Kenya phone numbers: format, 07 and 01 prefixes, validation and messaging rules

Kenyan numbers use the country code +254. Mobile numbers have 9 digits after the code and start with 7 or 1 (07XX or 01XX when dialled at home), so in E.164 they look like +254 7XX XXXXXX or +254 1XX XXXXXX. The first digits show which operator the Communications Authority of Kenya (CA) gave the range to, but numbers can be ported, so they don't prove the current network. Marketing SMS needs the person's opt-in, a free opt-out and, under the CA's guidelines, a 7 a.m. to 7 p.m. window.

This guide is part of our phone numbers by country series. The tables are generated from libphonenumber's metadata, our MNP atlas and our public catalog. Example numbers are masked with X, or are the example numbers published in libphonenumber. We read the CA's numbering plan, portability guidelines, consumer protection rules and statistics on its website on 2026-11-02. The Office of the Data Protection Commissioner's (ODPC) documents didn't load for us from its own site, so we link to Internet Archive copies of the same files. Where we rely on press reports or a law firm's summary, we say so. This is a summary, not legal advice.

#What does a Kenyan phone number look like?

A mobile number is 07XX XXXXXX or 01XX XXXXXX at home: the trunk prefix 0 and nine digits. From abroad it is +254 7XX XXXXXX or +254 1XX XXXXXX. The CA's numbering plan gives every mobile range a three-digit national destination code (700 to 799, and 100 to 146 for the newer ones) and a fixed national number length of nine digits. Across all services, numbers after the country code are seven to nine digits long (CA numbering plan, April 2026, section 1.1).

Store only the E.164 form, +2547XXXXXXXX or +2541XXXXXXXX, with no spaces and no 0 after 254. Kenyan sign-up forms often collect 07XXXXXXXX, 2547XXXXXXXX without a plus, +254 07… with a stray zero, or 00254…. A numbering-plan library with the default region KE handles most of these. The 00254 form needs one extra step, explained next.

#Why does 00254 fail validation, and what is 000?

Kenya's international access code is 000, not 00. The plan lists 000 for calls outside East Africa and separate regional access codes for the neighbours: 003 Burundi, 004 Rwanda, 006 Uganda and 007 Tanzania (CA numbering plan, section 1.5). libphonenumber knows this, so when it is told a number comes from Kenya, 00254 7XX XXXXXX doesn't start with an exit code. Both ports we test read the whole string as one long national number, which isn't valid. Row 3 of the test table below shows the result.

People still type 00254, because 00 is the exit code in most other countries. The fix is one line: rewrite a leading 00 followed by a non-zero digit to + before parsing. 000254…, the real Kenyan form, already parses.

#Which prefixes are mobile numbers?

Every mobile number starts with 07 or 01. For each 2-digit block, the generator counted every 9-digit number that libphonenumber's mobile pattern for KE accepts:

All ten 07 blocks are fully mobile. The 01 blocks are only partly open, because the CA assigns them in smaller pieces (three-digit codes such as 0110 or 0124). 015 to 017 and 019 aren't mobile ranges in libphonenumber today. One difference from the regulator: libphonenumber accepts the 018 block as mobile, but the April 2026 plan doesn't list a 018 assignment. We found no CA document that explains it.

#07 and 01 prefixes by operator

The CA's plan names the holder of each three-digit code. As of the April 2026 edition:

The plan doesn't list 0767. It also reserves 0199 as a shared resource for network testing and research, so treat it as not a subscriber number.

The 01 range is new. The CA opened it in April 2019 because the 07 range was close to exhausted, and said it holds 100 million numbers (The Star, 2019). Business Daily reported the first allocations: 0100, 0101 and 0102 to Airtel and 0110 and 0111 to Safaricom. Telkom didn't apply at the time (Business Daily, 2019).

#Don't take the operator name from a library's carrier data

libphonenumber also ships a carrier prefix file that maps ranges to operator names. For Kenya, it doesn't match the CA plan for several of the small blocks. We checked it on 2026-11-02 with the Python port, version 9.0.40:

Two lessons follow. A number in 0126, 0128 or 0146 may be real yet fail validation until the library catches up, so log rejections instead of dropping them silently. And the carrier name a library returns is a best guess about the original range holder. It is never the current network. For that you need a live lookup.

