Two days before Uganda’s January 2026 election, the internet went dark nationwide, with no state of emergency declared, no court order, and no warning beyond a regulator’s statement about curbing misinformation. Tanzania did something similar around its own 2025 election, cutting access from October 29 to November 3. These aren’t glitches. According to the digital rights group CIPESA, which has tracked internet freedom across the continent for over a decade, shutdowns during elections have become close to routine, and the African Commission’s own resolution against the practice, Res.580, carries no enforcement teeth to stop it.
What’s changing now is that shutdowns are just one tool in a much bigger toolbox.
The New Legal Architecture
Across the continent, governments are passing cybercrime and data laws that read, on paper, like ordinary modernization: protecting citizens from fraud, protecting personal data, regulating platforms. Zambia’s Cyber Crimes Act, passed in April 2025, criminalizes “false information” with penalties up to two years in prison. Within months, three people were arrested under it for social media posts about the president’s health. In Niger, six journalists were arrested this past year under a similar cybercrime statute simply for sharing an invitation to a press briefing. Tanzania’s Cybercrimes Act has been used to chill bloggers, activists, and ordinary users, according to a CIPESA, PALU, and JamiiAfrica joint report, while platforms like Clubhouse, X, and JamiiForums have been blocked outright.
The pattern CIPESA researchers keep flagging is the deliberate vagueness. Laws framed as fighting “false news,” “cyberbullying,” or “national security threats” hand prosecutors broad discretion — and broad discretion tends to land hardest on whoever is inconvenient to power that week, journalists, opposition figures, and disproportionately young people who dominate African social media use and protest organizing.
Where the Weaponization Is Already Visible
This isn’t hypothetical. Zambian youth protesters were arrested under public order provisions well before the 2025 cyber law existed, a pattern that predates the legislation but that the new statutes now formalize and extend online. Kenya’s own #RejectFinanceBill youth-led protests in recent years showed how quickly state actors can pair internet throttling with arrests once digital organizing threatens the status quo. And Africa’s rapid embrace of biometric digital ID, from Ghana’s GhanaCard covering 95% of adults to Ethiopia’s Fayda-ID enrolling 28 million people, means governments increasingly hold the infrastructure to identify, locate, and cross-reference exactly who posted what.
Who Benefits, and How
Several distinct beneficiaries emerge from this shift. Incumbent governments gain a legal shield for suppressing dissent that looks, to international observers, like ordinary law enforcement rather than censorship. Telecom regulators and security services gain expanded surveillance authority, often justified by genuine and rising cybercrime, INTERPOL’s 2026 Africa Cyberthreat Assessment found AI now implicated in 55% of reported cybercrimes on the continent, real fraud that gives cover for broader monitoring powers. Foreign technology and identity firms, meanwhile, are angling for a continent of over a billion mobile subscribers still building its regulatory rulebook; Worldcoin’s iris-scanning “Orb” rollout in Kenya collected biometric data from over 300,000 people before a court ordered it permanently deleted in 2025, ruling the company had bypassed consent requirements entirely.
Not every new law cuts one direction. Nigeria’s Data Protection Commission has fined Meta and pursued real enforcement against the very platforms critics worry about; South Africa’s Information Regulator forced WhatsApp to align its local privacy policy with EU standards. Over two-thirds of African countries now have some form of data protection legislation, a genuine gain civil society spent years demanding.
The Uncomfortable Question
So the honest tension is this — the same legal machinery capable of protecting a teenager’s data from an American tech company is equally capable of jailing her for a tweet. The words “cybersecurity,” “data protection,” and “digital sovereignty” all sound protective, and sometimes they are, but sovereignty exercised by a government against a foreign platform looks identical, on the statute books, to sovereignty exercised by a government against its own citizens. The difference lies entirely in who’s watching, who’s enforcing, and who gets to define “false.”
That’s worth sitting with the next time a government announces a new digital law “for your protection.”
