Consent, Data Protection, and the Legal Responsibilities of Online Content Creators in Light of ODPC Complaint No. 1724 of 2025: Ian Itolondo Mutoro vs Waithera Imani
Introduction
The growth of Kenya’s digital economy has transformed social media platforms into sites of commercial activity, where influencers, vloggers, and short-form content creators derive economic value from personal data, including the images, voices, and likenesses of identifiable individuals. This evolution has created a regulatory tension between creative freedom and statutory obligations under the Data Protection Act, 2019.
The ODPC determination in Complaint No. 1724 of 2025: Ian Itolondo Mutoro vs Waithera Imani marks a significant development in clarifying that digital content creation is not exempt from data protection requirements merely by virtue of its informal or entertainment-driven character.
The Legal Characterization of Digital Content as Data Processing
At the core of the ODPC’s reasoning is the recognition that the recording, editing, publication, and monetization of content involving identifiable individuals constitutes “processing of personal data” within the meaning of the Act.
The decision rejects the notion that one’s presence in a public space implies consent to recording or dissemination. Instead, it affirms that where content is used for promotional or commercial purposes, the processing of personal data must comply with statutory safeguards, including lawful basis, transparency, and purpose limitation.
Importantly, monetized content, whether through advertising revenue, sponsorships, affiliate marketing, or platform-based monetization systems, is treated as commercial processing, thereby attracting heightened regulatory scrutiny.
Consent as a Substantive and Evidentiary Requirement
A central principle reaffirmed by the ODPC is that consent must be express, informed, specific, and demonstrable. The decision elevates consent from a contextual implied assumption to an evidentiary obligation.
For content creators, this means that informal permissions, verbal agreements, or implied understanding are insufficient where personal data is used in published or monetized content. Instead, creators must be able to demonstrate verifiable consent that clearly identifies the scope and purpose of use.
This evidentiary threshold reflects a broader shift in data protection enforcement towards accountability and auditability in digital environments.
Content Creators as Data Controllers in Practice
The decision implicitly recognizes that influencers and digital creators may function as data controllers where they determine the purpose and means of processing personal data through content creation and distribution.
This classification carries significant legal consequences. As data controllers, creators are required to ensure compliance with the principles of lawful processing, including transparency, data minimization, and purpose limitation. They are also responsible for ensuring that data subjects are adequately informed and retain the right to withdraw consent.
This development reflects the increasing professionalization and regulatory recognition of influencer marketing as a structured economic activity rather than purely informal expression.
Withdrawal of Consent and Continuing Obligations
The ODPC further clarifies that consent is not irrevocable. Data subjects retain the right to withdraw consent at any time, and such withdrawal imposes a continuing obligation on data controllers to cease further processing.
In the context of digital content, this may include the removal, de-publication, or restriction of access to previously published material where continued dissemination is no longer justified under the Act.
This introduces an ongoing compliance duty that extends beyond the initial act of publication, fundamentally reshaping content lifecycle management for creators.
Implications for Influencer Marketing Practice
The decision has significant practical implications for Kenya’s influencer economy. It requires a shift from informal content capture practices to structured consent-based workflows. Content creators must now integrate consent mechanisms into their production processes, particularly where content is promotional or monetized.
This includes ensuring that consent is purpose-specific, clearly documented, and capable of being produced as evidence in the event of a dispute or regulatory inquiry. The absence of such safeguards exposes creators to potential enforcement action, including financial penalties and takedown orders.
Conclusion
The ODPC’s determination in Complaint No. 1724 of 2025 represents a critical step in aligning Kenya’s digital content ecosystem with the requirements of modern data protection law. It affirms that creative expression in the digital space is subject to legal limits where personal data is involved.
For content creators and influencers, the decision underscores a fundamental principle: digital influence is not exempt from legal accountability. While creativity drives audience engagement, lawful consent provides the structural foundation upon which sustainable and compliant digital practice must be built.
Accordingly, organisations and individuals in this space should implement structured consent management mechanisms, maintain comprehensive records of data collection and permitted use, undertake periodic compliance reviews against core data protection principles, and refrain from repurposing publicly available data without first establishing a lawful basis for such use.
Disclaimer: This article is provided free of charge for information purposes only; it does not constitute legal advice and should be relied on as such. No responsibility for the accuracy and/or correctness of the information and commentary as set in the article should be held without seeking specific legal advice on the subject matter. If you have any query regarding the same, please do not hesitate to contact our Data Protection & ICT Law Department vide WAICTLaw@wamaeallen.com
About the author
Virginiah is a seasoned Advocate with great expertise of more than three years in Real Estate, Banking and Finance, Commercial and Corporate Law. She is a focused and self-motivated advocate successful at strategically managing operations with proven team performance.
Flavious is an Associate in the Real Estate and Securitization Department.
She has vast knowledge and hands on experience in Real Estate, Securitization, Banking, Finance, Company Law, Corporate Governance, Insolvency and Commercial Law. She also has keen interest in policy making and emerging legal commercial issues in general.
She is a promising transactional advocate with exemplary interpersonal skills and exudes diligence, integrity, resilience, confidence and great enthusiasm in all her tasks.
