Singapore Online Safety Act 2026: Complete Guide for Businesses and Users

Singapore has moved decisively over the past few years to make its digital space one of the safest in Asia. The Singapore Online Safety Act 2026 builds on the 2022 amendments to the Broadcasting Act and the newer Online Criminal Harms Act (OCHA), tightening the rules for social media services, messaging platforms, and any online business that touches Singapore users. Whether you run a marketing agency, operate a SaaS product, or simply want to understand your rights as a user, this guide breaks down what the Act means in 2026.

What Is the Singapore Online Safety Act 2026?

The Singapore Online Safety Act 2026 is the updated regulatory framework administered by the Infocomm Media Development Authority (IMDA) that governs how online communication services must handle harmful content, protect minors, and cooperate with Singapore authorities. It consolidates and expands earlier obligations under the Broadcasting (Amendment) Act 2022 and the Online Safety Code of Practice.

In practical terms, the Act gives IMDA the power to order platforms to block, remove, or restrict access to content that is deemed "egregious"—such as child sexual exploitation material, terrorism content, content inciting racial or religious violence, and content promoting self-harm. The 2026 update pushes further into areas like deepfakes, AI-generated harmful content, scam links, and platform-level accountability.

Why Singapore Updated the Law in 2026

Three trends drove the 2026 refresh:

1. Generative AI misuse: A sharp rise in AI-generated scams, non-consensual intimate imagery, and impersonation of public figures.
2. Cross-border scam networks: Singapore residents lost over S$650 million to online scams in 2023 alone, with numbers still climbing.
3. Youth mental health: Growing evidence linking algorithmic feeds to harm among minors.

Who the Act Applies To

The Act applies to "Regulated Online Communication Services" (ROCS) accessible to end-users in Singapore. This is broader than many operators expect.

• Designated social media services — platforms with significant Singapore reach (Facebook, Instagram, TikTok, X, YouTube, etc.).
• Messaging and communication apps — including WhatsApp, Telegram, and Discord.
• Online marketplaces — e-commerce and classifieds where user-generated listings appear.
• App stores — with specific duties for age assurance.
• Smaller platforms — subject to reactive takedown orders even if not "designated."

Foreign platforms without a Singapore office are still bound if they serve Singapore users—a key extraterritorial feature that catches most global services.

Core Obligations Under the 2026 Framework

The Act imposes both proactive duties (systems you must have in place) and reactive duties (how quickly you respond to orders). Here is a summary of what regulated services must do.

1. Content Moderation Systems

Designated services must implement risk-based systems to detect and mitigate exposure to harmful content. This includes automated detection tools, trained human moderators, and clear internal escalation policies.

2. User Reporting Tools

Platforms must offer easy-to-find in-app reporting for Singapore users, with acknowledgement within 24 hours and resolution within a reasonable window (typically 72 hours for non-egregious content).

3. Child Safety by Default

Accounts belonging to minors must default to the strictest privacy settings. Targeted advertising to under-18s based on behavioural data is prohibited, and age assurance mechanisms are expected where risk is elevated.

4. Transparency Reporting

Annual online safety reports must be submitted to IMDA, covering the volume of harmful content detected, response times, and effectiveness of safety measures.

5. Compliance With Directions

When IMDA or an authorized officer issues a direction, platforms typically have as little as a few hours to disable access for Singapore users—especially in cases involving imminent harm.

Types of Harmful Content Covered

The Act categorises content into tiers, each with different response expectations.

Content Category	Examples	Response Time
Egregious content	CSAM, terrorism, incitement to violence	Immediate / hours
Scam & fraud content	Phishing links, investment scams, impersonation	24 hours
Harmful to minors	Self-harm promotion, cyberbullying, sexual content	24–48 hours
Misinformation with public harm	Election interference, false health claims	Case-by-case order
AI-generated harm	Deepfakes, synthetic intimate imagery	24 hours or faster

Penalties for Non-Compliance

The financial and operational consequences of ignoring the Act are severe.

• Fines up to S$1 million per breach for designated services.
• Access blocking — IMDA can order Singapore internet service providers to block a non-compliant platform entirely.
• App store delisting — Google Play and Apple's App Store may be directed to remove the app from Singapore storefronts.
• Criminal liability — In serious cases involving obstruction or false statements to IMDA, individual officers may face imprisonment.

In 2024 and 2025, several platforms received public advisories, and access-blocking orders were issued to sites hosting non-consensual intimate imagery. The 2026 update raises the ceiling on repeat-offender penalties.

