Children have one job: to make mistakes, try things out, and figure out who they are becoming. Generative AI tools, by handing children ready-made answers, risk taking that job away before children ever get the chance to do it themselves. Yet, a blanket ban is never really a comprehensive solution.
At this year’s forum on Internet Freedom in Africa (FIFAfrica ‘26), our Executive Director, Adeboro Odunlami, raised the above as a quiet but pointed concern.
The forum, organized by CIPESA, ran from 28 September to 1 October 2026 in Mauritius. Adeboro represented DIID on the panel “Children, AI, and the Age Debate in Africa”, speaking alongside Belinda Matore (University of Pretoria), Afia Asantewaa Asare-Kyei (Meta’s Oversight Board), Yasmin Ahmed (FemTech Law Initiative) and Lillian Kariuki (Africa Child Online Safety Alliance).
The panel’s focus was to discuss a question of AI, social media and age-based bans in Africa, as countries like Australia, Gabon, and the UK have moved to ban under-16s from social media.
A ban gives political salience, but it is not a holistic solution.
Adeboro opened with a wider picture of what is at stake. Africa is projected to be home to the youngest population in the world by 2030. She also noted a Research where only about 2 percent of adults passed a test on divergent thinking, while roughly 90 percent of children in nursery school passed the same test. This showed that children have a natural capacity for creative, outside-the-box thinking. Generative AI tools, used without guidance, risk handing them answers before they ever practice using that capacity. A generation raised this way enters the labour force well served by tools, but under-trained in thinking for themselves. A child’s pre-existing disadvantage may compound problems here too. That is, children who start behind stay behind, carried further apart by how differently they get to use these tools.
Against that backdrop, Adeboro’s case against a blanket ban has several layers.
A ban offers real political value to politicians. To the public, it comes off as a decisive action; much stronger than saying “we conducted a risk assessment”. This is why policymakers reach for it since many parents already clamour for it.
A blanket ban can also regulate the wrong place. Platforms flagged by UNICEF for risk include messaging apps that are outside Meta’s own oversight structures, and non-consensual images frequently move through platforms like Telegram that a social-media ban might not reach at all.
And the evidence has not caught up to the policy. Bans are spreading fast. Australia, the UK, Rwanda and Gabon have all moved on it, and more countries are following. But the early data from countries further along only tells part of the story. The number of accounts are dropping on major platforms, while usage rises on smaller, less regulated ones. However, a reduction in accounts is not the outcome anyone is actually after. Child online safety is.
Adeboro’s conclusion on this point was that children’s attention has become a commodity, and the fix starts with the design of the platforms built to capture it. Safety by design and platform accountability, using the least restrictive method available, address the actual mechanism at work. Whereas, a ban only addresses its visibility.
Where DIID stands
This is the version of child online safety DIID keeps advocating for. Rather than look for a single switch to flip, policy should be based on a set of deliberate, evidence-led choices. Regulation should target the actual harm and be built with an honest view of who it reaches, and the practical capacity to enforce it. Children should be treated as participants rather than subjects.
We were glad to bring this thinking to FIFAfrica26, in a room full of people working on the same questions from different corners of the continent.
This article was first published by the Digital Initiative for Innovation and Development (DIID). Click here to read more on its website.
Africa’s rapid adoption of digital public infrastructure is transforming how citizens access government and private services, but weak safeguards, digital exclusion and fragmented oversight are creating growing risks to human rights and democratic participation, a new continental report warns.
The 2026 State of Internet Freedom in Africa(SIFA) report, unveiled by Collaboration on International ICT Policy for East and Southern Africa (CIPESA) during Forum on Internet Freedom in Africa 2026 (FIFAfrica26) in Mauritius, examines the growing use of Digital Public Infrastructure (DPI) across 11 African countries and its implications for privacy, inclusion, civic participation and democratic governance.
The study covered Egypt, Ethiopia, Ghana, Kenya, Nigeria, Senegal, South Africa, Tunisia, Uganda, Zambia and Zimbabwe.
“DPI refers to foundational digital systems that allow governments, businesses and citizens to interact electronically. The report identifies three main components: digital identity, digital payments and data exchange platforms” the report explains.
According to the study, African governments are increasingly replacing fragmented government systems with interconnected digital platforms capable of sharing data, verifying identities, processing payments and delivering public services.
By the end of September 2026, 17 African countries were among 39 countries globally participating in the 50-in-5 campaign, an initiative aimed at helping countries design, launch and scale components of digital public infrastructure.
The report says early progress in countries including Ethiopia, Ghana, Kenya, Nigeria, Rwanda, Togo and Uganda, alongside continental digital transformation ambitions and support from development partners, has accelerated the adoption of DPI.
