Côte d'Ivoire Telecoms and Mobile Money: AI and Customer Data

It is 7 p.m. in a customer contact center in Abidjan. An agent is handling her fortieth complaint of the day: a mobile money transfer sent to the wrong number. To save time, she copies the conversation with the customer, his phone number and the transaction ID into an AI assistant and asks for a clear, polite reply. The answer arrives in three seconds. The customer's data, meanwhile, has gone to a server abroad.

Telecom operators, e-money issuers and call centers are one of the pillars of the Ivorian digital economy. They also handle more personal data than almost anyone else, and they are where generative AI is spreading fastest.

A sector under two regulators

In Côte d'Ivoire, the Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI) holds a special position. It regulates the telecom sector and it is also the data protection authority under Law No. 2013-450 of 19 June 2013. For an operator, the body that grants technical licenses is the same one that oversees how subscriber data is used.

Mobile money services add a second layer. In the WAMU, electronic money issuance is governed by the BCEAO, in particular through its Instruction No. 008-05-2015. An operator or its payment subsidiary must therefore meet the requirements of both ARTCI and the financial regulator. For a full view of the formalities under Law 2013-450, read our guide to Law 2013-450 and ARTCI.

Some of the most sensitive data there is

A subscriber file is not like any other file. It often contains:

• the subscriber's identity and ID document details, linked to SIM card registration;

• their phone number and their call and top-up history;

• location data from the network;

• for mobile money, balances, transactions and beneficiaries.

Put together, this information paints a very precise picture of a person's life.

Where AI enters daily work

AI has many useful applications in the sector. The risk appears when real data travels with the request:

• Call centers: drafting a reply from a full conversation, or summarizing a complaint history.

• Fraud teams: having an export of suspicious transactions analyzed, with numbers and amounts.

• Marketing: segmenting a subscriber base or preparing SMS campaigns from a customer file.

• Network and IT teams: pasting technical logs or configuration files that contain credentials.

Many call centers also work for several clients at once. A leak can then expose a client company's data, which raises a question of contractual liability.

What ARTCI expects in 2026

ARTCI has strengthened its tools. In January 2026, it opened the national register of data protection correspondents. These correspondents must draw up an annual activity report and send a copy to the authority. In July 2026, the CERTINUM platform made it possible to file authorization requests online and track the process.

For an operator or a call center, the use of generative AI must therefore fit into this system: in the record of processing, in the formalities for transfers abroad, and in the correspondent's report. The country also adopted a national strategy for artificial intelligence and data governance in 2025, with a focus on ethics and local data hosting.

Why classic tools are not enough

Telecom companies often have firewalls, web filtering and sometimes network DLP. These tools struggle to see what happens inside an encrypted session with a legitimate AI website. We explain this in Why email and network DLP fail on ChatGPT.

Blocking AI is not a lasting answer either. In a call center, agents have a personal phone in their pocket. The data keeps flowing, but the company no longer sees it.

An approach built for operators and call centers

1. Map AI use by team: customer care, fraud, marketing, network.

2. Define the data banned from prompts: subscriber numbers, transaction IDs, ID documents, location data.

3. Update the formalities with ARTCI and the correspondent's register.

4. Review contracts with outsourced call centers to cover the use of AI.

5. Anonymize at the source instead of blocking, so teams keep the tool.

6. Keep evidence of avoided incidents for the annual report and audits.

To see these issues in their regional context, read our article on generative AI and data protection in West Africa.

What ZeusLock does

ZeusLock runs on the computers and browsers of agents and technical teams. It detects phone numbers, transaction IDs, names and other sensitive data in real time in the prompts and files sent to ChatGPT, Copilot, Gemini or Claude. Depending on your rules, it replaces them with fictitious values of the same format, warns the user or blocks the upload. The agent gets her answer, but the customer's real number never leaves. To understand the technique, read our article on format preserving anonymization. Every event is logged for the correspondent and the auditors.

In short

Operators, mobile money providers and call centers in Abidjan handle highly sensitive subscriber data every day. Generative AI saves them time, but every prompt can become an uncontrolled transfer under Law 2013-450. With ARTCI acting as both sector regulator and data protection authority, the stakes are twofold. The right answer: keep the tool, strip real data before it is sent and keep a record.

Do you run an operator, a fintech or a call center in Côte d'Ivoire? Request a ZeusLock demo.