Your Old Phone Number Is Someone Else's Problem Now: Inside Kenya's Recycled-Number Safeguards

Kenya has a new answer to a question most people never think to ask: when you give up a phone number, who inherits everything attached to it?

As of September 19, 2026, the answer is governed by formal safeguards. The Communications Authority of Kenya (CA) published CA.G.520:2026 - the Procedures and Technical Safeguards for Deactivation and Recycling of Inactive Mobile Numbers - and mobile operators are now required to follow a defined process before any dormant number is handed to a new subscriber.

This matters because in Kenya a phone number is not just a way to be reached. It is a financial identity. It carries your M-PESA wallet, your bank alerts, your one-time passwords, your account recovery paths on dozens of services. When that identifier changes hands without safeguards, whatever was still attached to it can end up in a stranger's hands.

The six-month runway

Under the guidelines, a number becomes eligible for deactivation after three months with no revenue-generating activity - no calls made or received, no SMS, no data use, no airtime top-up, no value-added service.

That is only the beginning of the process, not the end. Operators must then spend a further three months trying to reach the subscriber, using every contact detail collected during SIM registration. That gives a dormant line up to six months of protection before it can be reassigned.

There is also a public dimension. Thirty days before the recycling window closes, operators must publish the lists of numbers facing deactivation - on their websites, in a newspaper with nationwide circulation and through other media. Each notice must include a USSD facility, delivered through the familiar *106# short code, that any Kenyan can dial to check whether a number is active, suspended, under recycling or deactivated.

That last detail matters practically. If you split your time between two lines, or you have a spare SIM that has been sitting in a drawer, you no longer have to guess its status. Dial and check.

The data-delinking duty

The sharpest edge of the framework is what must happen before reassignment. Operators are required to delink and securely archive the personal data, cached data and services associated with the previous owner, so that they are not accessible to or inherited by the new subscriber.

In plain terms: the new holder of your old number starts clean. Whatever was still linked to that number - an old marketing consent, a cached profile, a service that still pointed at the line - should not travel with the number to them.

The safeguards extend this principle into messaging. Newly issued and recycled numbers are excluded from marketing messages by default. A business that wants to message a recycled number has to obtain fresh, line-specific consent first. This closes the gap where a recycled number would keep receiving promotions aimed at a person who no longer holds it.

There are carve-outs for people who cannot keep a line active through no fault of their own. Subscribers who are seriously ill, incarcerated or travelling for extended periods can apply for whitelisting, and the Commissioner-General of Prisons is required to submit details for inmates serving sentences longer than six months so their numbers are protected from recycling.

The database that is coming

The delinking duty handles what the operator knows. The bigger gap is what everyone else knows - and one CA proposal aims directly at it.

The regulator has indicated it plans a central database of recycled phone numbers. Banks, fintech firms and bulk-SMS providers would be able to query it before sending subscription-related messages, verifying that the number they have on file still belongs to the person they think it does.

The need is real. A number can remain attached to a bank account, a payment service or an online profile long after its original owner has stopped using it. When a business keeps sending messages - transaction alerts, one-time passwords, account-recovery codes - to a number that has changed hands, those messages can reach someone with no connection to the original account holder.

The proposal resembles the United States Federal Communications Commission's Reassigned Numbers Database, which exists for exactly this reason: to let callers check whether a number has been reassigned before dialing it.

But there is a catch, and the guidelines are explicit about it: the centralized-database provisions become effective only once the database is established. Until it exists, the verification duty sits with every individual business. A database also cannot automatically unlink old numbers from customer profiles; businesses still need their own account-update procedures, secure recovery processes and accurate customer records.

Where this came from

The framework did not appear out of nowhere. It follows a March 2026 High Court ruling that found a registered mobile number to be a digital identifier linking personal data, protected under Article 31 of the Constitution - and that deactivating and reassigning numbers without adequate safeguards could expose the personal information of the former holder.

The court gave the Government six months to translate that direction into enforceable regulations, with a hard deadline of September 19, 2026: if the required measures were not in place by then, recycling of previously registered numbers would stop automatically. The CA consulted publicly on the draft safeguards through September 1-11, 2026, and finalized the framework against that deadline.

The CA's Director-General, David Mugonyi, presented the safeguards to the National Assembly's Public Petitions Committee in October, in response to a petition over SIM deactivation and reassignment practices. The committee's questioning - including who receives a deactivation notice when the registered owner has died - surfaced a real weakness: the protection is only as good as the contact details captured at SIM registration. The CA acknowledged that agents and subscribers often skip alternative contacts, which is exactly the data the notification system depends on.

What you should actually do

The safeguards reset the default in your favour, but they do not remove your own responsibility for one specific moment: when you stop using a number.

• Update your contact details with your bank, M-PESA and any service that uses the number for alerts or recovery - before you surrender the line, not after.


• Keep a dormant line alive if it is attached to anything important. A single activity every few months resets the inactivity clock entirely.


• Dial *106# to check the status of any line you are unsure about, especially lines belonging to family members.


• Use the whitelisting routes if a line must stay inactive for more than six months - for travel, illness or incarceration - rather than letting the clock run.

For businesses, the obligations are sharper. If you send transaction alerts, OTPs or any business-to-customer messages, the recycled-number default opt-out now applies to you, and the planned database will formalize a verification step you should already be building into your messaging stack.

The takeaway

Kenya's numbering safeguards are a quiet but consequential piece of digital-identity infrastructure. They treat a phone number the way the law now treats it - as personal data attached to a financial life - and they force the system to move slowly, notify publicly and wipe the slate before the identifier changes hands.

The database will be the real test. A quarterly-reported, query-before-you-send verification layer is the difference between a rule telcos follow and a protection that actually holds at the point where an alert or one-time password is about to be sent to the wrong person.

Until then, the practical protections are already yours to use: the six-month runway, the public notices, the *106# status check, and the delinking duty. A number is only as safe as the account records attached to it - and updating those is still on you.

Sources: Communications Authority of Kenya (CA.G.520:2026), TechTrendsKE (Oct 10, 2026), Capital FM via allAfrica (Oct 7, 2026), Business Daily, People Daily.