Singapore Online Safety Act 2026: Complete Guide for Businesses and Users

Singapore has positioned itself as one of Asia's most proactive regulators of the digital environment, and the Online Safety Act 2026 represents the next major step in that journey. Building on the original Online Safety (Miscellaneous Amendments) Act passed in 2022 and the Online Criminal Harms Act of 2023, the 2026 framework expands the Infocomm Media Development Authority's (IMDA) powers, tightens obligations on online services, and introduces new protections for users — particularly children. This complete guide explains what the Singapore Online Safety Act 2026 covers, who it applies to, the penalties for non-compliance, and the practical steps businesses, content creators, and everyday users should take.

What Is the Singapore Online Safety Act 2026?

The Singapore Online Safety Act 2026 is an updated legislative framework administered by the IMDA that regulates how online communication services, social media platforms, and certain digital intermediaries handle harmful online content accessible to users in Singapore. It strengthens earlier safety laws by expanding scope to additional service categories, introducing a statutory duty of care for designated platforms, and giving regulators faster enforcement tools against illegal and harmful content.

At its core, the Act aims to make Singapore's online space safer by:

Requiring platforms to proactively detect and remove specified categories of harmful content.
Granting IMDA powers to issue directions to platforms, app stores, and internet access service providers.
Providing users — including victims of online harms — with faster redress mechanisms.
Imposing stricter obligations on services accessible to minors.

Background: How Singapore Got Here

Singapore's online safety regime has evolved rapidly over the past five years. The 2022 amendments to the Broadcasting Act introduced the original Online Safety Code of Practice, focusing on egregious content such as child sexual exploitation material and terrorism content. The 2023 Online Criminal Harms Act addressed scams and malicious cyber activity. The 2026 Act consolidates lessons learned and aligns Singapore with international peers such as the UK's Online Safety Act, the EU's Digital Services Act, and Australia's Online Safety Act.

Key drivers behind the 2026 update include:

A sharp rise in deepfake-enabled scams and non-consensual intimate imagery.
Growing concerns about youth mental health and algorithmic amplification.
Cross-border enforcement gaps with offshore platforms.
The need to address generative AI-produced harmful content.

Who Does the Act Apply To?

The Act applies broadly to any service accessible in Singapore, regardless of where the provider is based. The scope is tiered based on user reach and risk profile.

Designated Online Communication Services (DOCS)

These are large social media services with significant Singapore reach (typically platforms with substantial monthly active users in Singapore). They face the strictest obligations.

Other Regulated Services

This includes search engines, app stores, messaging services, online marketplaces, and certain user-to-user platforms, even if not formally designated.

Ancillary Service Providers

Internet access service providers (IASPs), domain registrars, and hosting providers may receive access-blocking or takedown directions from IMDA.

Service Category	Examples	Key Obligations
Designated Social Media	Large global social platforms	Full Code of Practice, risk assessments, transparency reports
Search & App Stores	Search engines, mobile app marketplaces	Content delisting, app-removal directions
Messaging Services	Encrypted and unencrypted chat apps	Reporting tools, scam/fraud cooperation
IASPs	Telcos and ISPs	Access-blocking directions
Hosting / Domains	Web hosts, registrars	Takedown of illegal content

Categories of Harmful Content Covered

The 2026 Act covers a broader set of harms than its predecessor. Content categories include:

Egregious content: child sexual exploitation, terrorism, content advocating suicide or self-harm.
Cyber harassment and image-based abuse: doxxing, non-consensual intimate images, and AI-generated deepfakes targeting individuals.
Online scams and fraud: phishing, fake investment schemes, and impersonation accounts.
Content harmful to minors: age-inappropriate material, content promoting eating disorders, and grooming behavior.
Disinformation affecting public safety or elections: coordinated inauthentic behavior and harmful synthetic media.

Key Obligations for Online Platforms

Platforms that fall within scope must comply with a layered set of duties. While exact requirements depend on designation tier, the following obligations are central to the 2026 framework.

1. Duty of Care and Risk Assessment

Designated services must perform regular risk assessments covering illegal content, harms to children, and systemic risks from algorithmic recommendation systems. Risk assessments must be documented and made available to IMDA on request.

2. Content Moderation Systems

Platforms must implement proportionate systems to detect, review, and remove prohibited content. This includes:

Clear community standards published in English (and ideally other local languages).
Accessible user reporting tools.
Timely review — typically within 24 hours for egregious categories.
Appeal mechanisms for users whose content is removed.

3. Child Safety Standards

Services likely accessed by minors must implement age-appropriate design, default privacy settings for minor accounts, restrictions on targeted advertising to children, and tools enabling parental supervision.

4. Transparency Reporting

Designated services must publish annual transparency reports detailing content removed, government requests received, automated detection performance, and user appeals outcomes.

5. Cooperation with IMDA Directions

Platforms must comply promptly with directions to disable access to specified content, accounts, or apps. Non-compliance triggers escalating enforcement.

Enforcement Powers and Penalties

The 2026 Act significantly strengthens enforcement. IMDA can issue several types of directions:

Disabling directions: requiring removal of specific content within a defined window.
Account restriction directions: requiring suspension or restriction of accounts engaged in repeated harmful activity.
App removal directions: requiring app stores to delist non-compliant apps in Singapore.
Access-blocking directions: requiring IASPs to block access to non-compliant services.

Financial Penalties

Maximum fines for serious or repeated non-compliance can reach up to S$1 million, with daily penalties for continued breaches. Individual officers of a non-compliant entity may face personal liability where wilful breach is proven.

