Singapore Online Safety Act 2026: Complete Guide for Businesses and Users

Singapore's regulatory approach to online harms has evolved rapidly since the original Online Safety (Miscellaneous Amendments) Act came into force in 2023. By 2026, the framework has matured into a comprehensive regime that touches social media services, online platforms, link-sharing tools, advertisers, and even small businesses that operate digital storefronts. This complete guide explains what the Singapore Online Safety Act 2026 covers, who must comply, the penalties for breach, and the practical steps organisations should take now.

What Is the Singapore Online Safety Act 2026?

The Singapore Online Safety Act 2026 is the updated statutory framework administered by the Infocomm Media Development Authority (IMDA) that regulates how online services prevent Singapore users from encountering harmful content. It builds on the 2023 amendments to the Broadcasting Act and the Code of Practice for Online Safety, expanding obligations beyond designated social media services to a wider class of digital intermediaries.

In simple terms, the Act requires online services that are accessible to Singapore users to take proactive, demonstrable steps to limit exposure to a defined list of "egregious" content — including child sexual exploitation material, terrorism content, content advocating suicide or self-harm, and content inciting violence or racial and religious disharmony. The 2026 update broadens the scope to include generative AI outputs, deepfakes used for electoral interference, and certain categories of scam content.

Key Objectives of the 2026 Update

1. Protect minors from exposure to harmful or age-inappropriate content.
2. Combat scams involving impersonation, fraudulent investment schemes, and phishing.
3. Address synthetic media, including deepfakes and AI-generated disinformation.
4. Increase accountability through transparency reporting and user redress mechanisms.
5. Harmonise enforcement with related laws such as the Online Criminal Harms Act (OCHA) and the Protection from Online Falsehoods and Manipulation Act (POFMA).

Who Must Comply With the Act?

The Act applies extraterritorially. Any service accessible to end-users in Singapore can fall within scope, regardless of where the operator is based. However, the intensity of obligations depends on how the service is classified.

Categories of Regulated Services

Category	Examples	Core Obligations
Designated Online Communication Services (DOCS)	Major social networks, messaging platforms with public channels	Full Code of Practice compliance, annual reports, child safety standards
Designated Internet Access Services	Large ISPs serving Singapore consumers	Access blocking for directed content, retention of logs
General Online Services	Forums, link shorteners, file-sharing tools, smaller platforms	Takedown on direction, reasonable proactive measures
App Distribution Services	Mobile app stores	Age assurance, removal of non-compliant apps
AI Content Generators	Generative image, video, audio, and text platforms	Provenance labelling, abuse mitigation, model documentation

Thresholds for "Designation"

IMDA can designate a service based on user reach in Singapore, the nature of the content shared, and the level of risk posed. The 2026 thresholds were lowered: a service with as few as 100,000 monthly Singapore users — or one that hosts user-generated content with documented harm risk — may now be designated. This means many mid-sized regional platforms are caught for the first time.

What Content Is Targeted?

The Act distinguishes between "egregious content" (subject to rapid takedown) and "harmful content to children" (subject to systemic safety-by-design duties).

Egregious Content Categories

• Child sexual exploitation and abuse material (CSAM)
• Terrorism content, including recruitment and instructional material
• Content advocating or instructing suicide and self-harm
• Content endangering public health or public security
• Content inciting racial or religious disharmony in Singapore
• Non-consensual intimate imagery, including deepfakes
• Scam and fraud content directed at Singapore residents (new in 2026)

Harmful Content to Children

Designated services must conduct annual child safety risk assessments, deploy age-assurance tools where feasible, and provide parental controls. The 2026 update introduced explicit duties around algorithmic amplification — platforms must ensure recommendation systems do not aggressively push self-harm, eating disorder, or violent content to accounts identified as belonging to minors.

Core Compliance Obligations

The compliance regime is structured around four pillars: user safety, accountability, user empowerment, and transparency. Each pillar maps to specific operational requirements.

1. User Safety Standards

1. Implement community standards that clearly prohibit each category of egregious content.
2. Deploy content moderation systems — human and automated — proportionate to service size and risk.
3. Provide easy-to-use reporting tools available in English and at least one other official Singapore language.
4. Action confirmed CSAM and terrorism content within hours, not days.

2. Accountability Measures

Designated services must publish an annual online safety report describing the volume of harmful content detected, response times, and the effectiveness of safety measures. Senior management may be required to attest to the accuracy of these reports.

3. User Empowerment Tools

• Content filters that users (or parents) can enable.
• Transparent appeals processes for moderation decisions.
• Clear labelling of synthetic or AI-generated media.

4. Transparency Reporting

Reports must be filed with IMDA on a defined schedule and published on the service's website. They must include metrics on directions received, content removed, and any systemic interventions made during the year.

Penalties and Enforcement

Enforcement under the 2026 framework has clear escalation steps, beginning with directions and progressing to financial penalties and access blocking.

Breach Type	Maximum Penalty	Additional Consequences
Failure to comply with a removal direction	Up to S$1 million fine	Daily fines of S$100,000 for continuing breach
Failure to comply with Code of Practice	Up to S$1 million per contravention	Public censure, mandatory remediation plan
Non-compliance with access blocking order	Up to S$20,000 per day	ISP-level blocking of the service in Singapore
False or misleading transparency report	Fines plus director liability	Potential criminal referral

Access Blocking

IMDA may direct Singapore internet access service providers to block non-compliant overseas platforms. This is reserved for serious or persistent breaches and was used sparingly between 2023 and 2025 — but the 2026 update streamlines the procedure and broadens it to app stores and payment intermediaries.

