Advertising and SEO agencies in Kenya: the data protection rules and how to hire one

To hire an advertising agency, SEO company or digital marketing agency in Kenya, check four things before price: that the firm is registered with the Business Registration Service, that it is registered with the Office of the Data Protection Commissioner where the law requires it, that its SMS, email and targeted ads follow the Data Protection Act 2019 and its 2021 regulations, and that every Google, Meta and website account it opens is in your company's name. Google handles almost 97% of searches in Kenya and nearly every customer is on a phone, so the work is mobile-first Google SEO, a strong Business Profile, and social media spread across more platforms than in most markets.

The Kenyan market an agency works in

StatCounter's September 2026 figures for Kenya show Google with 96.87% of search and Bing with 2.59%. On social media the split is unusually even: Facebook sends 29.59% of the social visits to websites, YouTube 22.34%, Instagram 17.09%, X (Twitter) 16.65%, LinkedIn 6.18% and Pinterest 5.47%. An agency that only knows Facebook will miss a large share of your audience.

The Communications Authority of Kenya's sector statistics for April to June 2026 counted 88.0 million active mobile subscriptions at 30 June 2026, a mobile penetration rate of 165.0%, with 97.1% of them prepaid. Mobile money subscriptions stood at 54,005,800. Plan for small screens, slow connections and mobile money payment: pages must load fast, show the phone number and WhatsApp link at the top, and make paying easy.

The Data Protection Act and your marketing

The Data Protection Act 2019 and the Data Protection (General) Regulations 2021 set the rules a marketing agency works under. The parts that matter most:

• Commercial use needs consent. Section 37 says personal data may not be used for commercial purposes unless the person has given express consent, or the use is authorised by law and the person was told when the data was collected.
• What counts as direct marketing. Regulation 14 includes sending a catalogue, showing an advertisement on an online site where the person is logged in using their personal data, and sending an electronic message about a sale. Marketing is not direct where personal data is not used to identify or target particular recipients.
• Conditions for direct marketing. Regulation 15 lets you use personal data, other than sensitive data, for direct marketing where you collected it from the person, told them marketing was a purpose, and they consented, with a simple way to opt out that they have not used.
• Opt out in every message. Regulation 17 lists the mechanisms: a single-word reply to a text message, a prominent link in an email, telling the person on a call that they can opt out verbally, and instructions in each message. One option must be to opt out of all future marketing.
• No profiling of children for marketing. Regulation 13 prohibits profiling of a child that is related to direct marketing.

The Communications Authority's Consumer Protection Regulations 2010 add a separate rule. Regulation 17 makes it an offence to use automated calling, fax or email for direct marketing without the subscriber's prior consent, or to send marketing email that hides the sender or has no valid address for asking it to stop.

Registration with the Data Commissioner

The ODPC's FAQ says section 18 of the Act and the Registration Regulations 2021 require organisations processing personal data to register, and that registration opened on 14 July 2022. A business is exempt only if it has annual turnover below KES 5 million and fewer than ten employees. That exemption does not apply to anyone processing data for a purpose in the regulations' Third Schedule, which includes businesses wholly or mainly in direct marketing, hospitality, property management, financial services, education, health and transport.

So an agency whose business is mainly SMS or email campaigns may need to register however small it is. The Second Schedule sets the fees: KES 4,000 to register and KES 2,000 to renew every two years for a micro or small data controller or processor, rising to KES 16,000 and 9,000 for medium and KES 40,000 and 25,000 for large ones. Ask the agency for its certificate, and check it on the ODPC's register of data handlers.

Advertising claims and the Competition Authority

The Competition Authority of Kenya's Consumer Protection Department enforces Part VI of the Competition Act, sections 55 to 70. Its core work is investigating false or misleading representations, unconscionable conduct and unsafe goods. Its remedies include refunds and the withdrawal of misleading representations. A claim such as "Kenya's number one", "best price in Nairobi" or a before-and-after photo needs evidence before it runs.