But the report cautions that technological progress is moving faster than the institutions and safeguards needed to protect citizens.
Digital Exclusion Remains A Major Concern
The study finds that people who are already digitally connected, formally documented and living in urban areas tend to benefit first from DPI systems.
Those facing barriers such as poor connectivity, limited digital literacy, disability, poverty or weak civil registration systems risk being left behind.
“Rural communities, low-income people, older people, persons with disabilities, migrants and communities facing contested citizenship are particularly vulnerable to exclusion” the report identifies.
It cites concerns raised over digital identity systems in Kenya and Uganda, where refugees, stateless people and some rural communities have faced exclusion.
The report warns that DPI can reproduce existing inequalities when a person’s ability to access services depends on documentation, biometric records, addresses or other foundational data that may be missing or inaccurate.
As more public and private services rely on the same foundational systems, a failure in one record can have consequences across multiple areas of a person’s life.
A citizen, for example, could face difficulties accessing a service because of an incorrect or missing identity, citizenship, address or birth record held by another government agency.
Connectivity Failures Could Have Wider Consequences
The report also highlights the growing dependence of essential services on connectivity and interconnected digital infrastructure.
“A cable cut, power failure, cloud outage or internet disruption could simultaneously affect identity systems, payments and public services” the report warns.
For landlocked countries, the report says resilience can also depend on neighbouring states, border crossings and regional infrastructure-restoration arrangements.
The study further finds that although governments are increasingly pursuing digital sovereignty, including local data centres, data localisation and domestic digital infrastructure where many national DPI systems remain dependent on foreign financing, technology companies and international standards.
AI generated image/CoPilot
The report identifies organisations and actors including the World Bank, development partners, Modular Open-Source Identification Platform (MOSIP), telecommunications operators, global payment networks and technology vendors as playing significant roles in financing, developing or operating various DPI systems.
Democracy And Civic Participation At Risk
The report says the consequences of DPI extend beyond service delivery to democratic participation.
It warns that the growing convergence of foundational identity systems with electoral processes and telecommunications infrastructure could expose citizens to democratic risks.
“Network disruptions, inaccurate administrative records and restrictions on digital platforms can affect people’s ability to participate in public life and exercise civic freedoms”, according to the study.
“Technology-facilitated gender-based violence, online harassment and misogynistic disinformation are also identified as factors that can discourage women from participating in political and civic life” the report shows.
The report argues that DPI does not necessarily create underlying inequalities, but can reproduce or intensify them when systems fail to account for differences in documentation, disability, gender, income, geography or language.
No Clear Continental Leaders or Laggards
The study cautions against ranking African countries simply according to their level of digital development.
It finds that countries can make significant progress in one aspect of DPI while continuing to face serious weaknesses in areas such as oversight, access or legal remedy.
According to the report, Nigeria, Ethiopia and Ghana perform strongly on aspects of scale and payments, while Kenya and South Africa are comparatively stronger on institutional contestability.
The broader finding, however, is that progress is uneven.
The report says technical development, institutional safeguards and rights protection can advance at different speeds within the same country.
Call For Stronger Safeguards
The report recommends that governments conduct human rights, data protection and equality impact assessments before major DPI systems are introduced or significantly expanded.
It also calls for transparent information about the agencies responsible for systems, suppliers and financiers, as well as accessible complaint and correction mechanisms.
Governments are urged to maintain non-digital alternatives so that citizens who cannot access digital systems are not excluded from essential services.
Oversight institutions, meanwhile, should conduct regular audits of national identity databases, interoperability platforms and government-to-person payment systems, according to the report.
The study also calls on technology companies, telecommunications operators, banks and payment firms to conduct human-rights due diligence on high-risk DPI projects, particularly those involving identity, biometrics, data exchange and surveillance.
Development partners and DPI financiers are urged to link funding and expansion to evidence of inclusion, rights protection, effective oversight and access to remedy rather than relying primarily on measures such as enrolment numbers, infrastructure coverage or transaction volumes.
For civil society and the media, the report recommends greater scrutiny of DPI before systems are deployed, including investigation of procurement, system design, vendor arrangements, identity and authentication failures and the use of digital systems in elections.
Building Trust Into Africa’s Digital Future
The report concludes that DPI is becoming an increasingly important part of the relationship between African states and their citizens.
While interconnected digital systems can improve administrative efficiency and financial inclusion, the study warns that they are not neutral simply because they are technological systems.
