Why a betting app asks for your ID photo, and what it may do with it

A betting app that asks for a photo of your national ID or passport is doing something Kenyan law tells it to do. The 2026 Regulations require every licensed operator to confirm your identity, your location and your age before you can bet. Before you upload anything, confirm the app belongs to a licensed operator: how to verify that a betting app comes from a licensed operator sets out the checks.

This page covers three things. It explains what the Gambling Control Act, 2025 and its Regulations require, what the Data Protection Act, 2019 lets the operator do with the image, and when you should not send it at all.

What does the law require before you can bet?

Section 72(1) of the Gambling Control Act, 2025 lets a person play only once registered as a player and holding an account with that licensee. Section 72(3) adds that the operator must require proof of age of majority before it registers anyone. Gambling is for adults of the age of majority, which in Kenya is eighteen; the 2026 Conduct of Gambling Operations Regulations (regulation 92) bar persons under eighteen.

The Regulations, published as Legal Notice No. 112 of 2026, go further. Regulation 82(1) forbids any form of online gambling without a mandatory identity check, location verification and age assurance check. Regulation 82(2) says the operator must use reliable, independent and electronically verifiable data sources, before the account is activated and before any wagering deposit is received.

Two more rules close the gaps. Regulation 83 prohibits anonymous gambling unless the Authority approves it. Regulation 95(2) makes it mandatory to verify the identity of every punter under the know your customer requirements of the Proceeds of Crime and Anti-Money Laundering Act.

When will the app ask for your ID?

The check is not a single event. The law ties identity checks to several moments in the life of an account, and the checks get stricter as prizes grow.

So an app that verified you at sign-up may ask again before a large payout. Regulation 82(4) says verification of a winner includes official identification documents and confirmation that the person is not self-excluded.

Why a photo and not just your ID number?

The 2026 Conduct of Gambling Operations Regulations never use the words photo or selfie. Regulation 82 sets the result, an identity confirmed from reliable and independent sources, and leaves the method to the operator. Section 68(2) of the Act then says the Authority approves an operator's gambling control system only if it provides for protection against under-age gambling and for data protection measures under the Data Protection Act.

A camera upload means the app asks your phone for camera or photo access. Apple's App Review Guideline 5.1.1(iii) tells apps to request only data relevant to their core function and, where possible, to use a picker instead of full access to your photo library. For what each Android permission opens up, read what each betting app permission means.

What may the operator do with your ID photo?

Your ID image is personal data. Section 2 of the Data Protection Act, 2019 defines personal data as any information relating to an identified or identifiable natural person, and the body that decides why and how it is processed is the data controller.

Regulation 93 of L.N. 112 applies that Act to gambling. Collection and processing must comply with the Data Protection Act, data may be collected only for purposes directly related to administering the gambling operation, and it may not be used for any form of marketing without your prior consent.

Section 29 of the Data Protection Act adds a duty to tell you, before collection where practicable, that data is being collected, for what purpose, who else may receive it and how it is secured. That information normally sits in the app's privacy notice. Apple's Guideline 5.1.1(i) requires every App Store app to link to a privacy policy explaining what it collects, its retention and deletion policy and how to request deletion.

Deletion has limits. Regulation 89(1)(j) of L.N. 112 lists customer information among the records a licensee must keep, and section 39(1)(a) of the Data Protection Act allows retention that a law requires. A request to erase your ID image may therefore not be granted straight away, so ask the operator which rule it relies on.

What rights do you have over the image?

Section 26 of the Data Protection Act gives you the right to be told how your data will be used, to access it, to object to its processing, and to have false or misleading data corrected or deleted. You exercise these rights through the operator, whose customer care centre must be in Kenya under section 68(8) of the Gambling Control Act.

If the operator does not respond, section 56 lets you complain to the Data Commissioner orally or in writing, and the complaint must be investigated and concluded within 90 days. The Office of the Data Protection Commissioner also publishes a register of data handlers, where a company's registration shows as active, expired or deregistered.

One store rule helps as well. Apple's Guideline 5.1.1(v) says an App Store app that lets you create an account must also let you delete that account inside the app.

When should you refuse to send your ID?

An ID check inside a licensed app is normal. The situations below are not, and in each of them you should stop before you send anything.

• The request arrives by WhatsApp, SMS, e-mail or a phone call instead of inside the app. Regulation 82 describes a check the licensee runs on its own platform, not an image you hand to a stranger.
• The operator, trading name or domain behind the app is not on the regulator's list headed Licensed Gaming Companies for the Trading Period 2025/26. Compare it with the App check list of licensed operators and their domains first.
• The app wants your M-Pesa PIN, a one-time code or a password together with the ID. No identity rule needs them, and Safaricom's own guidance says the M-PESA PIN should not be shared with anyone.
• Someone offers to verify your account for a fee, or suggests using another person's ID. Section 72(5) of the Act tells a licensee to refuse, or cancel, the registration of anyone found to have given false information.
• The app has no privacy notice, or the notice does not name the company that holds your data. Without that name you cannot use your section 26 rights.

Clone apps copy the look of real ones, so an ID step on its own proves nothing about who runs the app. The guide to the signs of a fake or clone betting app covers the other checks worth making.

What this page does not cover

This page explains the rules; it does not assess any operator's verification process. The Regulations as gazetted do not set a photo format, a retention period for ID images or a list of documents accepted at account opening. The location part of regulation 82 is explained in why betting apps need your location in Kenya.