Singapore Online Safety Act 2026: Complete Guide for Businesses and Users

Singapore continues to refine its digital regulatory framework, and the Online Safety Act 2026 represents the next phase in the country's approach to protecting users from harmful online content. Building on the Online Safety (Miscellaneous Amendments) Act passed in 2022 and the subsequent codes of practice issued by the Infocomm Media Development Authority (IMDA), the 2026 updates expand the scope, sharpen enforcement powers, and introduce new compliance obligations for online communication services, businesses, and content publishers operating in Singapore.

This guide explains what the Singapore Online Safety Act 2026 covers, who it applies to, what your obligations are, and how to prepare. Whether you run a social platform, an e-commerce store, a marketing agency, or you simply want to understand your rights as a Singapore-based user, this article walks through everything you need to know.

What Is the Singapore Online Safety Act 2026?

The Singapore Online Safety Act 2026 is the updated legislative framework governing online safety obligations for digital services accessible in Singapore. It sits alongside the Broadcasting Act, the Protection from Online Falsehoods and Manipulation Act (POFMA), and the Personal Data Protection Act (PDPA) to form Singapore's broader internet regulation regime.

The 2026 framework strengthens earlier provisions in three main ways:

1. Broader scope of regulated services — covering not only large social media platforms but also mid-tier user-to-user services, app stores, and certain content aggregators.
2. Stronger user protection duties — including new requirements around child safety, scam prevention, and algorithmic transparency.
3. Faster enforcement tools — IMDA can issue directions to block, restrict, or disable access to harmful content with shorter response windows and higher penalties for non-compliance.

Why Was the Act Updated for 2026?

Since the original Online Safety amendments came into force, Singapore has seen a sharp rise in online scams, deepfake-driven harassment, AI-generated child sexual abuse material (CSAM), and coordinated misinformation campaigns. The 2026 update responds to these trends by closing loopholes around generative AI content, anonymous link forwarding, and platforms that previously fell outside IMDA's enforcement reach.

Who Does the Online Safety Act 2026 Apply To?

The Act applies to any online communication service with end users in Singapore, regardless of where the service is headquartered. This extraterritorial scope mirrors the EU Digital Services Act and the UK Online Safety Act.

Regulated entities generally fall into the following categories:

• Designated Online Communication Services (DOCS) — large platforms designated by IMDA (e.g., major social networks, video-sharing services, messaging apps with significant Singapore reach).
• General online communication services — forums, community platforms, dating apps, and user-to-user content services with smaller footprints.
• App distribution services — app stores that distribute regulated services to Singapore users.
• Ancillary service providers — including URL shorteners, link redirectors, content delivery networks, and hosting providers when used to distribute harmful content.
• Businesses operating digital channels — companies that operate user-facing chat, comments, or social functions on their websites or apps.

Does It Apply to Small Businesses?

Yes, but proportionately. A small e-commerce store with a product review section is not held to the same standard as a major social platform. However, all operators must still take reasonable steps to remove illegal content once notified, maintain a reporting channel, and respond to lawful directions from IMDA.

Categories of Harmful Content Under the Act

The Act defines several categories of content that platforms must proactively manage. Understanding these categories is essential for building compliant moderation policies.

Category	Examples	Required Response
Egregious content	CSAM, terrorism content, content inciting violence	Immediate removal; proactive detection required
Scam and fraud content	Phishing links, investment scams, impersonation	Rapid takedown within 24 hours of notice
Harmful content to children	Self-harm promotion, grooming, age-inappropriate material	Age-gating, safety-by-design defaults
Non-consensual intimate imagery	Deepfake pornography, leaked private images	Priority removal channel with same-day response
Cyberbullying and harassment	Doxxing, coordinated harassment, threats	User reporting tools, escalation procedures
Election integrity content	Coordinated inauthentic behavior, foreign interference	Transparency obligations, expedited response

Key Obligations for Regulated Services

The Act imposes a layered set of duties. Larger designated services face the strictest obligations, while smaller services have lighter but still meaningful duties.