“Technical failures, inaccurate records and poorly designed access requirements can trigger cascading exclusion, particularly among people already facing barriers to connectivity, documentation and digital literacy” the report notes.
The report argues that the long-term legitimacy and public trust of DPI will depend on whether rights protections are built into the systems from the beginning rather than introduced later as compliance measures.
It recommends accessible non-digital channels, stronger data-protection enforcement, independent oversight, resilient connectivity and timely access to legal remedies as key elements of a rights-respecting digital future for Africa.
This article was first published by TalkAfrica on October 12, 2026. Click here to read more on their website
Uganda’s digital economy is expanding rapidly across finance, transport, agriculture, commerce, healthcare and public-service delivery. However, this growth is outpacing the legal, regulatory and institutional safeguards needed to address emerging concerns around personal and biometric data, artificial intelligence, platform work, digital exclusion and internet shutdowns.
Drawing on a 2025 survey, two commentaries and a policy submission by CIPESA, this policy brief examines Uganda’s evolving digital business landscape, business data practices, the future of work and the impact of internet disruptions. It highlights the gaps between technological advancement and effective governance and proposes actions for government, businesses, private sector associations and civil society to build an inclusive, resilient, and rights-respecting digital economy.
The brief finds that Uganda has established important legal protections, including the Data Protection and Privacy Act of 2019. The principal challenge, however, is implementation, enforcement, and the ability of regulatory and institutional frameworks to adapt to rapidly evolving technologies and business models. Businesses frequently collect personal and biometric data without sufficiently explaining how it will be used, stored, shared, or deleted. Meaningful consent, data security, and effective retention and deletion practices also remain inconsistent, particularly among businesses with limited compliance capacity.
These gaps have consequences beyond privacy and individual rights. Weak data governance can undermine trust in digital services, while inadequate safeguards for platform workers and persistent digital exclusion can limit who benefits from the digital economy. Internet shutdowns pose a broader threat, disrupting digital financial services, e-commerce, public services and other activities that increasingly depend on reliable connectivity.
The brief calls for coordinated action by government, businesses, private sector associations and civil society to:
Businesses
Strengthen data governance and informed consent: implement collection and processing frameworks built on explicit, freely given consent, backed by clear, accessible privacy notices.
Improve data security and lifecycle management: adopt encryption, regular security audits, and clear retention, deletion and minimisation policies.
Build organisational compliance capacity: appoint and train Data Protection Officers, embed privacy-by-design into product development, and run regular staff training on data protection, cybersecurity and phishing risks.
Strengthen digital resilience: develop business continuity plans for internet disruptions, and collaborate with civil society and legal actors to promote an open, secure and reliable internet.
Government of Uganda
Strengthen enforcement of the data protection framework by adequately resourcing the Personal Data Protection Office (PDPO) and other regulators to conduct audits, investigate violations, and impose proportionate sanctions.
Modernise the legal and policy framework to address biometric data, AI and platform work, aligned with constitutional and international human rights standards, and issue practical, sector-specific guidance to help businesses, particularly SMEs, comply.
Promote digital inclusion and public awareness through sustained education campaigns, including in local languages, and continued investment in affordable infrastructure and digital skills.
Safeguard the digital economy against internet disruptions by developing clear legal safeguards against shutdowns and ensuring any restrictions comply with constitutional and international human rights obligations.
Private Sector Associations
Build members’ capacity through regular training on data protection, cybersecurity, AI governance and business continuity planning.
Promote industry standards and peer learning by developing model policies and compliance toolkits for consistent implementation across member organisations.
Support risk management by encouraging periodic risk assessments among members and facilitating the sharing of lessons learned and mitigation strategies.
Civil Society Organisations
Strengthen multi-stakeholder collaboration among government, businesses, academia and technical experts on data protection, AI governance and digital rights.
Promote public awareness and digital rights literacy through accessible educational materials and community outreach.
Undertake research and evidence-based advocacy on biometric data governance, AI, platform work and internet shutdowns, including documenting their social, economic and human rights impacts, to support stronger legal frameworks and strategic litigation.
Support business compliance and resilience by developing practical guidance, templates and capacity-building support on responsible data governance.
In May 2026, CIPESA joined the World Organisation Against Torture (OMCT) and partners to conduct a three-day workshop on digital security and Open-Source Intelligence (OSINT) for Congolese human rights defenders and journalists in exile in Uganda.
The workshop addressed the various threats this community continues to navigate daily including account compromise, phishing-borne malware, surveillance by state and non-state actors, device confiscation, and exposure to coordinated disinformation operating across both home-country and diaspora information spaces.
