Singapore Online Safety Act 2026: Complete Guide for Users and Businesses

Singapore has steadily built one of the most comprehensive online safety frameworks in Asia. The Singapore Online Safety Act 2026 represents the latest evolution of that framework, expanding the reach of the original 2022 amendments to the Broadcasting Act and introducing new duties for social media platforms, messaging services, and even smaller digital operators. Whether you run a business, moderate an online community, or simply use the internet in Singapore, understanding these rules matters.

This complete guide breaks down what the Act covers, who it applies to, what harmful content it targets, how enforcement works, and the practical steps you should take in 2026 to stay compliant and protected.

What Is the Singapore Online Safety Act 2026?

The Singapore Online Safety Act 2026 is a regulatory framework administered primarily by the Infocomm Media Development Authority (IMDA) that requires online communication services accessible in Singapore to prevent, detect, and remove specified categories of harmful online content. It builds on the Online Safety (Miscellaneous Amendments) Act of 2022 and the Online Criminal Harms Act (OCHA) of 2023, tightening obligations for designated platforms and introducing new categories of regulated harm.

In practical terms, the Act gives Singapore authorities the ability to:

• Direct platforms to disable access to harmful content for users in Singapore.
• Require designated services to implement systems and processes for user safety.
• Block non-compliant services at the network level.
• Impose financial penalties of up to S$1 million per breach, with additional daily fines for continued non-compliance.

Why Singapore Updated Its Online Safety Laws

Singapore's earlier framework focused mainly on large social media services designated as "Regulated Online Communication Services" (ROCS). However, the online harm landscape has shifted significantly since 2022. Key drivers behind the 2026 update include:

1. AI-generated content and deepfakes: Synthetic intimate imagery, election-related deepfakes, and scam impersonations have exploded globally.
2. Scam epidemic: Singapore recorded record-high losses to online scams, prompting stronger duties on platforms hosting scam advertising and phishing links.
3. Child safety: New obligations around grooming, child sexual abuse material (CSAM), and age-appropriate design.
4. Cross-platform harm: Harmful content increasingly spreads across messaging apps, not just public feeds.
5. Victim redress: Establishment of a dedicated Online Safety Commission to help victims of online harms obtain fast takedowns.

Who Does the Act Apply To?

The Act applies extraterritorially. If your service is accessible to end users in Singapore, you may fall within scope even if your company is based overseas. Regulated entities generally fall into these tiers:

Category	Examples	Key Obligations
Designated Online Communication Services	Large social media, video sharing, search engines	Full code of practice, transparency reports, user safety systems
Private messaging & DM services	Chat apps, community platforms	Reporting mechanisms, grooming and CSAM controls
App stores	Mobile app marketplaces	Age assurance, removal of non-compliant apps
Smaller online services	Forums, niche communities, link tools	Baseline content removal on lawful direction
Internet access providers	Telcos and ISPs	Blocking directions for non-compliant services

Even smaller businesses that host user-generated content — comment sections, review platforms, community forums, or link-in-bio tools — should assume the Act may apply and prepare accordingly.

Categories of Harmful Content Covered

The Act targets a defined list of "egregious content" and expanded categories of harm. Regulated categories include:

1. Content Endangering Public Safety

Advocacy of terrorism, violent extremism, or content that incites public disorder or racial and religious enmity.

2. Child Sexual Exploitation Material

CSAM, grooming behaviours, and content that sexualises minors. Platforms must have proactive detection where technically feasible.

3. Non-Consensual Intimate Imagery (NCII)

Including deepfake and AI-generated intimate content. Victims can request expedited takedowns through the Online Safety Commission.

4. Cyberbullying and Harassment

Sustained abuse, doxxing, and coordinated harassment campaigns targeted at individuals in Singapore.

5. Scams and Malicious Cyber Activity

Phishing links, investment scams, impersonation accounts, and malicious URLs are explicitly named as regulated harms — a major expansion from earlier laws.

6. Content Undermining Public Health or Elections

Coordinated inauthentic behaviour and manipulated media targeting elections or public health responses may attract expedited directions.

