Why betting apps need your location in Kenya: the geo-location rule, what is stored and what a VPN changes

A betting app that asks where you are when you first open it, or again before a deposit, is meeting a legal requirement. Kenya's 2026 Regulations make location one of three checks, next to identity and age, that an operator must complete before you gamble online. How the permission prompt itself works on Android is covered in what each betting app permission means; this page covers the rule behind it.

What does regulation 41 require?

Regulation 41 of the Gambling Control (Conduct of Gambling Operations) Regulations, 2026, Legal Notice No. 112, lists the technical standards for every online gambling system or platform. Item (c) requires geo-location technology able to block access from prohibited locations. The same list asks for an approved domain name, accurate and secure transaction records, a tamper evident audit log and real-time monitoring by the Authority.

Regulation 2 defines geo-location technology as a system capable of determining the physical location of a player with accuracy, so that gambling takes place only within permitted jurisdictions. Regulation 82(1) makes location verification mandatory for any form of online gambling, and regulation 82(2) times it before account activation and before the first wagering deposit.

Because regulation 41 speaks of a system or platform, it covers the mobile website as much as the app; the betting app and the mobile site are regulated the same way. What the Regulations do not do is list the prohibited locations or name a technology.

Why do Google and Apple insist on it too?

Google Play's real-money gambling policy says an approved gambling app must prevent access and use from countries, states or geographic areas not covered by the developer's gambling licence. Its key considerations add that a developer must not let users in unapproved locations use the app.

Apple applies its own geo-restriction rule to the App Store. A licensed operator therefore hears the same demand from three directions, and the store side is explained in whether betting apps are allowed on Google Play in Kenya and the App Store rules for betting apps on iPhone.

What does the app actually check?

A phone works out its position from several signals. Google's Android help page says that with Location Accuracy on, the device uses GPS, Wi-Fi, mobile networks and sensors such as the accelerometer, barometer and gyroscope. Apple's support page says Location Services on an iPhone uses GPS and Bluetooth where available, plus crowd-sourced Wi-Fi hotspots and cellular towers.

Android's developer reference explains why the isMock flag exists. A location that comes from a test provider may not be related to where the device actually is, and an app can read that flag together with the coordinates.

Location can also be judged from the network side. Regulation 7(1) of L.N. 113, the Foreign-Based Operators Regulations, names Internet Protocol geo-blocking, which works from your connection instead of your phone's sensors.

The checks in regulation 82 are tied to moments: account activation and deposits. Android's documentation describes background location as something for features that constantly share location, such as family location sharing. Apple's page says apps should explain how they will use your location, so an app asking for Always deserves a clear reason in its prompt.

What may the app store about your location?

A location reading linked to your account is personal data. The Data Protection Act, 2019 defines an identifiable natural person in section 2 as someone who can be identified directly or indirectly by reference to identifiers, and location data is one of the identifiers it names. The same section counts automated analysis of a person's location or movements as profiling.

Under regulation 93 of L.N. 112, a licensee may use what it collects only for purposes directly related to running its gambling operation. Using your location for promotions would be marketing, which that regulation allows only with your prior consent.

The audit log is the part most people miss. A location check is a user activity on the platform, so its result may be among the entries regulation 41(d) requires, while regulation 41(e) gives the Authority real-time monitoring of gambling activity. The Regulations as gazetted do not say how long such logs are kept.

What happens if you use a VPN?

A VPN changes the route of your internet traffic, so a website sees the address of the VPN server instead of yours. It does not move the phone. The satellite, Wi-Fi and cellular signals the phone uses for its own position stay the same, and an app that reads both kinds of signal can see when they disagree.

The Gambling Control Act, 2025, L.N. 112 and L.N. 113 never mention VPNs by name. What they do contain all points one way.

• For licensed operators in Kenya, regulation 82(1) says no one may take part in online gambling without location verification. An operator that cannot verify where you are has not met that rule.
• For foreign-based operators, regulation 7(1) of L.N. 113 requires Internet Protocol geo-blocking and identity verification so that persons resident in Kenya cannot reach their platforms. A VPN may change the address such a site sees, but not the identity check that ties the account to you.
• Regulation 10(1) of L.N. 113 lets the Authority suspend or revoke the licence, or forfeit the security bond, of a foreign-based operator that allows Kenyan residents unauthorised access.
• A site with no Kenyan approval at all is, under regulation 102(2) of L.N. 112, an illegal gambling platform: any website, application or electronic system offering gambling without the required authorisation or licence.

Winnings depend on checks a VPN does not touch. Regulation 82(3) requires the winner's identity to be verified before payment, and regulation 82(4) adds confirmation that the person is legally eligible to take part in gambling under the Act.

How do you control the permission?

On an iPhone, open Settings, then Privacy and Security, then Location Services, and pick the app. Apple's support page lists four choices: Never, Ask Next Time Or When I Share, While Using the App, and Always. Turning off the separate Precise Location switch means the app receives only your approximate location.

On Android, granting only approximate location limits the app to approximate location whatever permissions it declared, according to Android's developer documentation. Google tells developers an app should still work with approximate access, and that an app needing more may ask you to allow precise location.

If you refuse location altogether, the operator cannot complete the location step of regulation 82. Expect the app to stop before you can deposit or bet.

What this page does not cover

The Regulations as gazetted do not define prohibited locations, set a numeric accuracy level for the check or fix how long location records are kept. This page does not describe how any particular operator runs its check. For the identity side of regulation 82, read why a betting app asks for your ID photo.