The 23 participants were drawn from women’s rights organisations, community documentation initiatives, justice and accountability groups, and broader human rights defender (HRD) support structures. A pre-workshop participant assessment found that one in three respondents had received no prior digital security training, highlighting a significant gap between the threats faced and necessary skills and knowledge to mitigate them.
The findings underscored the need to begin with foundational digital security practices before moving on to more advanced verification and documentation techniques.
Reported incidents within the cohort included hacked accounts, phishing attempts, confiscation of phones by security agents, surveillance of digital communications, and impersonation. One respondent described documentation work conducted in close proximity to alleged perpetrators of human rights violations, with no possibility of relocating, and elevated personal risk attached to ordinary data collection. These conditions, common across conflict-affected zones as is the case in the Democratic Republic of Congo (DRC), shape the technical and ethical constraints under which any digital security training must be designed.
CIPESA’s contribution builds on the organisation’s broader work supporting at-risk communities across the region, including through the Level-Up programme, which has provided digital security support to HRD organisations in Kenya, Ethiopia, Tanzania, South Sudan, and Uganda.
It also draws on CIPESA’s wider efforts to strengthen the capacity of civil society actors to advance digital rights in Africa. Across these engagements, a consistent key insight is that defenders rarely need more tools than they already have. More often, they need a clearer understanding of how those tools work, where the vulnerabilities lie, and which everyday habits can expose them to risks.
The workshop therefore began with the fundamentals of digital security: how information travels online, where vulnerabilities emerge, how accounts are compromised, and why stronger authentication practices matter. Participants explored common attack pathways and practical measures for reducing exposure in their day-to-day work. The tools and exercises were selected for compatibility with the devices and operating systems that participants already relied on.
Foundations of digital safety
Participants installed secure communication tools like Tor and Orbot on their devices, worked through phishing recognition exercises based on scenarios familiar to the cohort, and tested safer-browsing configurations. The goal was not to introduce defenders to a long list of tools but to build working familiarity with a few, including practices of opening, inspecting, and configuring in ways they could transfer the acquired skills and knowledge onto their communities’ and colleagues’ devices.
Building on these foundations, the workshop moved onto OSINT and verification techniques that help defenders assess contested information and strengthen the credibility of human rights documentation. Participants practised reverse image searching against cases of recycled imagery presented as fresh evidence; used ExifTool to extract and read image metadata; and verified short-form video using the InVID-WeVerify verification plugin, parsing keyframes and tracing material across platforms.
Secure OSINT Documentation
Effective documentation and digital security are increasingly interconnected skills. The session on secure documentation walked participants through eyeWitness to Atrocities, the camera application developed by the International Bar Association that embeds metadata to support evidentiary chain of custody. In 2018, footage captured with eyeWitness was admitted as evidence before a military tribunal in Bukavu town, which subsequently convicted two armed group commanders of murder and torture, constituting crimes against humanity. It was the first time eyeWitness footage had been used in court proceedings in the DRC. The session also demonstrated structured data collection and management using Uwazi and KoBoToolbox, both open-source platforms widely adopted for field research and human rights documentation.
These tools strengthened participants’ capacity to document and verify human rights abuses while also helping them to understand how their digital footprints can be exploited by adversaries. They also helped participants assess potentially misleading or manipulated content without inadvertently amplifying false information.
Outcomes
The training was grounded in the recognition that participants understand their own operating environments better than external facilitators ever can. The sessions were designed to strengthen existing knowledge and support locally informed security practices.
According to pre- and post-workshop evaluations, participant capacity increased from a composite score of 2.27 to 3.69 on a five-point scale. The results reflected a shift from limited familiarity with core concepts to practical competence in applying digital security and verification tools within their own documentation and advocacy work.
To extend the impact of the workshop beyond the participants in the room, CIPESA adopted a Training of Trainers (ToT) approach. Participants were encouraged to cascade the knowledge, tools, and practices acquired during the training within their organisations and communities. The approach supports the development of locally embedded digital security capacity and reduces reliance on external technical support.
Beyond the training
CIPESA’s work with refugee and exiled defender communities will continue, in collaboration with OMCT and other partners with adjacent mandates. The next phase will build on this foundation through sequenced follow-up modules, applied casework on documented matters, and ongoing technical support for the organisations represented in the cohort.
The aim is not simply to transfer skills during a workshop, but to strengthen the long-term resilience of organisations and networks engaged in human rights documentation, advocacy, and accountability work in increasingly complex digital environments.
Child online safety has returned to the forefront of digital governance discussions across Africa and globally. New regulatory initiatives from the United Nations, the African Union, and industry coalitions reflect growing concern about the risks children face in increasingly digital societies. Yet, while policy commitments are multiplying, implementation continues to lag.