Key Obligations for Platforms in 2026

Designated services must comply with a Code of Practice for Online Safety that has been strengthened in 2026. Core duties include:

1. User reporting tools: Easy-to-find, in-product reporting for each category of harm, with acknowledgement timelines.
2. Content moderation systems: Documented processes, human review for edge cases, and prioritisation of Singapore-user reports.
3. Proactive detection: Use of hash-matching, classifiers, and known-bad-URL lists for CSAM, terrorism content, and scam links.
4. Child safety measures: Default privacy settings for minors, restrictions on adult strangers messaging children, and age assurance where risk is high.
5. Transparency reporting: Annual reports on volumes of harmful content actioned, response times, and appeals.
6. Rapid response to directions: Compliance with IMDA and Online Safety Commission directions, typically within hours for the most serious harms.
7. Recordkeeping and audit: Retaining evidence of moderation decisions to support enforcement and appeals.

The Online Safety Commission

A signature feature of the 2026 framework is the operational Online Safety Commission (OSC). The OSC provides Singapore users with a direct route to seek redress. Users who experience harms such as intimate image abuse, doxxing, harassment, or impersonation can:

• Submit a complaint online with supporting evidence.
• Request a takedown direction against the hosting service.
• Obtain a stop-communication direction against an individual perpetrator.
• Escalate to account restriction or service disabling if the platform fails to comply.

Directions issued by the OSC carry the force of law, and non-compliance is an offence.

Penalties and Enforcement

Enforcement is layered. Directions and financial penalties are the primary tools, but the Act preserves severe measures for repeat or serious offenders.

Violation Type	Typical Response	Maximum Penalty
Failure to remove specified content after direction	Financial penalty, remedial direction	Up to S$1 million per breach + daily fines
Systemic failure to meet Code of Practice	Compliance direction, audit	Up to S$1 million + follow-up penalties
Non-compliance with access-blocking direction	ISP-level blocking in Singapore	Loss of Singapore market access
Individual offences (e.g. NCII distribution)	Criminal prosecution	Imprisonment and fines under Penal Code

What the Act Means for Businesses in Singapore

Even if you are not a large social platform, the Act likely touches your operations. Marketing teams running paid campaigns, e-commerce sites with reviews, SaaS platforms with community features, and creators using link tools all have exposure. Practical steps to take now:

1. Map Your User-Generated Content Surfaces

Inventory every channel where users can post, comment, message, or share links. Each surface needs a reporting path and a moderation owner.

2. Tighten Link and URL Practices

Scam and phishing content is a major regulated category. Businesses that publish links — especially at scale in marketing, affiliate, or campaign contexts — should use reputable link management infrastructure with abuse detection, transparent redirects, and clear ownership. Trusted providers such as Lunyb offer branded short links with security-focused controls, which helps recipients verify legitimacy and reduces the risk of your domain being spoofed by scammers. For a broader look at options, see our 2026 buyer's guide to URL shorteners.

3. Update Terms of Service and Community Guidelines

Explicitly prohibit the categories of harm listed in the Act, describe your enforcement process, and note that Singapore-specific directions will be honoured.

4. Train Staff on OSC Directions

Legal, trust and safety, and engineering teams should know what an OSC or IMDA direction looks like and how quickly it must be actioned.

5. Implement Age and Risk Controls Where Relevant

If your service is likely to be used by minors, apply age-appropriate defaults and restrict risky features such as unsolicited adult contact.

What the Act Means for Everyday Users

For individuals, the 2026 Act is largely protective. You have clearer rights to report abuse and expect action. Practical guidance:

• Report early: Use in-platform tools first; escalate to the OSC if the platform does not act.
• Preserve evidence: Screenshots with URLs and timestamps strengthen any complaint.
• Be scam-aware: Verify unfamiliar short links, check sender identity, and avoid entering credentials from links received in messages.
• Protect your accounts: Use strong, unique passwords, enable two-factor authentication, and review app permissions regularly.
• Use privacy-respecting tools: Encrypted DNS, reputable password managers, and modern browsers with tracker blocking reduce exposure to malicious content.