#How do I validate a Kenyan number in code?

Use a libphonenumber port with full metadata and the default region KE, rewrite 00 to + first, then keep only mobiles.

Python (pip install phonenumbers):

import re

import phonenumbers


def normalize_ke(raw: str) -> str | None:
    """E.164 for a Kenyan mobile number (07XX or 01XX), or None."""
    s = re.sub(r"^\s*00(?=[1-9])", "+", raw)  # 00254… is foreign-style dialling; Kenya's own exit code is 000
    try:
        n = phonenumbers.parse(s, "KE")
    except phonenumbers.NumberParseException:
        return None
    if (not phonenumbers.is_valid_number(n) or phonenumbers.region_code_for_number(n) != "KE"
            or phonenumbers.number_type(n) != phonenumbers.PhoneNumberType.MOBILE):
        return None
    return phonenumbers.format_number(n, phonenumbers.PhoneNumberFormat.E164)


for raw in ["0712 123456", "+254 712 123456", "254712123456", "00254 712 123456",
            "000254 712 123456", "071212345", "020 2012345", "0800 223456"]:
    print(f"{raw!r:22} -> {normalize_ke(raw)}")

JavaScript (npm install libphonenumber-js):

import { parsePhoneNumberFromString } from "libphonenumber-js/max";

/** "0712 …", "+254 7…", "254…", "00254…" or "000254…" → E.164 for a Kenyan mobile, or null. */
export function normalizeKe(raw) {
  const s = String(raw).replace(/^\s*00(?=[1-9])/, "+"); // 00254… → +254…
  const phone = parsePhoneNumberFromString(s, "KE");
  return phone?.isValid() && phone.country === "KE" && phone.getType() === "MOBILE" ? phone.number : null;
}

for (const raw of ["0712 123456", "+254 712 123456", "254712123456", "00254 712 123456",
  "000254 712 123456", "071212345", "020 2012345", "0800 223456"]) {
  console.log(JSON.stringify(raw).padEnd(22), "->", normalizeKe(raw));
}

The inputs are libphonenumber's own example numbers for Kenya (mobile 0712 123456, fixed line 020 2012345, toll-free 0800 223456), not real subscribers. We ran both on 2026-11-02 (Python 3.12 with phonenumbers 9.0.40, Node.js 24 with libphonenumber-js 1.13.13). Both printed the same answers:

'0712 123456'          -> +254712123456
'+254 712 123456'      -> +254712123456
'254712123456'         -> +254712123456
'00254 712 123456'     -> +254712123456
'000254 712 123456'    -> +254712123456
'071212345'            -> None
'020 2012345'          -> None
'0800 223456'          -> None

(The JavaScript version prints null instead of None and uses double quotes.) The fourth line only works because of the 00 rewrite. Without it, both libraries return nothing for 00254…. The shape regex column below tests the pattern most tutorials give, after spaces, dashes and brackets are removed:

Rows 3 and 8 are the ones to remember. Row 3 is the 00254 trap above. Row 8, 015, has the shape of a mobile number and passes the regex, but no mobile range starts there, so an OTP sent to it is wasted. Our post on why an E.164 regex is not enough shows the same problem in other countries, and our Python and JavaScript guides cover more cases.

One more range to know about: the plan gives machine-to-machine (M2M) and Internet of Things services the code 300 with 12-digit national numbers. They aren't phones, so a MOBILE check correctly leaves them out.

#Does number portability change the carrier?

Yes. Mobile number portability (MNP) has run in Kenya since 1 April 2011. The then regulator, the Communications Commission of Kenya (CCK), set that date after operators missed the original 31 December 2010 launch (Telecompaper, 2010). Messages in an April 2011 KICTANet thread, which includes a reply from CCK's public relations office, refer to porting going live on 1 April (KICTANet, 2011).