The challenge is particularly acute in Africa, where internet access is expanding rapidly while child protection systems struggle to keep pace. As more children go online, they are increasingly exposed to cyberbullying, online grooming, sexual exploitation, harmful content, privacy violations, and emerging Artificial Intelligence (AI)-enabled risks such as disinformation and misinformation.
Just last month, the United Nations Human Rights Office called for stronger regulation and government oversight, publishing 10 key points to make platforms safer for children, urging technology companies to embed child safety into their product design and address the growing risk posed by AI. This reflects a broader shift in global digital policy. The Global Digital Compact has committed states to strengthen legal and policy frameworks for children’s rights in digital spaces and to prioritise national online child safety policies and standards by 2030.
At the continental level, the African Union Child Online Safety and Empowerment Policy of 2024 sets out principles on children’s safety and privacy, and participation to guide member states in developing national strategies, while the Global System for Mobile Communications Association (GSMA), UNICEF, and partners recently launched the Africa Taskforce on Child Online Protectionto strengthen coordination among governments, mobile operators, technology companies, regulators, law enforcement, civil society, and young people.
Some African countries are already taking steps to strengthen child protection online. Rwanda is considering restrictions on social media access for children under 16, while Zimbabwe recently approved a National Child Online Protection Policy for 2026–2030 aimed at addressing online sexual exploitation, cyberbullying, grooming, harmful content, sextortion, and privacy violations.
These developments reflect a broader global shift in approaches to child online safety. Australia has legislated to restrict social media access for children under 16, while the United Kingdom recently concluded a national consultation examining age-based protections and enforcement mechanisms. Across several countries, governments, regulators, and civil society organisations are increasingly calling on technology companies to strengthen safeguards and take greater responsibility for protecting children online.
A broader strategy would expand efforts to ensure that while policies and frameworks on child protection are being developed, children are involved. This would help them understand the several platforms available for use, associated risks, pressures, and opportunities for digital life. The Africa Taskforce on Child Online Protection recognises this mode of participation and has now included youth representatives by integrating their voices for a child-centered digital future in Africa. Replicating this approach at the national level, through wide youth consultations, school-based dialogues, child-friendly policy forums, and participatory design of reporting and safety tools, will foster a healthy digital environment for the young.
It is against this backdrop that the Digital Rights Alliance Africa (DRAA) report, “Child Protection and Safety Online in Africa: The Law, Privacy, Challenges and Solutions, provides crucial, ground-level evidence across 10 countries – Algeria, Botswana, Egypt, Ghana, Kenya, Nigeria, Rwanda, South Africa, Tanzania, and Uganda. It highlights the gaps in child safety and protection online despite technological advancement and expansion.
The report highlights several recommendations that could help foster child safety and protection online, which are directed to different stakeholders, including the government, civil society organisations, international organisations, development partners, the technology sector, media, academia, parents, and the general community, and among others include;
Parliaments should enact specific national laws that protect children’s privacy and safety in digital spaces, with clear safeguards tailored to children’s particular vulnerabilities, such as cyberbullying, grooming, online sexual exploitation, image-based abuse, harmful content, misuse of children’s data, profiling, and age-inappropriate design.
Governments should invest in the implementation of national strategies that set out the roles of government agencies, the judiciary, data protection authorities, law enforcement actors, educators, parents, and the private sector in protecting children in the digital age.
Platforms and telecom companies should design child-friendly products and services, minimise the collection and retention of children’s data, introduce age verification and parental controls, publish transparency reports, and submit protection measures to independent audits.
The media should monitor, document, and report objectively, and expose all cases of online child abuse and demand accountability from the responsible parties.
Civil society organisations should engage in advocacy, awareness raising, legal reform, evidence-based research, and documentation of issues affecting child safety online in order to demand and push for accountability of all the relevant stakeholders.
All stakeholders must ensure that children are meaningfully included in innovation and programming, and that children and young people are actively engaged as participants in discussions, collaborations, and co-design of digital solutions.
Ultimately, for children to stay online, measures must go beyond mere policy expressions and aspirations as reiterated in the Global Digital Compact’s 2030. Laws and frameworks specific to child protection and safety online should be developed and stringently implemented. Moreover, digital service providers must be held accountable, and other stakeholders, including parents, schools, and communities, should join efforts to ensure that children are empowered to safely utilise digital technologies.
CIPESA and partners continue to advocate for rights-respecting policies that advance children’s protection, participation, access, and safe use of digital technologies, while calling on technology companies to embed these principles in platform design, governance, and accountability systems.
