Tanzania Social Media Tax Rule Sparks Privacy and Cybersecurity Fears

The Tanzanian government has introduced a new rule requiring businesses selling on social media platforms to display their Tax Identification Number (TIN) or tax clearance certificate publicly on their profiles starting from July 1, 2026. This requirement, issued by Finance Minister Khamis Mussa Omar, is part of amendments to the Tax Administration (General) Regulations, 2016, aimed at simplifying tax enforcement and increasing compliance in the digital economy. Non-compliance can result in fines and, in some cases, imprisonment for up to six months.

The Tanzania Revenue Authority (TRA) has issued the rule, targeting online businesses and traders, including those on platforms such as Instagram, Facebook, WhatsApp Business, TikTok, and X. The public display of tax identifiers is intended to make tax compliance easier and ensure that tax authorities can more easily monitor digital transactions. However, this new requirement has sparked concerns over privacy, identity theft, and cybersecurity.

Critics argue that publicly posting a TIN or tax clearance certificate increases the risk of phishing, fraud, impersonation, and social engineering scams. For small businesses that manage their accounts informally, this public disclosure poses a significant privacy risk, potentially exposing their tax status and making it easier for malicious actors to correlate commercial activity with tax information.

Moreover, the rule creates a data-minimisation issue, as it requires the publication of an identifier that, while useful for tax administration, is not necessarily necessary for customer trust. In a country already grappling with mandatory registration and content controls, this rule could deepen surveillance of ordinary commercial activity and diminish the sense of anonymity online.

Tanzania's legal framework already encompasses strong penalties for cyber-related offenses under the Cybercrimes Act of 2015, as well as a Personal Data Protection Act of 2022, which came into effect on May 1, 2023, and established a dedicated data protection authority in 2024. The combination of these regulations makes the new rule that forces tax data onto public profiles seem inconsistent with the existing privacy architecture and the increasing cybersecurity obligations in the country.

In response to the new tax rules, businesses might shift their sales to less visible channels such as WhatsApp groups, encrypted messaging, or offline payment links. While this could complicate enforcement and raise new cybersecurity risks, it may also push the government to further tighten its control over digital platforms. Tanzania has been expanding taxation of digital activity since the Finance Act of 2022 introduced taxation of digital services, with the digital services tax set at 2% of gross payments, and VAT at 18%. The income tax rate on nonresident digital services also increased from 2% to 3% on July 1, 2026.

The TRA emphasizes that the new rule is part of a broader strategy to tax online activities, including platforms, digital intermediaries, and online marketplace services. For instance, non-resident providers of digital services selling in Tanzania face a digital services tax, while a 5% withholding tax applies to payments to resident digital content creators, and a 3% withholding tax is imposed on payments to resident persons through digital-asset exchange platforms.