1. Safety-by-Design Requirements

Designated services must build safety considerations into product design from the outset. This includes default privacy settings for minors, friction on suspicious link sharing, and clear warnings before users interact with flagged content.

2. Content Moderation Systems

Regulated services must maintain content moderation systems proportionate to their size and risk profile. This means having:

1. Clear community guidelines published in English and ideally other official Singapore languages.
2. Functional reporting tools accessible from every piece of user-generated content.
3. Documented escalation procedures for high-priority content.
4. Trained moderators or automated systems capable of handling Singapore-context cases.

3. Transparency Reporting

Designated services must publish annual transparency reports covering moderation volumes, response times, accuracy of automated tools, and government request statistics. The 2026 update introduces a standardized reporting template to make cross-platform comparisons easier.

4. Scam and Phishing Controls

Given Singapore's ongoing battle with online scams, the 2026 Act places specific duties on platforms to detect and disrupt scam patterns. This includes link scanning, impersonation detection, and partnerships with the Singapore Police Force's Anti-Scam Command.

5. Cooperation with IMDA Directions

When IMDA issues a direction — for example, to remove specific content, disable a URL, or block an account — regulated services must comply within the timeframe stated (typically 24 hours for serious content, shorter for egregious categories).

Implications for URL Shorteners and Link Services

One notable expansion in the 2026 update is the explicit inclusion of link redirection services within the regulatory perimeter. URL shorteners can be misused to hide phishing destinations, malware downloads, or scam landing pages, so the Act now requires shortening platforms to:

• Maintain abuse reporting channels accessible to Singapore users.
• Implement reasonable link scanning to detect known malicious destinations.
• Respond to IMDA takedown directions promptly.
• Cooperate with law enforcement on investigation requests under proper legal process.

Reputable providers were already aligned with most of these duties. Services like Lunyb apply automated link scanning, allow users to report abusive links, and operate transparent takedown procedures. If you're choosing a shortener for business use in Singapore, you can review options in our 2026 buyer's guide or our Rebrandly review to compare enterprise features.

Penalties and Enforcement

The 2026 Act significantly increases the financial consequences of non-compliance. IMDA can now issue:

Violation	Maximum Penalty
Failure to comply with a takedown direction (general)	Up to S$1 million per direction
Continuing offence (per day)	Up to S$100,000 per day
Designated service systemic non-compliance	Up to 10% of global annual turnover
Failure to file transparency report	Up to S$500,000
Individual officer liability (knowing breach)	Up to S$200,000 and/or imprisonment

In addition, IMDA can issue access blocking orders requiring internet access service providers in Singapore to block non-compliant services entirely. This is a meaningful deterrent for platforms with significant Singapore user bases.

What the Act Means for Singapore Users

For everyday users, the 2026 Act delivers several practical improvements:

Stronger Reporting Rights

Users can report harmful content directly to platforms and escalate to IMDA if a platform fails to act. The escalation pathway includes a standardized online complaint form and statutory response timeframes.

Better Protections for Minors

Services likely to be accessed by children must apply safety-by-default settings, age assurance measures where appropriate, and restrictions on targeted advertising to minors.

Scam Victim Support

Victims of online scams now have clearer paths to request rapid takedown of fraudulent content and accounts, with platforms expected to cooperate with the Anti-Scam Command's referrals.

Privacy Considerations

While the Act focuses on safety, it intersects with the PDPA on data handling. Users should still take steps to protect their own privacy: use unique passwords, enable two-factor authentication, prefer browsers with strong tracking protection, use encrypted DNS where available, and be cautious about what you share on public platforms.

