Why a betting site asks for your location in Kenya, and what the rules say

The two regulations behind the location prompt

The prompt comes from the Gambling Control (Conduct of Gambling Operations) Regulations, 2026, Legal Notice No. 112. Regulation 41(c) says an online gambling system or platform must employ geo-location technology able to block access from prohibited locations. Regulation 2 defines that technology as a system capable of determining a player's physical location with accuracy, so that gambling is conducted only within permitted jurisdictions.

Regulation 82(1) turns the check into a condition of play. A licensee may not allow anyone to take part in online gambling without a mandatory identity check, location verification and age assurance check. Regulation 82(2) requires reliable, independent and electronically verifiable data sources before the account is activated and before any wagering deposit is received, the same stage described in our guide to opening a betting account in Kenya.

So the request is not a marketing extra. Without a location result, the licensee cannot complete checks that regulation 82 makes mandatory.

Which rules call for a location check

What the check looks at

The Regulations set the goal, not the method. L.N. 112 names no technique such as GPS or network data; it asks only for technology that can fix a player's physical location with accuracy. The Foreign-Based Operators Regulations, L.N. 113, do name one technique for the operators they cover: Internet Protocol geo-blocking.

L.N. 112 also publishes no list of prohibited locations. Its definition speaks instead of keeping gambling within permitted jurisdictions, and for a foreign-based operator L.N. 113 makes Kenya itself the place to block.

Regulation 93(2) limits what the result may be used for. A licensee may collect and process data only for purposes directly related to administering the gambling operation, and a location check run for regulations 41 and 82 is one of those purposes.

What happens if you use a VPN

Neither the Gambling Control Act, 2025 nor L.N. 112 or L.N. 113 mentions VPNs by name. The rules work on the operator's side: the platform must block prohibited locations under regulation 41(c) and verify location before play under regulation 82(1). A tool that hides your real location works against checks the licensee is legally bound to run.

The consequences sit mainly in the operator's terms and conditions. Regulation 4(1) of L.N. 112 requires a licensee to submit its terms to the Authority for approval, and regulation 4(2) says they must include eligibility restrictions, prohibited conduct, and account suspension and closure. Read those three parts before assuming a masked location is harmless.

The Act's closest rule is section 72(5), on false information given during registration. A licensee that becomes aware of it must refuse to register the person, or cancel an existing registration immediately.

Reaching a foreign site from Kenya is a separate question. Regulation 7(1) of L.N. 113 requires a foreign-based operator licensed under section 79(4) of the Act to stop persons resident in Kenya from reaching its platforms. Under regulation 10(1), an operator that lets Kenyan residents in can have its licence suspended or revoked, or its security bond forfeited to the State.

An operator with no Kenyan licence runs what regulation 102(2) of L.N. 112 calls an illegal gambling platform. The offences in section 79(3) of the Act and regulation 102 are aimed at operators and at those who host or process payments for them. The penalties are listed in the guide is online betting legal in Kenya.

Your data rights over location information

Location linked to your account relates to an identifiable person, which is how section 2 of the Data Protection Act, 2019 describes personal data. Regulation 93(1) of L.N. 112 makes that Act the rulebook for personal data collected in gambling operations. Section 68(2)(h) of the Gambling Control Act also requires data protection measures before the Authority approves an online licensee's gambling control system.

Two further rules in L.N. 112 limit what happens to the data. Regulation 93(3) bars using personal data for any form of marketing without your prior consent. Regulation 42 requires player data to be encrypted in transit and at rest, and stored and processed on servers in Kenya unless the Authority grants a written exemption.

Section 26 of the Data Protection Act gives you the right to be told how your data will be used, to access it, to object to its processing, and to have false or misleading data corrected or deleted. Section 25(h) bars transfer of personal data outside Kenya without proof of adequate safeguards or your consent. Regulation 4(2)(u) of L.N. 112 requires the operator's terms to carry its data collection and privacy statements.

If you think a betting site has misused your location data, section 56 of the Data Protection Act lets you complain to the Data Commissioner orally or in writing. The complaint must be investigated and concluded within 90 days.

Can you refuse the location request?

You can decline a location prompt on your phone or in your browser. The effect follows from regulation 82(1): a licensee may not let anyone gamble online without location verification, so declining can leave the account unable to open, take a deposit or accept a bet.

Refusing is not the same as complaining. If you think the site collects more location data than the check needs, the Data Protection Act rights above are the route, not masking where you are.

What this guide does not cover

This guide deals with online location checks. Rules for land-based betting premises and app-store policies are separate topics. The getting started guides cover the other checks made before a first bet, and the rule finder lists which section of the law settles each common question.