The current rules are the CA's guidelines of June 2018 (CA MNP guidelines):

• Four hours at most. A port must finish within four hours (240 minutes) of the new operator accepting the application. Ports that take longer are recorded and reported.
• Debts don't block a port. Porting is allowed even if the subscriber owes the old operator money or is under contract, though the debt remains.
• Confirmation by SMS. The applicant sends a validation text to the toll-free short code 1501 before leaving the new operator's shop.
• New SIM, same services. The SIM isn't ported, so the subscriber gets a new SIM. Prepaid balance is forfeited, and prepaid and postpaid can switch.
• Cooling off and limits. Every port has a 14-day cooling-off period. The guidelines define an onward-porting restriction of 60 days after a successful port, and also say there is no limit on how often a number is ported once 30 days have passed after the cooling-off period.
• Routing. A central reference database acts as the clearing house, with all-call query and direct routing.

Uptake has always been low. An analysis of CCK figures counted 47,884 ports by 30 June 2012, about 0.16% of 29.7 million mobile subscriptions at the time (Abacus, 2012). The CA's quarterly report for April to June 2026 doesn't publish porting figures. It counts 88.0 million mobile SIM subscriptions, 69.8% of them on Safaricom (CA sector statistics). With porting rare, the prefix usually matches the network. Still, "usually" isn't enough for routing, pricing or fraud rules.

The Kenya row of our MNP atlas:

Porting started on 1 April 2011, and a port must complete within four hours. Our MNP atlas compares Kenya with other countries. When it matters, look up the current network per number, as our SMS routing with MNP and HLR use case shows.

#How are SIM cards registered in Kenya?

Every SIM in Kenya must be registered to an identified person or entity. The current rules are the Kenya Information and Communications (Registration of Telecommunications Service Subscribers) Regulations, 2025, Legal Notice 90 of 2025, in force since 30 May 2025 (Kenya Law). Kenya Law's page didn't load for our tools, so the points below come from a law firm's summary (CM Advocates, 2025):

• Only operators and their agents may register subscribers. Registering a SIM in someone else's name (proxy registration) isn't allowed, except by a parent or guardian for a child.
• Documents by type of subscriber: a national ID card for Kenyan adults, a birth certificate plus the parent's ID for minors, a refugee identity card for refugees, and a passport or foreign national registration certificate for foreigners. Companies register with a certificate of incorporation.
• Checks against government databases. Operators must verify details, and registration without document authentication is invalid.
• Deadlines. Operators had six months from 30 May 2025 to bring existing subscribers into line. A child who turns 18 must re-register within 90 days.
• Suspension, then deactivation. A non-compliant subscriber must get notice before suspension. If nothing is fixed within 90 days, the SIM is permanently deactivated.

In November 2025, after press reports about DNA and other biometric data, the CA said the regulations only define "biometric data" and that it has not told operators to collect it (TechCabal, 2025). Before these rules, a nationwide re-registration drive ran to 15 October 2022, after a six-month extension from 15 April 2022 (The Star, 2022).

What this means for your data: registration ties a SIM to an identity at the operator, but that identity never leaves the operator through a lookup. Deactivated SIMs and reused numbers still make old lists go stale. Re-check numbers you collected long ago before you send them an OTP. Our post on number recycling and list decay explains how.

#What are the rules for SMS marketing, opt-outs and personal data?

These summarise CA and ODPC documents as we read them on 2026-11-02. Not legal advice; ask counsel how they apply to you.

#The CA's consumer protection guidelines

The CA's Consumer Protection Guidelines and Customer Care Standards were first issued in July 2022 and re-issued in February 2025. They say they take effect 12 months after the date of issue (CA guidelines, 2025). On SMS marketing they say:

• Opt-in only. No service provider may use an opt-out process to sign people up for marketing (6.2.2.1). Licensees must keep records showing that the consumer started the request from their own number (MSISDN) before being subscribed to a service (6.2.2.3).
• A free opt-out. Marketing and corporate messages sent by SMS or email must be free and carry an opt-out option, unless the subscriber agreed otherwise (6.2.1.7).
• 7 a.m. to 7 p.m. Marketing SMS may only be sent between 7.00 a.m. and 7.00 p.m., unless it answers a request the customer just made or the customer expressly agreed to other times (6.2.2.5).
• Do-not-contact registers. Licensed network providers must run their own "Do Not SMS, Do Not Call, Do Not Spam and Do Not Disturb" register, or join a national one. They must let all their subscribers register, and must not deliver spam or telemarketing to registered numbers from themselves or other providers (6.2.2.6 and 6.2.2.7).