Compliance Checklist for Businesses

If you operate a digital service in Singapore, the following compliance steps will put you in a strong position under the 2026 Act:

1. Map your service — determine whether you are a designated service, general online communication service, or ancillary provider.
2. Update your terms and community guidelines — make rules on illegal and harmful content explicit, with examples relevant to Singapore.
3. Implement reporting tools — every user-facing content surface should have an accessible reporting mechanism.
4. Document your moderation workflow — including SLAs for each content category.
5. Establish a Singapore point of contact — IMDA expects a named contact for service of directions.
6. Conduct a risk assessment — identify which harm categories are most likely on your platform and what mitigations apply.
7. Train staff — moderators, trust and safety, and legal teams should understand Singapore-specific obligations.
8. Prepare transparency reporting — start collecting moderation metrics now if you anticipate designation.
9. Review third-party tools — ensure any shorteners, hosting providers, or moderation vendors you rely on are also compliant.
10. Engage early with IMDA — voluntary engagement is generally received positively and helps clarify ambiguous obligations.

Timeline and Key Dates

The 2026 framework rolls out in phases:

• Q1 2026 — Act commences; existing designated services must update compliance documentation.
• Q2 2026 — New codes of practice for scam prevention and child safety take effect.
• Q3 2026 — Expanded designation list published; newly designated services have a transition period.
• Q4 2026 — First standardized transparency reports due from designated services.

How the Singapore Act Compares to Other Frameworks

Singapore's approach sits between the prescriptive EU Digital Services Act and the duty-of-care model of the UK Online Safety Act.

Feature	Singapore OSA 2026	UK Online Safety Act	EU Digital Services Act
Extraterritorial scope	Yes	Yes	Yes
Designated tier for large platforms	Yes (DOCS)	Yes (Categorised services)	Yes (VLOPs/VLOSEs)
Maximum fine	10% global turnover	10% global turnover	6% global turnover
Access blocking power	Yes	Limited	Limited
Transparency reports	Standardized template	Required for categorised	Required for VLOPs
Scam-specific duties	Strong, explicit	Included via fraud duties	General duty

Frequently Asked Questions

1. Does the Singapore Online Safety Act 2026 apply to overseas platforms?

Yes. The Act applies extraterritorially to any online communication service with end users in Singapore. Platforms based overseas can still be designated, fined, and ultimately blocked by IMDA directions to local internet access service providers if they fail to comply.

2. Are small businesses with a comments section subject to the Act?

Small businesses are within scope but face proportionate obligations. You generally need to provide a way for users to report harmful content, remove illegal content when notified, and respond to lawful IMDA directions. You are not expected to operate the same systems as a major social network.

3. How quickly must platforms remove harmful content?

Timeframes vary by category. Egregious content such as CSAM and terrorism material requires immediate removal once detected or notified. Scam content typically requires action within 24 hours. Other categories follow the timeframes set in IMDA directions or the relevant code of practice.

4. Can users appeal if their content is wrongly removed?

Yes. The Act requires platforms to provide accessible internal appeal mechanisms and clear reasons for moderation decisions. Where users believe a platform has acted unreasonably, they can also raise concerns with IMDA.

5. What should I do if I receive a takedown direction from IMDA?

Treat it as a priority. Acknowledge receipt, comply within the stated timeframe, and document your actions carefully. Seek legal advice quickly if you believe the direction is incorrect — there are formal review processes, but compliance pending review is generally expected. Maintaining a documented internal workflow for IMDA correspondence is one of the most important compliance investments you can make.

Final Thoughts

The Singapore Online Safety Act 2026 reflects a maturing approach to digital regulation: clearer duties, stronger enforcement, and explicit recognition that online harms cut across platforms, ad networks, hosting, and link services. For businesses, the practical task is to map your obligations, build proportionate systems, and document everything. For users, the Act delivers more accountability and better tools to report harm.

Whether you are a platform operator, a marketer choosing compliant tools, or a Singapore user wanting to understand your rights, the time to act is now — before the first wave of enforcement notices lands in late 2026.