clicks.

1. The image as a record

   The operator stores the selfie so that a person can look at it later and compare it with the ID portrait. This is personal data. The sources read do not say it is biometric data merely because it shows a face.

2. The image compared by software

   Software compares the selfie with the document portrait and returns a match or no match. Here the image is being technically processed for identification, which is the situation where the biometric label is most likely to be argued.

3. A stored template

   If the operator keeps a numeric face template to recognise you at later logins or withdrawals, that is a separate dataset from the photo. Whether the operator does this is not stated in any gambling text read, so it is a question for its privacy statement.

The three steps above describe a general pattern, not a particular operator's system. Which step applies to you, and whether it meets the Act's definition, is something the statute text and the operator's own notice must settle. This guide cannot settle it.

What the gambling rules add

The gambling texts do not mention selfies. They set a duty to establish age and identity and a separate duty to handle the data lawfully.

Regulation 96(2) is useful for the selfie question. Whatever the label, the operator may collect the image only for a purpose directly tied to running the gambling operation, such as the identity check in regulation 85. Using it for something unrelated is outside what regulation 96(2) allows.

What to check in the privacy statement

Because the law read does not fix how a face image is stored, the operator's notice carries the detail. Terms must cover registration, player accounts and privacy statements (Ops Regs r.4(2), as set out in the guide on personal data terms for gambling accounts). Look for these points:

• Whether the notice says only "photograph" or also mentions facial recognition, face matching or biometric templates.
• The purpose given for the selfie, and whether it is limited to registration and identity checks.
• How long the image is kept and who receives it, which the guide on how long a betting company keeps your personal data explains.
• Whether the same image is reused for marketing, which regulation 96(3) bars without your prior consent.

If you are unhappy with how the image is handled

Start with the operator in writing and ask what it holds and why. The guide on requesting a copy of your data from a betting company covers that step. If the answer is not adequate, the ODPC handles complaints, and the route is set out in the guide on reporting betting data misuse to the ODPC.

Send identity images only to a licensed operator's own site or app. A copied site that asks for a selfie with ID is a fraud risk, not a verification step.

Illustrative example

Illustrative example: a player completes registration with a selfie and an ID. The operator's notice says the image is used "to confirm your identity at registration" and deleted after the check. That wording ties the image to a purpose that regulation 96(2) allows. A second operator's notice says the image is used "to recognise you and offer you products". The second purpose points towards marketing use, which regulation 96(3) bars without the player's prior consent, and it also signals that a face template may be kept, which is a question to put to the operator.