Singapore Online Safety Act 2026: Complete Guide for Businesses and Users

Singapore has long been recognised as a regional leader in digital governance, and the Online Safety Act 2026 represents the next major step in protecting users from harmful online content. Building on the foundations laid by the 2022 amendments to the Broadcasting Act and the Online Criminal Harms Act 2023, the 2026 framework consolidates and expands obligations for online platforms, advertisers, and content intermediaries operating in or accessible from Singapore.

This complete guide explains what the Singapore Online Safety Act 2026 covers, who it applies to, the penalties for non-compliance, and the practical steps organisations should take to prepare. Whether you run a global social media platform, a local e-commerce site, or a marketing agency that uses link tracking and URL shorteners, this article will help you understand your responsibilities.

What Is the Singapore Online Safety Act 2026?

The Singapore Online Safety Act 2026 is a regulatory framework administered by the Infocomm Media Development Authority (IMDA) that requires online services to proactively prevent the dissemination of harmful content to Singapore users. It expands the scope of the original Online Safety (Miscellaneous Amendments) Act of 2022 by introducing new categories of regulated services, stronger user-redress mechanisms, and significantly higher financial penalties.

The Act addresses content categories such as child sexual exploitation material, terrorism-related content, cyberbullying, non-consensual intimate imagery, online scams, and content that incites racial or religious hatred. It applies regardless of where the service provider is based, as long as the service is accessible to users in Singapore.

Key Objectives of the Act

1. Reduce the exposure of Singapore users — particularly minors — to egregious online content.
2. Hold online service providers accountable for systemic safety measures, not just reactive takedowns.
3. Provide effective user redress when harmful content is encountered.
4. Align Singapore's regulatory environment with international benchmarks such as the UK Online Safety Act and the EU Digital Services Act.

Who Does the Online Safety Act 2026 Apply To?

The Act applies to a broad spectrum of online services. Understanding whether your business falls within scope is the first compliance step.

Regulated Online Communication Services (ROCS)

Services with significant reach in Singapore — typically major social media platforms, video-sharing sites, and messaging services — are designated as Regulated Online Communication Services. These carry the heaviest obligations, including codes of practice on online safety and annual transparency reporting.

Online Intermediaries

This category covers search engines, app stores, hosting providers, content delivery networks, and increasingly, link management and URL shortening services. While obligations here are lighter than for ROCS, intermediaries must still respond to directions from IMDA within set timeframes.

Advertisers and Content Publishers

Businesses running paid campaigns, affiliate marketers, and publishers who monetise content are also captured if their content reaches Singapore audiences. This is particularly relevant for marketers using tracking links and shortened URLs.

New Obligations Introduced in 2026

The 2026 update introduces several obligations that go beyond the original framework. These reflect both lessons learned from the first wave of enforcement and the rapid evolution of AI-generated content.

1. AI-Generated Content Disclosures

Platforms must label synthetic media — including deepfakes, AI-generated images, and voice clones — when used in political, commercial, or sensitive contexts. Failure to maintain reasonable detection systems can result in penalties.

2. Enhanced Child Safety Measures

Services likely to be accessed by minors must implement age-assurance mechanisms, default privacy settings for under-18 accounts, and restrictions on direct messaging between adults and minors.

3. Scam and Phishing Link Controls

One of the most impactful additions is the obligation to detect and block scam URLs in real time. Link shorteners, in particular, must implement abuse-monitoring systems to prevent their service being used to mask phishing destinations. Reputable providers like Lunyb already operate proactive scanning of destination URLs and integrate threat intelligence feeds — practices that now become regulatory expectations rather than best-practice extras. You can read more about how trustworthy shorteners operate in our honest review of Lunyb.

4. User Complaint and Appeal Mechanisms

All regulated services must provide an accessible complaints channel, acknowledge reports within 24 hours, and resolve them within statutory deadlines. Users dissatisfied with the outcome may escalate to a new Online Safety Commission.

5. Transparency Reporting

Designated services must publish annual reports detailing content moderation actions, automated detection accuracy, user complaints received, and government directions complied with.

Penalties and Enforcement

The 2026 framework introduces a tiered penalty regime that is significantly more aggressive than its predecessor. Enforcement is led by IMDA with support from the Singapore Police Force for criminal matters.

Violation Type	Maximum Penalty	Additional Consequences
Failure to comply with directions to remove harmful content	SGD 1 million per offence	Daily fines for continued non-compliance
Systemic breach of Code of Practice (ROCS)	10% of annual Singapore turnover	Service access restrictions
Failure to label AI-generated content in regulated contexts	SGD 500,000	Mandatory remediation plan
Non-cooperation with IMDA investigations	SGD 200,000 + criminal liability	Possible director disqualification
Repeat or egregious offences	App store delisting / ISP blocking	Public notice of blocking

How the Act Affects URL Shorteners and Link Management

URL shorteners occupy a unique position in the online ecosystem. They are convenient for marketing and analytics but historically have been exploited by scammers to disguise malicious destinations. Under the 2026 Act, link management services accessible from Singapore are expected to:

• Scan destination URLs against threat intelligence feeds at creation and at click time.
• Maintain abuse-reporting endpoints with documented response SLAs.
• Disable or replace links pointing to confirmed phishing, malware, or scam destinations.
• Retain audit logs sufficient to support lawful enforcement requests.
• Provide transparency around custom domains used for branded links.