The older Kenya Information and Communications (Consumer Protection) Regulations, 2010 still set the base rule. Regulation 17 makes it an offence to use automated calling systems, fax or email for direct marketing without the subscriber's prior consent, and says all automated direct-marketing schemes in Kenya must be opt-in (CA copy of the 2010 regulations).

How people opt out in practice depends on the operator. Safaricom puts it in its *456# menu under STOP, then Promotional Messages, where a subscriber can block a sender by name, and premium service subscriptions are listed in the same menu (Kenyans.co.ke, 2019). That report is from 2019, so the menu numbers may have changed. We didn't find a CA document that fixes a single opt-out code across all operators.

#The Data Protection Act 2019 and the ODPC

The Data Protection Act, No. 24 of 2019, came into force on 25 November 2019. Section 37 bars using personal data for commercial purposes unless the person gave express consent, or a written law allows it and the person was told at collection (Data Protection Act). The Data Protection (General) Regulations, 2021 add the direct marketing rules (General Regulations):

• Regulation 15 lists when personal data may be used for direct marketing: data collected from the person, who was told marketing is a purpose and consented, with a simplified opt-out that the person hasn't used. Marketing messages must show where to send a free request to stop. Using personal data commercially without consent is an offence.
• Regulation 16 says the opt-out must be clear, quick, direct, free (or nominal cost) and accessible to people with disabilities.
• Regulation 17 asks for an opt-out statement in each marketing message. For SMS it gives the example of replying with a single word, and an "opt out of everything" choice must always be offered.

The ODPC's guidance note for the communication sector (December 2023) gives examples. Someone who contacts a company with a complaint doesn't expect to be added to its bulk marketing SMS list. Customers shouldn't be opted in to marketing by default. Providers must offer a free, easy way to opt out of subscriptions and promotional messages (ODPC guidance note). The ODPC also lists a separate guidance note on consent on its guidelines page. We couldn't extract that file's text, so we don't summarise it here.

#Sender IDs and what that means for OTP

We didn't find a CA rule that sets up a national register of alphanumeric sender IDs. In practice operators and SMS providers register them under contract, so ask your provider what it needs for Kenyan routes. A one-time passcode the user asked for isn't marketing, so the opt-in and time-window rules for marketing shouldn't apply to it. Still, send it from a sender set up for transactional traffic, keep it free of offers, and don't reuse numbers collected for verification for marketing unless the person opted in.

#Which messaging apps and channels reach people?

SMS reaches every active mobile, and Kenyans still send a lot of it: the CA counted 57.1 billion domestic SMS in the year to June 2026, down 0.3% on the year before (CA sector statistics). For WhatsApp, Meta doesn't price Kenya as a separate market. Kenya is one of the "Rest of Africa" markets on its rate card, and Meta's page showed no Kenya-specific rate change for 2025 or 2026 when we read it (Meta pricing, read on 2026-11-02). Our WhatsApp Business API pricing post covers the regions.

We found no published source that measures messaging-app use in Kenya in a way we can verify, so we don't quote shares. Measure your own opted-in customers instead: check which apps they are registered on, route each person to the channel they use, and keep SMS as the fallback. Our channel-by-country guide shows the method.

#How do I check WhatsApp registration for a Kenyan customer list?

Normalise every row with normalize_ke() first, then run one check per number. A check tells you whether a number is registered at the time of the check. It can't tell you whether the person wants your messages:

For lists, use a bulk job and upload the CSV with default_country=KE, so numbers written as 07XX XXXXXX are read as Kenyan. WhatsApp checks get the bulk price only for groups of at least 132 numbers from the same country in one job, so collect a day's Kenyan numbers into one job rather than many small ones. POST /v1/jobs/estimate is free and shows the maximum cost before anything runs; see current prices. Our bulk WhatsApp number check post walks through the flow.