Criminal Offences

Certain conduct — including creating or distributing non-consensual intimate deepfakes — carries criminal penalties including fines and imprisonment.

What This Means for Businesses in Singapore

Even if your business is not a major social platform, the Act has practical implications. Companies running community forums, customer review sections, employee social tools, or marketing platforms may be indirectly affected.

Marketing and Communications Teams

Brands need to be careful about how they share links, run influencer campaigns, and manage user-generated content. Using credible, transparent link infrastructure helps users trust where they're going. Privacy-respecting tools like Lunyb can help marketing teams create safe, branded short links without compromising user privacy — a useful practice when distributing campaign URLs across Singaporean audiences. For a broader comparison of options, see our 2026 buyer's guide to URL shorteners.

Trust and Safety Operations

Mid-sized platforms should formalise content moderation policies, set up clear escalation paths to legal, and document moderation decisions. Even where designation does not apply, regulators expect demonstrable good faith.

Legal and Compliance Teams

Review terms of service, community guidelines, complaint-handling SOPs, and data retention policies. Map your services against the Act's categories to identify exposure.

What This Means for Everyday Users

For users in Singapore, the Act provides stronger protections and faster avenues for redress. Key user-facing improvements include:

A streamlined complaints pathway to IMDA for content that platforms refuse to act on.
Statutory takedown rights for victims of intimate image abuse and deepfake harassment.
Clearer rules around minors' accounts and default privacy settings.
Greater visibility into how platforms moderate content via transparency reports.

However, users should also stay vigilant. Scams remain the most prevalent online harm in Singapore. Always verify links before clicking, avoid sharing personal information on unfamiliar sites, and use reputable tools when shortening or sharing URLs. If you're evaluating link-sharing services, our honest review of Lunyb may help, alongside our Rebrandly review for 2026.

How the Singapore Act Compares Internationally

Singapore's approach borrows from — but does not copy — global counterparts. The table below summarises key similarities and differences.

Jurisdiction	Key Law	Approach	Max Penalties
Singapore	Online Safety Act 2026	Code-based, IMDA-led directions	Up to S$1m + daily fines
UK	Online Safety Act 2023	Ofcom duty of care	£18m or 10% global turnover
EU	Digital Services Act	Tiered DSA obligations	Up to 6% global turnover
Australia	Online Safety Act 2021	eSafety Commissioner directions	Civil penalties + blocking

Practical Compliance Checklist

Whether you operate a platform, run a business with online communities, or simply want to understand the Act, the checklist below provides a practical starting point.

Map your service: identify whether you fall under DOCS, other regulated, or ancillary categories.
Conduct a risk assessment: document illegal content risks, child safety risks, and algorithmic risks.
Update policies: refresh terms of service and community standards to reflect the 2026 categories.
Build reporting tools: ensure users can flag content easily and receive a response.
Train staff: equip moderation, customer support, and legal teams to handle escalations.
Engage with IMDA: respond promptly to directions and maintain a designated point of contact.
Plan for transparency: set up data collection for annual transparency reporting.

Common Misconceptions

"It only applies to Facebook, TikTok, and Google."

False. While the strictest obligations target designated services, the Act's scope reaches search, app stores, IASPs, hosting providers, and many user-to-user services.

"If we're based overseas, the law doesn't reach us."

Also false. The Act has extraterritorial effect for services accessible to users in Singapore. IMDA can direct local IASPs to block non-compliant offshore services.

"Free speech is being curtailed."

The Act targets specific categories of illegal or seriously harmful content, not lawful expression or political debate. Appeals processes exist for users who believe their content was wrongly removed.

Looking Ahead: What to Expect Beyond 2026

Singapore's online safety regime is expected to keep evolving. Areas to watch include:

Tighter rules on AI-generated content and synthetic media labelling.
Expanded child safety codes aligning with international age-assurance standards.
Greater cross-border cooperation with ASEAN partners and global regulators.
Possible expansion to cover online gaming and immersive (XR) platforms.

For digital businesses operating in Singapore, the strategic takeaway is clear: build compliance and user safety into your product, not as an afterthought. Platforms that demonstrate trustworthy practices — from how they moderate content to how they handle URLs and user data — will be better positioned both legally and commercially.

Frequently Asked Questions

When does the Singapore Online Safety Act 2026 take effect?

The Act is being phased in during 2026, with core obligations for designated services typically commencing first, followed by transparency and child safety codes. Service providers should monitor IMDA announcements for specific commencement dates relevant to their category.

Does the Act apply to small businesses or personal blogs?

Most small businesses and personal blogs are not directly designated, but they must still avoid hosting or distributing illegal content. If your site allows user-generated content (comments, forums, reviews), you should implement basic reporting and moderation tools as a precaution.

Can users complain directly to IMDA if a platform ignores their report?

Yes. The Act provides a statutory complaints pathway. Users who report harmful content and receive no response or an unsatisfactory outcome can escalate to IMDA, which may issue directions to the platform.

How does the Act address deepfakes and AI-generated content?

The 2026 framework specifically covers non-consensual intimate deepfakes and harmful synthetic media. Creating or distributing such content can result in both regulatory action against platforms and criminal penalties for individuals.

What's the difference between this Act and the Online Criminal Harms Act?

The Online Criminal Harms Act focuses on criminal activity such as scams and malicious cyber acts, enabling swift directions to disrupt them. The Online Safety Act 2026 focuses more broadly on systemic safety obligations, content moderation, child safety, and platform accountability. The two laws operate in parallel and together form Singapore's online safety architecture.