Blog

Ever snapped a selfie at Uhuru Park or checked in at a mall without a second thought? In Kenya today, our social media is like one giant never-ending tea session – and everyone is invited. But here is the catch: every photo, post or check-in is a little clue for the internet’s nosiest characters. In fact, one study found “significant knowledge gaps” among Kenyan social media users about basic privacy settings and security, even as many report facing online threats. In other words: we know we should care about privacy, but most of us treat it like that privacy policy popup – we click “Accept” without reading!

Let us stroll through some all-too-relatable Kenyan scenarios. Imagine 20-year-old Wambui, bragging on Twitter about her new job: “Thank God I didn’t even deserve this job, but hey it happened!” (We have all seen tweets like that). Little does she know, her future boss is one Google search away – and bragging about undeserved success can backfire. In fact, a viral Kenyan X (formerly Twitter) user warned exactly this: publicly admitting you did not “merit” your new job can make employers revoke the offer. Yikes.

Meanwhile, Mutahi is painting Nairobi’s skyline on Instagram – tagging “#ChasingDreams at HotelX” – and security thieves are taking notes. Every public post is a breadcrumb on your digital trail. And yes, as one tech blog quipped, beneath all our selfies and hashtags there is a “darker economy… of deception, stolen identities and broken trust”. In Kenya, scammers have even cloned pastors’ and CEOs’ profiles – complete with their photos and made-up stories – to dupe victims. In short, oversharing your life online can turn you into an unwitting mark for identity theft, stalking and fraud. It is not paranoia if it is happening: researchers note that many Kenyans repeatedly see threats online but do not know how to defend against them.

Geo-Tagging: An Invisible Map in Your Photos

Your holiday selfies are cute – but did you leave a map for burglars embedded in them? Many phones automatically geotag photos with GPS data. A famous example: journalists once analysed a family’s vacation photos and, via GPS tags, mapped out the very layout of their home – bedrooms, living room, even the kids’ school and playground. It sounds like a movie plot, but it is real. The photos handed over all the directions. (Parents, if your teen is geotagging everywhere, it is like telling thieves “I am out, break in now!”.)

It gets scarier. Geo-tags have even had tragic global consequences. One case: soldiers posted location-tagged photos of an airfield, and that info led an enemy to destroy Apache helicopters. In Kenya we are not dodging missiles – but imagine criminals watching your check-ins. Post that cool new car with a location tag, and you have just told the bad actors exactly where to hunt. So switch off “Add location” in settings, or edit that photo before posting. Treat every geotag like a loudspeaker announcing your whereabouts.

Free Wi-Fi: A Hacker’s Buffet

You are chilling at a café in Nairobi, sipping coffee and happily logging into an app on the free Wi-Fi. Innocent, right? Actually, anyone else on that network can snoop on your data like it is open season. Security experts warn that free public Wi-Fi is “uncontrolled by design” – an open invitation to attackers. A hacker on the same hotspot can capture your web sessions with a man-in-the-middle trick (think: fake “BaristaWiFi” hotspots or ARP spoofing). They do not even need your password if your login session is still active.

In tech-speak, attackers on public Wi-Fi often steal session tokens (the digital keys that keep you logged in) instead of trying to crack your password. The result? They quietly hijack your social media, email or banking sessions without a hint. Even “HTTPS” (the lock icon) cannot fully protect you from this kind of snooping. So the next time you are tempted by “free” Wi-Fi, remember what one cybersecurity blog notes: many real account takeovers trace right back to public hotspots because hackers exploit the “visibility and trust gaps” on those networks. Bottom line: if you must use public Wi-Fi, install a VPN or at least log out of sensitive apps. Your data will thank you.

App Permissions: Are You Spying on Yourself?

Have you ever gone through that “give permissions” screen and hit “Allow everything” just to get to the game? Do not feel bad – everyone is guilty. But remember: every app is basically asking, “May I rummage through your phone?” When you grant a teeny app access to your camera, microphone, contacts, photos and location, you are handing over the keys to your digital kingdom.

Consider the locally notorious example: that flashy new camera app or random game with a ton of ads might request your contacts and location – “just to improve the experience.” In reality, it could be collecting phone numbers and whereabouts for data brokers. And if an app asks to use your mic or camera, ask yourself why: is it a karaoke app, or is it listening in on your private conversations? We joke that phone apps are like that one nosy auntie who wants all your secrets; do not hand them permission to snoop by default. Go through Settings → Apps and disable anything creepy you do not need. It might save you from getting “scandal photos” snapped or voice data leaked to strangers.