Impact on Link Shorteners and Marketing Tools

One of the most discussed aspects of the 2026 update is the explicit treatment of link-shortening and link-cloaking services. Because scammers frequently use disposable shortlinks to disguise malicious destinations, the Act now expects shortener operators serving Singapore users to take reasonable steps to detect and disable abusive links.

Responsible providers like Lunyb have long operated abuse detection, malware screening, and rapid takedown workflows for shortened URLs — practices that align well with the new statutory expectations. Businesses choosing a shortener for Singapore campaigns should now treat safety tooling as a compliance factor, not just a feature. For a deeper look at how Lunyb operates, see our honest review of Lunyb, and for a side-by-side overview of the market, see our 2026 buyer's guide to URL shorteners.

What Marketers Should Check

1. Does your shortener scan destination URLs for phishing and malware?
2. Are abuse reports actioned within hours?
3. Are analytics and link management auditable for compliance reviews?
4. Does the provider publish a transparency or trust statement?

If you are evaluating premium branded-link tools, our Rebrandly review compares another popular option in this category.

How the Act Affects Businesses Operating in Singapore

Even if your organisation is not a designated service, the Act has ripple effects on day-to-day digital operations.

Social Media and Advertising

Brands running paid campaigns on designated platforms should expect stricter ad review, particularly for financial services, health products, and anything involving AI-generated creative. Misleading deepfake endorsements can now trigger removal directions affecting both the platform and the advertiser.

Community and User-Generated Content

If you run a forum, comments section, or customer review platform accessible to Singapore users, you may fall within the general online services category. You should:

• Publish clear community guidelines aligned with the egregious content list.
• Maintain a working reporting and takedown channel.
• Keep records of moderation actions for at least 12 months.
• Train moderators on Singapore-specific sensitivities, including racial and religious harmony rules.

Employee Awareness

Marketing, communications, and product teams should understand the difference between content that is merely controversial and content that is statutorily egregious. Mistakes in this area can result in directions being issued to your company within hours.

Practical Compliance Roadmap

The following six-step roadmap is suitable for most in-scope organisations:

1. Scoping assessment. Map all customer-facing digital services and determine which fall under the Act.
2. Gap analysis. Compare current policies, tooling, and response times against the Code of Practice.
3. Policy refresh. Update terms of service, community standards, and internal moderation playbooks.
4. Tooling investment. Procure or upgrade content classification, age assurance, and reporting systems.
5. Governance. Assign a named accountable person, set up an incident response process, and brief the board.
6. Transparency reporting. Build the data pipelines needed to produce IMDA-ready annual reports.

How the Act Interacts With Other Singapore Laws

The Online Safety Act does not operate in isolation. It sits alongside:

• Personal Data Protection Act (PDPA) — relevant when moderation or age assurance involves personal data.
• Online Criminal Harms Act (OCHA) — focused on criminal conduct facilitated online, such as scams and malicious cyber activity.
• Protection from Online Falsehoods and Manipulation Act (POFMA) — governs false statements of fact.
• Cybersecurity Act — applies to operators of critical information infrastructure.

A coherent compliance programme should treat all four as overlapping rather than separate workstreams.

What It Means for Everyday Users

For Singapore residents, the Act should make day-to-day browsing safer, but it does not replace personal digital hygiene. Practical steps users can still take include:

• Enable platform-provided safety filters, particularly for younger family members.
• Use encrypted DNS resolvers and reputable private browsers to reduce tracking.
• Hover over shortened links before clicking, and prefer shorteners that display a preview or safety check.
• Report harmful content using the in-platform tools — these reports feed directly into the regulator's metrics.

Looking Ahead

Singapore's regulators have signalled that further updates are likely as AI capabilities evolve. Areas to watch include mandatory watermarking for generative outputs, standardised age-assurance frameworks, and tighter rules on algorithmic recommendation systems. Organisations that invest in flexible safety architectures now will find it easier to absorb future changes.

FAQ

Does the Singapore Online Safety Act 2026 apply to overseas companies?

Yes. The Act applies extraterritorially to any online service accessible to Singapore users. IMDA can issue directions to overseas operators and, if ignored, can order Singapore internet access services to block the platform.

What is the difference between the Online Safety Act and POFMA?

The Online Safety Act targets harmful content categories such as CSAM, terrorism, self-harm, and scams, with a focus on systemic platform duties. POFMA targets false statements of fact and operates through correction or takedown directions on a case-by-case basis. They are complementary tools.

Do small businesses need to comply?

If a small business operates an online service with user-generated content accessible to Singapore users — even a comments section or forum — basic obligations such as takedown on direction apply. Full Code of Practice obligations only apply once a service is formally designated by IMDA.

How quickly must harmful content be removed?

Egregious content, particularly CSAM and terrorism material, must be actioned as soon as practicable after a direction is issued, typically within hours. For systemic obligations under the Code of Practice, response time expectations are measured against the platform's published targets and overall effectiveness.

How does the Act affect URL shorteners used in marketing?

Shorteners that disguise destinations are a known vector for scams, so providers serving Singapore users are expected to detect and disable abusive links promptly. Marketers should choose shortener platforms with strong abuse handling, malware screening, and transparent moderation policies as part of their compliance posture.