Betting app or mobile site in Kenya: which is regulated, and how

Kenyan law asks one question of any betting platform: does a licensed operator run it? An app on your phone and a site in your browser get the same answer, because the licence belongs to the operator. The steps for that first check are set out in how to verify a betting app is from a licensed operator.

The practical differences are real, though. An app asks for phone permissions in a different way from a browser, it updates through a store or a file, and a store adds its own review and data labels. This page compares the three routes to a betting service on a phone: a store app, an APK file from a website and a mobile site.

Does Kenyan law treat a betting app and a mobile site differently?

No. Section 2 of the Gambling Control Act, 2025 defines online gambling as any form of gambling in which people take part by remote communication and on the internet. A phone app and a mobile website both fit that wording.

Section 28(1) then says no gambling activity or service may be offered in Kenya unless it is licensed under the Act. The licence types follow the product, not the screen. Section 67(1) lists three online licences: online bookmaker, online lottery and online casino, and none of them is an app licence or a website licence.

The 2026 Regulations take the same line when they describe what is illegal. Regulation 102(2) of the Gambling Control (Conduct of Gambling Operations) Regulations, 2026 (L.N. 112) defines an illegal gambling platform as any website, application, digital device or electronic system that offers gambling without the licence or approval the law requires. A website and an app pass or fail the same test.

Which rules apply to both in the same way?

Most player protections attach to the licensee's platform as a whole. Section 36(3) of the Act requires an online licensee to display its licence on its online platform. Regulation 82(1) of L.N. 112 bars a licensee from letting anyone gamble online without an identity check, location verification and an age assurance check.

Regulation 82(2) adds that the operator runs these checks against reliable, independent and electronically verifiable data sources before it activates the account and before it takes any wagering deposit. Regulation 41(c) requires geo-location technology able to block access from prohibited locations. Neither rule names a format.

Your money sits in one place too. Section 73(1) requires the licensee to keep a player's account for each registered player, so the account belongs with the licensee rather than with an app or a browser tab.

Section 68(1) makes the operator run its online activity under a gambling control system the Authority approves. Section 68(6)(a) has the operator give the Authority the platforms players use to take part. The fit and proper form in the Fourth Schedule to L.N. 112 asks applicants for their "Website(s), Mobile App(s), Domain(s)" in a single field.

App, APK or mobile site: how do they compare?

The table sets the three routes side by side on control, verification and risk. The licence row is the same in every column; the other rows show where your own checks differ.

Updates: who decides when the app changes?

A store app updates through Google Play. Google's help page says you can update Android apps one at a time, all together or automatically. It also says Google may push an update that fixes a critical security vulnerability whatever your update settings are.

An APK from a website sits outside that system. New versions arrive as files from the operator's site, so you rely on the operator to publish them and on yourself to install them. Android's warnings on that route are covered in what Android warns you about when you download a betting APK.

A mobile site has no install step. The operator changes its pages on its own server, and you see whatever version the server sends when the page loads. Sites can still keep data on the phone, and Chrome's site settings show how much local storage each site has used.

Permissions: what can each one reach on your phone?

Android sorts app permissions by how much they expose. Its developer documentation calls runtime permissions, also known as dangerous permissions, the ones that give an app extra access to restricted data or restricted actions. The app must ask before it uses them.

That documentation gives location as an example of private user data and says the camera and microphone reach particularly sensitive information. Both matter in a betting app, because regulation 82(1) needs a location check and regulation 82(4) needs official identification documents.

A browser asks site by site instead. Chrome on Android lets you answer a request for the camera, location or microphone with "Allow this time", "Allow while visiting the site" or "Never allow". For location you can choose approximate or precise, and a site must ask before it shows notifications.

Either way, refusing a permission can stop a step the law requires, such as the location check. Which requests make sense for a betting app is set out in betting app permissions and what each one means.

Data use: who sees your details?

The operator handles your data whichever route you use. Regulation 93(1) of L.N. 112 says personal data collected during gambling operations must be processed in line with the Data Protection Act. Regulation 93(2) limits collection to purposes directly related to running the gambling operation, and regulation 93(3) bars marketing use without your prior consent.

A store app adds a label you can read before installing. Google Play's Data safety section lets developers describe the data an app collects, how they use it, whether collection is optional and what they share. Google also says apps that offer account creation must give an in-app path to delete the account and its data, plus a web link for the same request.

A mobile site and an APK carry no store label, so the operator's privacy notice is your main source. If an app asks for a picture of your ID card, the rules on that request are in why a betting app asks for your ID photo.

Which one is easier to check against the licence list?

The mobile site, in most cases. The regulator's list, headed "Licensed Gaming Companies for the Trading Period 2025/26", has eight columns: No., Operators Name, Trading Name, BK, PG, PL, STATUS and DOMAINS. One column holds web domains, and none holds app names, store listings or APK files.

In the snapshot of that list taken on 28 October 2026, 125 of the 187 rows carry a domain and the rest read Nil. A site address can be matched to that column at once. An app has to be traced back to a domain first, through the website in its store listing or the site that served the file.

The licensees and their listed domains are gathered on the App check page of licensed operators and domains. Google Play adds a filter of its own: its policy allows real-money gambling apps only in select countries, only after an application, and only from operators licensed by the relevant government gambling authority.

Google's requirements also say a gambling app must stop under-age users, block places its licence does not cover and be free to download. That filter helps, but store approval is not the regulator's licence. Only the Authority's list answers that question.

What this comparison does not cover

This page does not rank operators or tell you which format to use. It does not cover USSD menus, which the fit and proper form lists with paybill and till numbers as payment channels rather than as platforms.

It also leaves out the App Store, which has its own rules for iPhone users and its own guide on this site. Payment prompts inside apps and sites work the same way in both and have a separate guide in the related list below.