Data Protection Act 2019: The Law (In Your Corner)

Yes, I know – African laws sound dry. But Kenya’s Data Protection Act (2019) is actually on your side. It was put in place precisely to enshrine Article 31 of the Constitution (our right to privacy) and to force companies to handle your data responsibly. Think of it as Kenya’s own GDPR: it empowers individuals with “enforceable rights over their personal information”. In short, they can’t just use or leak your data without consequences.

And the commissioner is serious. By 2025 Kenyans have already won big in privacy cases. The Data Commissioner fined firms over KSh 30 million in one year for misusing personal data. True story: companies have been ordered to pay heavy compensation – like a bank sending unwanted loan calls had to pay KSh 900,000. Even a hotel ripped wedding photos and got slapped with KSh 750,000 in damages. The lesson? The law says your face and data cannot be weaponized without consequences.

That said, do not expect Wikipedia-level enforcement on day one. The DPA is still young, and awareness is catching up. It does give you rights (like demanding your data be deleted), but you have to assert them. In the meantime, be your own data bodyguard.

The Ghosts of Digital Past: Footprints That Haunt

Time for a reality check: the internet never forgets. Anything you post today could pop up during a job interview or a date next year. Picture this: you posted that hilarious (or embarrassing) TikTok after one too many at that concert. Fast forward, and your potential boss is one Google search or background-check away. Did you really want your clubbing dance moves on your career resume? (Note: the answer is probably not.)

Kenyan social media users get it. A local online sage put it bluntly: “You can thank God for a new job – but best do it in private, not on social media.” Because, as the viral tweet put it, some blessings need no microphone. In other words, advertise grace with caution.

And it is not just work. Dating profiles are digital dossiers, too. That “harmless” ex who still lurks on your posts is not just checking if you recovered from heartbreak – they see everything. In pop-culture terms, your old posts and pics are like Casper the Friendly Ghost: they might not bother you… until they reappear to spook your love life or career. Future partners or employers acting like Spiderman pointing memes? That’s you on one side, your own past post on the other, both accusing each other of being cringe. (Yes, it’s meme-worthy – and real.)

Risks Lurking in the Digital Jungle

So what exactly are the monsters in our safari of oversharing? Let us name them:

• Identity Theft: Someone grabs enough personal tidbits (Date Of Birth, mother’s maiden name, even your pet’s name) from your posts and poof, they are applying for loans or opening accounts in your name.

• Stalking and Physical Threat: Creepy actors or opportunistic thieves can track down addresses, routines or personal info from your online life.

• Financial Fraud: A smart scammer can impersonate you to trick your family or even fish your MPESA PIN if you are unlucky and unprotected. Remember, WhatsApp pages can be fake fundraisers trying to harvest both cash and contacts.

• Reputation Damage: One drunken party tweet or controversial meme decades old can resurface on the internet. We’ve seen careers and relationships tank over tweets that “went viral” for the wrong reasons.

• Legal Trouble: Finally, some posts can actually get you in legal trouble (defamation, cyberbullying, etc.). We’re not lawyers here, but even the Computer Misuse and Cybercrimes Act is watching what we say online.

In short, every unchecked like, check-in or permission is a potential crack in your digital armor. One Kenyan blog puts it well: social media should be a force multiplier, not a hunting ground for predators. Use healthy doubt as your shield: pause before you click or post. Ask yourself, “Who benefits if I rush into sharing this?”.

Quick Survival Tips

Before we wrap up, here are some no-nonsense tips (no jargon, promise) to keep your digital life on the bright side:

• Trim Your Timeline: Audit old profiles. Delete outdated posts or photos that could embarrass you or reveal too much (like your ID photos, boarding passes, or home videos).

• Lock It Down: Make personal accounts private whenever possible. (But remember, screenshots never forget.) Also disable unnecessary location tagging in apps and photo uploads.

• Password Power: Use strong, unique passwords and turn on two-factor authentication for email, social and banking apps. If it is too much work, use a password manager.

• Be Wi-Fi Wise: Avoid logging into sensitive accounts on public networks. If you must, use your mobile network or a trusted VPN. It is like using a napkin at that roadside ‘choma’ stand – better safe than sorry!

• Permission Patrol: Review the permissions you have granted to each app. If a calculator app wants to use your camera, reconsider (unless it is really a smart calculator).

• Think Twice Before You Tap: If a post or share feels juicy or controversial, ask: “Would my mom, boss or future spouse think this is wise?” If in doubt, do not post.

Keeping your personal data safe is not about fear; it is about common sense and a bit of street smarts. And remember – a little privacy goes a long way.

Interact with us:- For more tips, tools, and resources, follow us on Tiktok, X, Facebook, Instagram and LinkedIn.    

By:-
Jane Ndambuki
Education and Training Manager