Businesses choosing a link-shortening partner should treat these capabilities as compliance prerequisites, not optional extras. For a side-by-side view of leading providers and their safety features, see our 2026 buyer's guide to URL shorteners and our Rebrandly review for an in-depth look at one of the major commercial options.

Compliance Checklist: 10 Steps to Prepare

Whether you are a global platform or a Singapore-based SME, the following ten-step checklist provides a pragmatic compliance pathway.

1. Map your services. Determine which of your products are accessible from Singapore and whether they qualify as ROCS, intermediaries, or publishers.
2. Appoint a local representative. Foreign providers without a Singapore office must designate a contact person for IMDA correspondence.
3. Conduct a risk assessment. Identify the harmful content categories most likely to appear on your service and document mitigations.
4. Update terms of service. Clearly prohibit the categories of content covered by the Act and explain enforcement actions.
5. Implement age assurance. If minors can plausibly access your service, deploy proportionate age-verification or age-estimation tooling.
6. Stand up a reporting channel. Provide a clearly signposted, low-friction way for users to report harmful content.
7. Automate detection. Use hash-matching, classifiers, and threat-intel feeds for known categories such as CSAM, terrorism, and phishing URLs.
8. Train moderation staff. Ensure reviewers understand Singapore's legal definitions and cultural context, especially around racial and religious harmony.
9. Prepare transparency reports. Begin collecting the metrics required for annual disclosure.
10. Run a tabletop exercise. Simulate an IMDA direction to remove content within 24 hours and identify operational gaps.

How the Act Compares Internationally

Singapore's 2026 framework sits within a global trend of stricter online safety regulation. Understanding the differences is important for multinational compliance teams.

Jurisdiction	Primary Legislation	Maximum Penalty	Distinct Feature
Singapore	Online Safety Act 2026	10% of SG turnover	Strong focus on racial/religious harmony and scams
United Kingdom	Online Safety Act 2023	10% of global turnover	Duty of care, Ofcom-led codes
European Union	Digital Services Act	6% of global turnover	Tiered obligations for VLOPs
Australia	Online Safety Act 2021 (amended 2025)	AUD 49.5 million	eSafety Commissioner takedowns

Practical Impact on Businesses

For many Singapore businesses, the practical impact comes not from being directly designated as a regulated service, but from the downstream effects of compliance by the platforms they use. Expect changes such as:

• Stricter ad approvals. Platforms will reject more creatives, particularly those using AI imagery without disclosure.
• Verification of advertisers. Expect to provide ACRA records and identity verification before running political or financial ads.
• Link reputation matters more. Using a low-quality URL shortener can cause your messages to be filtered as spam or blocked entirely.
• Faster takedowns of competitor impersonation. Trademark and brand-protection workflows will become more efficient under the new redress mechanisms.

Timeline and Phased Implementation

The Act follows a phased rollout to give industry time to adapt:

1. Q1 2026: Act passed and gazetted; designation of ROCS begins.
2. Q2 2026: Codes of Practice published; consultation period for intermediaries.
3. Q3 2026: Mandatory user-reporting channels and age-assurance obligations take effect.
4. Q4 2026: AI labelling rules and scam-link controls become enforceable.
5. Q1 2027: First transparency reports due from designated services.

Frequently Asked Questions

Does the Singapore Online Safety Act 2026 apply to foreign companies?

Yes. The Act has extraterritorial reach. Any online service accessible to users in Singapore — regardless of where the provider is incorporated — can be designated and required to comply. Foreign providers should appoint a local point of contact for IMDA.

What counts as "harmful content" under the Act?

Harmful content includes child sexual exploitation material, terrorism-related content, content inciting suicide or self-harm, cyberbullying, non-consensual intimate imagery, content inciting racial or religious hatred, and online scams. Categories may be expanded by subsidiary legislation.

How quickly must content be removed after an IMDA direction?

For egregious content categories such as CSAM or terrorism content, removal is typically required within 24 hours. Other categories have proportionate timelines specified in the relevant Code of Practice. Failure to comply can trigger daily penalties and, ultimately, access blocking.

How does the Act affect my use of URL shorteners for marketing?

You should ensure your shortener actively scans destinations for malware and phishing, supports custom branded domains for trust, and provides audit logs. Using a reputable provider reduces the risk of your campaigns being flagged or blocked. Our comparison guide reviews the leading options against these safety criteria.

Are small businesses and individual content creators in scope?

Most obligations focus on platforms and intermediaries rather than individual creators. However, individuals who publish content that falls into prohibited categories — for example, scam promotions or non-consensual imagery — remain subject to existing criminal law and may be the target of takedown directions.

Conclusion

The Singapore Online Safety Act 2026 marks a significant tightening of the country's digital regulatory environment. It reinforces Singapore's reputation as a jurisdiction that takes online harms seriously while striving to remain attractive for legitimate digital business. For platforms, the immediate priorities are risk assessments, user-reporting infrastructure, and AI-content labelling. For marketers and SMEs, the focus should be on using compliant tooling — from advertising platforms to URL shorteners — and ensuring brand communications meet the new standards.

Preparing now, ahead of the phased deadlines, will minimise disruption and position your organisation as a trusted participant in Singapore's digital economy.