According Kenya’s Data Protection Act, sending unsolicited marketing messages is prohibited and businesses must obtain explicit, informed consent before contacting individuals for direct marketing purposes.

At the same time, businesses must also provide a simple, free-of-charge mechanism for recipients to opt out of receiving such communications at the time of data collection and when sending marketing messages.

Failure to comply can lead to penalties, including fines and other consequences, as seen with how busy the Office of the Data Protection Commissioner (ODPC) has been during the last few years with many large and relatively small fines being dished our regularly for data privacy violations.

Therefore, when I got this unsolicited and unconsented direct marketing message via WhatsApp earlier today, my first concern was how this business had gotten my contacts to do so, given that it literally came out of nowhere. I have no context about this business and I am not aware of ever interacting with them at any point in the past.

As you will see in the WhatsApp screen grabs, when I asked this very question, the feedback was somewhat amusingly, ‘I’m doing random whatsapp marketing’. So honest but also so naive from where I am standing as far as Kenya’s Data Protection Laws are concerned!

As expected, this is an especially big problem for small businesses who are quite often ‘not in the loop’ on these sort of things with potentially massive consequences in the making.

Quite frankly, I am not at all surprised that this happens often with small businesses trying to acquire customers as cost effectively as possible using affordable and targeted digital channels like WhatsApp. However, in doing so, their own lack of knowledge, possibly due to their own negligence, or ignorance, could be the very source of their own undoing.