#What changed recently?

The rows for KE and +254 in our numbering-plan changes dataset, built from libphonenumber's release notes:

Latest numbering-plan updates for KE: 2026-07-16 (v9.0.35), 2026-06-17 (v9.0.33), 2026-03-26 (v9.0.27), 2025-09-24 (v9.0.15), 2024-06-13 (v8.13.39).

Kenya's metadata changes often: 17 numbering updates since 2019, three of them in 2026 (March, June and July). That matches the regulator's pace. The CA keeps handing out small 01 and 07 blocks to new holders, and the April 2026 plan includes blocks that libphonenumber didn't accept when we checked. Update your library at least monthly. On the rules side, the newest documents are the SIM registration regulations of May 2025 and the re-issued consumer protection guidelines of February 2025.

#What can MobileValidate check for Kenyan numbers?

Generated from our public catalog:

* bulk jobs only. Catalog as fetched on 2026-11-02; the live list is at GET /v1/services.

A lookup returns network and registration facts. It never returns a subscriber's name, ID number or address, and we don't offer "number details" searches.

Because the prefix shows only the range holder, the useful Kenyan lookup is the current network: HLR lookup for live reachability and porting, or MNP lookup for ported or not ported and the current network code. Here is a small flow for a customer list. One real-time lookup returns the current network and WhatsApp registration. It uses the public sandbox key mv_test_publicSandboxn9ZgneuhR1B9CRfKG3fulym and our test values. The sandbox accepts only those UK drama numbers, so the example uses them. With a live key, pass the output of normalize_ke().

import os

import requests  # pip install requests

API = "https://api.mobilevalidate.com/v1/lookup"
KEY = os.environ["MOBILEVALIDATE_API_KEY"]


def channels(numbers: list[str]) -> dict[str, dict]:
    """Current network and WhatsApp registration per number. None means we don't know."""
    r = requests.post(API, headers={"Authorization": f"Bearer {KEY}"}, timeout=15,
                      json={"numbers": numbers, "checks": ["carrier", "whatsapp"], "wait": 5})
    r.raise_for_status()
    out = {}
    for row in r.json()["results"]:
        carrier, wa = row["checks"]["network.carrier"], row["checks"]["whatsapp.registered"]
        attrs = carrier["attributes"] or {}
        out[row["e164"]] = {
            "network": attrs.get("carrier"),
            "whatsapp": wa["registered"] if wa["status"] == "completed" else None,
        }
    return out


for number, info in channels(["+447700900001", "+447700900002", "+447700900005"]).items():
    print(number, info)

We ran it against the sandbox on 2026-11-02. It printed:

+447700900001 {'network': 'Test Carrier', 'whatsapp': True}
+447700900002 {'network': None, 'whatsapp': False}
+447700900005 {'network': None, 'whatsapp': None}

Keep None apart from False: None means we don't know, and it's never billed. Requests with 20 or more consecutive numbers are refused (403 suspected_enumeration), and our acceptable use policy forbids finding recipients for unsolicited messages. People can object through our opt-out form. See WhatsApp number check and carrier lookup for the fields.

#What are the key takeaways?

• Kenyan mobiles are +254 plus nine digits starting with 7 or 1, written 07XX XXXXXX or 01XX XXXXXX at home. Store the E.164 form.
• Kenya's exit code is 000, so rewrite a leading 00 to + before parsing, or 00254… will fail.
• The CA plan shows the range holder: mainly Safaricom, Airtel and Telkom, plus small 01 and 07 blocks for newer holders. Library carrier names don't always match it, and porting (since 1 April 2011, within four hours) can move any number.
• Marketing SMS needs opt-in, a free opt-out in each message and, under the CA's guidelines, the 7 a.m. to 7 p.m. window. The Data Protection Act requires express consent for commercial use.
• Check WhatsApp registration only for customers you hold lawfully, keep unknown apart from false, and never treat registration as consent.

Platform, regulator and company names are used descriptively. MobileValidate is not affiliated with any of them.