Think Twice Kenya has been ordered to pay Sh700,000 in compensation after the Office of the Data Protection Commissioner (ODPC) found the company unlawfully used a minor’s photographs for commercial gain without obtaining parental consent.
In a determination issued under ODPC Complaint No. 0653 of 2025, the Data Commissioner ruled that the company breached the Data Protection Act, 2019 by publishing and circulating the child’s images across its social media platforms to promote its business activities.
The complaint was lodged on May 7, 2025, by the minor’s parent, who told the regulator that her daughter’s photographs had been collected and displayed online without her knowledge or approval.
According to the ODPC, the images were shared on Facebook and TikTok for over a year beginning May 2024.
Investigations by the regulator confirmed that the images were still active during the inquiry.
“Upon careful analysis of the evidence and applicable law, the Office found that indeed the minor’s images were still actively in use on TikTok and Facebook platforms,” the ruling reads.
The ODPC noted that Think Twice Kenya was formally notified of the complaint and warned that the alleged conduct, if proven, would amount to a violation of the Act.
However, the company failed to engage the process.
“Despite effective and prompt service of the notification of complaint, the Respondent remained unresponsive at all material times,” the Data Commissioner stated.
At the heart of the dispute was whether the company obtained valid consent from the child’s parent or guardian, as required when processing children’s personal data.
The Commissioner emphasized that consent must be express, informed and provable.
“Valid consent is a product of conscious decision-making and requires affirmative action. It should be demonstrable and capable of being proven,” the ruling states.
Under Kenyan law, the burden of proving consent rests with the data controller.
The ODPC found that Think Twice Kenya failed to meet this threshold.
“The Respondent herein failed, refused and/or neglected to furnish the Office with a response to the notification of complaint,” the Commissioner ruled, adding that the company therefore “failed to demonstrate that indeed the Complainant expressly consented to the use of her child’s images for marketing and advertising.”
The regulator further found that by publishing the images to promote its services, the company was advancing its own commercial interests.
“This constituted the use of the minor’s images for commercial purposes which required express consent,” the determination states.
As a result, the ODPC awarded compensation under Section 65 of the Data Protection Act, which allows damages for both financial and non-financial harm, including distress.
“The Respondent is hereby directed to compensate the Complainant the amount of Kenya Shillings Seven Hundred Thousand Only (Sh 700,000),” the Commissioner ordered.
In addition to the financial penalty, the Data Commissioner issued an Enforcement Notice against the company for failing to comply with its obligations as a data controller under the Act.
“Having found that the Respondent did not fulfill its obligations as a data controller to the Complainant as a data subject, the Office hereby orders for an enforcement notice to be issued,” the commissioner stated
The parties have 30 days to appeal the decision to the High Court of Kenya.
