By Jonathan Mbiriyamveka
Harare – A routine regulatory report has ignited a quiet but growing debate about digital privacy in Zimbabwe.
The latest POTRAZ sector performance report contains an unusual level of detail: exactly how much data Zimbabweans consume on WhatsApp, YouTube, Facebook, and X (formerly Twitter).
According to the Q4 2025 report, WhatsApp accounts for 20.69% of all mobile internet traffic, YouTube 9.53%, Facebook 7.89%, and X a mere 0.40%. The remaining 61.48% is classified as “Other,” including TikTok, Instagram, and Netflix.
While POTRAZ presents this data as routine market analysis, privacy advocates are asking a pointed question: How does the regulator know exactly which apps citizens are using, and should that information be collected in the first place?
“This is a classic case of function creep,” said a digital rights researcher based in Southern Africa who requested anonymity.
“POTRAZ may say this is just for network management or market research, but the infrastructure that allows app-specific tracking can very easily be repurposed for surveillance.”
POTRAZ derives its data from mobile network operators, who have technical visibility into traffic patterns.
Deep packet inspection (DPI) technology, commonly used for network optimization, can identify application signatures. However, critics argue that such granular reporting goes beyond what is necessary for regulation.
Similar data collection practices in other countries have raised alarms. In 2024, a European Union court ruled that blanket retention of traffic data violated privacy rights.
Zimbabwe’s Constitution guarantees a right to privacy under Section 57, but no specific data protection law has been fully implemented.
The regulator did not explicitly state whether individual users can be identified from the aggregated data. In past statements, POTRAZ has maintained that it collects only anonymized, operator-level statistics for policy and infrastructure planning.
Still, the timing of the report’s release — alongside rising government interest in digital surveillance — has fueled concern.
In 2025, Zimbabwe accelerated its push toward a National Artificial Intelligence Strategy, which will require vast amounts of data for training algorithms.
“The question is not just whether POTRAZ can see what apps you use,” said a Harare-based tech lawyer. “It’s whether that capability will expand — and who else might gain access.”
POTRAZ is yet to comment on the privacy implications of its app-specific traffic reporting.
But the report itself notes that data collection is “based on data provided by service providers” and that the authority is “not liable for the inaccuracy of any information.”
For now, Zimbabweans continue to scroll, stream, and message — mostly unaware that their digital habits are being counted, categorized, and published.
Whether that amounts to a privacy breach or merely sensible regulation may be the next big debate in Zimbabwe’s digital age.
About Author