How the Act Compares to Other Regional Frameworks

Singapore's framework sits between the UK Online Safety Act and Australia's Online Safety Act, with strong elements of Singapore's own regulatory style.

Feature	Singapore 2026	UK OSA	Australia OSA
Dedicated commissioner/commission	Yes (OSC)	Ofcom	eSafety Commissioner
Extraterritorial reach	Yes	Yes	Yes
Scam content in scope	Yes (explicit)	Yes	Partial
NCII and deepfakes	Yes	Yes	Yes
Max penalty per breach	S$1M + daily fines	£18M or 10% turnover	AUD ~$782k civil
Access blocking power	Yes	Yes	Yes

Common Misconceptions

"It only affects big tech."

False. Directions can be issued to any online service accessible in Singapore, including forums, blogs, and smaller platforms.

"Encrypted messaging is exempt."

Not entirely. While the Act respects encryption, messaging providers still have duties around reporting mechanisms, metadata-based signals, and known-bad content lists.

"Overseas companies can ignore it."

They cannot. Non-compliance can result in access blocking at the ISP level, effectively cutting off the Singapore market.

"The Act criminalises opinion."

No. It targets defined categories of harmful content, not general commentary or criticism.

A Practical Compliance Checklist for 2026

1. Confirm whether your service is accessible to Singapore users.
2. Classify your service against the Act's tiers.
3. Publish clear reporting and appeals mechanisms.
4. Deploy proactive detection tools for CSAM, terrorism, and scam URLs.
5. Establish a Singapore point of contact for regulator directions.
6. Document moderation policies and training programs.
7. Prepare annual transparency reporting templates.
8. Audit third-party tools — including link shorteners, ad networks, and analytics — for abuse controls.
9. Run tabletop exercises for urgent takedown directions.
10. Review the framework annually as codes of practice evolve.

Looking Ahead

Regulators globally are converging on a similar model: designated services, codes of practice, transparency reporting, and empowered commissioners. Singapore's 2026 update signals that the era of light-touch platform regulation is over in the region. Businesses that treat online safety as a product and operational discipline — not just a legal checkbox — will be best placed to serve Singapore users while avoiding costly enforcement action.

Frequently Asked Questions

When does the Singapore Online Safety Act 2026 take effect?

Core provisions of Singapore's online safety framework are already in force under the 2022 amendments and the 2023 Online Criminal Harms Act. The 2026 updates — including expanded categories such as AI-generated NCII and the operational Online Safety Commission — are being phased in through 2026, with codes of practice updated by IMDA. Businesses should monitor IMDA announcements for exact commencement dates for each obligation.

Does the Act apply to my overseas business if I do not target Singapore?

Yes, if your service is accessible to end users in Singapore, it can fall within scope regardless of where you are based. Regulators focus on accessibility and user base rather than intent to target the market. If a meaningful number of Singapore users access your platform, treat the Act as applicable.

What should I do if I am a victim of online harm in Singapore?

Report the content through the platform's in-product tools first, preserving screenshots and URLs. If the platform does not respond or refuses to act, submit a complaint to the Online Safety Commission with your evidence. For criminal conduct such as threats, harassment, or intimate image abuse, you should also file a police report.

How does the Act affect link shorteners and marketing links?

Because scams and phishing URLs are explicitly regulated, link infrastructure providers are expected to have abuse detection, takedown workflows, and cooperation with regulators. Businesses using short links should choose reputable providers with strong security practices. Our 2026 shortener comparison and our honest review of Lunyb can help you evaluate options.

What are the penalties for non-compliance?

Financial penalties can reach S$1 million per breach, with additional daily fines for ongoing non-compliance. Beyond fines, the most consequential penalty is access blocking — where Singapore ISPs are directed to prevent users from reaching a non-compliant service. Individual offences, such as sharing NCII, can also attract criminal prosecution under other Singapore laws.