For influencer work, insist that paid posts are clearly marked as ads and that the agency keeps a record of what each creator was paid or given. Our comparison of influencer agencies by the platform the work lands on is a useful way to brief one, given how spread out Kenyan social traffic is.

Google Ads, PPC and VAT

Google's help centre says that from 1 February 2023 Google charges 16% tax on Google Ads for customers with a billing address in Kenya, and that customers should add their KRA PIN to the Google Ads account so invoices are valid for VAT recovery. Budget for the 16%, and make sure the PIN on the account is your company's. Keep the media spend separate from the agency's fee, and check Keyword Planner's top of page bids for your own terms with the location set to Kenya, Nairobi or Mombasa before agreeing a budget.

What to put in the brief

Service	What to ask for in writing
SEO	Pages written or fixed each month, mobile speed work, Search Console in your name
Local SEO	The Business Profile owned by you, with a real address or service area and your WhatsApp number
Social media and influencers	Platforms by audience, who approves posts, how paid posts are marked, how WhatsApp enquiries are counted
PPC and Google Ads	Account in your name, KRA PIN on the account, spend separate from fee
SMS and email	Consent records, opt-out wording in every message, the agency's ODPC certificate
Outdoor and BTL	Which county permits are needed and whose name each permit is in

Pricing is by monthly retainer, fixed project or hourly rate. Compare quotes on hours, named people, line items and exclusions. The Marketing Society of Kenya runs individual and corporate membership and a Practitioner Diploma in Marketing, so membership or the diploma is one thing to ask about. Google's own advice is plain: "No one can guarantee a #1 ranking on Google."

Nairobi, Mombasa and the counties

Nairobi. The national rules above apply in Nairobi as everywhere else. The local layer is the county: Nairobi City County's eServices portal lists outdoor advertisement and business licensing among its services. For a billboard, a branded vehicle or a shop sign, ask your agency to name the permit it will apply for and to put it in your name. For search, a Nairobi business competes by neighbourhood, so set your Business Profile to your real address or the areas you serve, and write a page for each service.

Mombasa. The County Government of Mombasa lists business permits among its digital services. Hospitality firms are in the Third Schedule (it excludes tour guides), so hotels and restaurants in Mombasa must register with the ODPC even if they are small.

Other counties. Each county sets its own permits for signs and business licences, so ask for the county permit in writing. The Data Protection Act, the Competition Act and Google's 16% tax apply everywhere.

Questions about hiring a marketing agency in Kenya

Does our small business need to register with the ODPC?

Not if annual turnover is below KES 5 million and you have fewer than ten employees, unless your work is in a Third Schedule purpose such as hospitality, property, financial services, education, health, transport or direct marketing.

Can we send bulk SMS to customers who bought from us?

Only for marketing they agreed to when you collected their number, with a clear way to opt out by a single-word reply, and only if they have not already opted out.

Is VAT charged on Google Ads in Kenya?

Yes. Google charges 16% for billing addresses in Kenya and asks for your KRA PIN on the account.

Which social platform should a Kenyan business start with?

Start where your customers are. StatCounter's referral figures put Facebook, YouTube, Instagram and X close together in Kenya, so look at your own website analytics and enquiry records before you pick one.

When can we judge whether our agency is delivering?

Read Search Console for impressions and positions, the Business Profile performance report for calls, Google Ads and Meta Ads Manager for cost per enquiry, and your own count of WhatsApp enquiries by source. The outcome depends on competition, your offer and your budget.

What a Kenyan buyer hears from an AI assistant

A Nairobi marketing manager who asks ChatGPT for the best digital marketing agency in Kenya gets a handful of names. They come from what the assistant can read: agency directories, Kenyan business press, award lists and the agencies' own sites. That list is not the same as Google's results and can change between assistants, so a strong agency can still be left out. AI Knows Us checks this for any business, asking its real buyer questions on ChatGPT, Gemini, Perplexity, Claude and Google AI Overviews and showing which firms are named and which sources the answers use.