AI-fuelled campaigns: How voter data security faces new test

Immaculate Kassait, Data Commissioner. [File Courtesy]

Kenya’s data protection watchdog is facing a new question as artificial intelligence (AI) makes it easier to manufacture political messages and present them as genuine public opinion ahead of the 2027 General Election: how far can campaigners go when personal data is used to decide who sees those messages and why?

The question has gained urgency after US-based AI company Anthropic identified a Kenya-based operation that used its Claude system to mass-produce political content, including posts praising Energy CS Opiyo Wandayi and messages portraying opposition figures as politically weakened.

The operation was designed to make coordinated messages look like spontaneous grassroots commentary.

Anthropic said it found no evidence of government involvement and described the activity as consistent with a domestic Kenyan operation. It classified the network as Category One on its Breakout Scale, meaning the activity remained within fake accounts and local influencers on X and did not reach or influence real people.

But the case offers a glimpse of a potentially bigger problem.

What happens when AI-generated political messaging is combined with personal data to identify particular groups of voters, infer their political preferences or tailor messages intended to influence them?

The Office of the Data Protection Commissioner (ODPC) says the answer starts with a principle that predates generative AI: political actors cannot escape data protection obligations simply because technology is doing the processing.

Under the Data Protection Act, 2019, personal data must be processed lawfully, fairly and transparently, collected for specified and legitimate purposes and limited to what is necessary. The law also gives data subjects rights over how their information is processed.

The Data Protection Act also provides safeguards around decisions based solely on automated processing, including profiling, where such decisions produce legal effects or significantly affect an individual.

For political campaigns, the regulatory line is particularly important.

Kenya’s Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 list canvassing political support among activities for which registration as a data controller or processor is mandatory.

That means the data protection question around AI-assisted campaigning is not simply whether a politician, campaign team or communications agency used AI to write a social media post.

It is also about where the information used to shape that message came from, whether it was obtained lawfully, what was inferred from it, who was targeted and whether those people were given the protections required by law.

Data Commissioner Immaculate Kassait says the concerns become more serious where personal data is used to profile voters or infer their political opinions, preferences or vulnerabilities.

Political beliefs and affiliation fall within sensitive areas of personal information, meaning any attempt to derive such information from other data for political targeting would attract heightened scrutiny.

That could become significant as campaigns become increasingly personalised.

For example, a campaign operation could theoretically combine information about people’s online behaviour, interests, location or other personal information to identify groups considered more receptive to a particular political message. The legal question would then move beyond the wording of the message itself to the processing behind it.

Was the information collected lawfully? What was the purpose? What data was used? Who was targeted? And was there a lawful basis for the processing?

Ms Kassait says political actors cannot avoid those questions by handing the work to an AI system or an outside technology provider.

Responsibility, the Commissioner says, follows the data through the processing chain, with political parties or candidates potentially carrying primary responsibility as data controllers or processors, while third-party vendors must also be properly vetted.

That becomes particularly important as political campaigns increasingly rely on external technology companies, data providers and digital platforms.

The Data Protection Act gives the ODPC powers to investigate unlawful processing, require compliance and take enforcement action where the law has been breached.

The electoral context does not create an exemption from data protection obligations.

Kenya’s existing framework therefore provides a starting point for dealing with AI-assisted political targeting. The Commissioner points to the Data Protection Act (DPA), ODPC guidance on electoral purposes and the country’s wider policy framework on AI and emerging technologies.

But the effectiveness of those safeguards will depend on enforcement and cooperation between institutions.

The Commissioner says agencies including the ODPC, the Independent Electoral and Boundaries Commission (IEBC), the Office of the Registrar of Political Parties (ORPP) and other relevant stakeholders will need to work together, while political actors should undertake data protection impact assessments before deploying campaign technologies that could pose a high risk to people’s rights and freedoms.

The High Court has previously emphasised that electoral bodies dealing with personal information must comply with data protection requirements and undertake a data protection impact assessment where processing is likely to pose a high risk to the rights and freedoms of data subjects.

The emerging AI challenge, however, adds another layer.

Synthetic political content can make it difficult for voters to distinguish between genuine public sentiment and a coordinated campaign designed to look organic.

Kassait says data subjects have a right to know who is processing their information and why. The broader question of whether political content has been artificially generated also raises transparency concerns, particularly where technology is used to make coordinated messaging appear to come from ordinary citizens.

The Anthropic case illustrates the problem.

The company said it did not establish the real-world identity of those behind the operation, although it concluded that the campaign appeared to be domestic and was plausibly aligned with the ruling coalition. It also said the activity had failed to break out of the network of fake accounts and influence real people.

That finding may offer some reassurance, but it also shows how quickly the technology can be organised for political communication.

Anthropic said the Kenyan actor supplied topics, talking points and hashtags, then used Claude to turn them into batches of posts ready for publication. The company said the model’s main value to the operation was volume and the appearance of authenticity, while the underlying political messages had already been decided by the actors.

For Kenya’s 2027 election, that distinction could prove important.

AI does not necessarily create the political message. It can make an existing campaign strategy faster, cheaper and easier to disguise as ordinary public conversation.

And if personal information is added to that process, the stakes become higher.

The Commissioner recommends safeguards including data protection impact assessments, establishing a lawful basis for processing, stronger due diligence of third-party vendors, transparency measures for AI-generated political content and clear internal responsibility for handling campaign data.

The challenge for regulators and political actors will therefore not be to stop AI from writing political messages.

It will be to ensure that the technology does not become a shortcut around voters’ rights.

As Kenya heads towards the 2027 General Election, the harder question may not be whether AI can manufacture convincing political speech. It is whether voters will know when that speech is being created for them, based on information collected about them and who is ultimately responsible for putting it in front of them.