What This Means for Businesses Operating in Singapore

Even if you are not a social media giant, the Act affects you if any of the following apply.

You Run a Website With User-Generated Content

Forums, comment sections, review platforms, and community sites all fall under the reactive duties of the Act. You should be able to receive and act on takedown notices from Singapore authorities.

You Send Marketing Links to Singapore Users

Scam links are a priority enforcement area. If your shortened links are ever hijacked or spoofed, you need infrastructure that lets you disable them fast. Tools like Lunyb allow you to deactivate a short link instantly, add password protection, and track clicks so you can respond to abuse reports the moment they arrive. This kind of control is now effectively a compliance requirement, not a nice-to-have. If you're evaluating options, see our 2026 buyer's guide to URL shorteners.

You Operate a Marketplace or Classifieds Site

Listings for illegal goods, counterfeit items, or scam services must be removed promptly on report. Verifiable seller identity is increasingly expected for higher-risk categories.

You Handle Minors' Data

Edtech, gaming, and social products aimed at users under 18 face the strictest scrutiny. Age gates alone are no longer sufficient—documented age assurance strategies are expected.

Interaction With Other Singapore Laws

The Online Safety Act 2026 does not sit alone. It interlocks with:

• Personal Data Protection Act (PDPA) — governs how user data collected during moderation and reporting is stored.
• Online Criminal Harms Act (OCHA) — gives police direct powers to order takedown of criminal content, including scams.
• Protection from Online Falsehoods and Manipulation Act (POFMA) — addresses misinformation, including correction directions.
• Cybersecurity Act — covers critical information infrastructure and incident reporting.

A single incident—say, a phishing campaign impersonating a Singapore bank—can trigger obligations under all four laws simultaneously.

How Users Are Protected

For Singapore residents, the Act provides several concrete rights and protections.

1. Right to report: Every regulated platform must offer a clear in-app reporting mechanism.
2. Right to escalate: If a platform fails to act, users can escalate to IMDA directly through its online portal.
3. Protection from doxxing and image-based abuse: Victims can request rapid removal of intimate images or personal information published without consent.
4. Youth-specific protections: Enhanced default settings, no behavioural ads, and restrictions on features that encourage compulsive use.

Practical Compliance Checklist

If you operate any online service reaching Singapore users, use this checklist as a starting point.

1. Map whether your service qualifies as a Regulated Online Communication Service.
2. Publish clear community guidelines and terms addressing harmful content categories.
3. Deploy in-product reporting with acknowledgement and case tracking.
4. Establish a Singapore point-of-contact for IMDA notices (email inbox monitored 24/7 is the minimum).
5. Implement age assurance if minors form a meaningful part of your audience.
6. Log takedown requests and responses for annual transparency reporting.
7. Review your link infrastructure—ensure shortened URLs, redirects, and marketing assets can be disabled quickly if abused.
8. Train staff on POFMA, OCHA, and Online Safety Act direction handling.
9. Audit third-party vendors (analytics, ad networks, moderation tools) for compliance alignment.
10. Schedule an annual policy review, ideally aligned with IMDA guidance updates.

Common Misconceptions

"We're Based Overseas So It Doesn't Apply"

The Act is explicitly extraterritorial. If you have Singapore users, you have obligations—regardless of where your servers or company are located.

"We're Too Small to Be Noticed"

Designated-service duties only apply above certain thresholds, but the reactive duties (responding to takedown orders) apply to virtually any online service. Enforcement has already reached smaller sites hosting harmful content.

"End-to-End Encryption Exempts Us"

Encryption protects message content, but platforms still have duties around reporting tools, safety-by-design, transparency, and metadata-based responses. The Act does not require breaking encryption, but it also does not treat it as a blanket exemption.

Looking Ahead: What's Next After 2026?

IMDA has signaled several areas of continued focus:

• Stronger duties around AI-generated content provenance, including watermarking and disclosure.
• Expanded age assurance requirements, potentially aligned with UK and EU standards.
• Closer ASEAN-level coordination on cross-border scam takedowns.
• New codes of practice for generative AI platforms operating in Singapore.

Businesses that treat compliance as an ongoing programme rather than a one-off project will fare best. For a broader look at protecting your brand's links and tracking abuse, our honest review of Lunyb covers the safety controls modern link platforms should offer.

FAQ: Singapore Online Safety Act 2026

1. When did the Singapore Online Safety Act 2026 take effect?

The 2026 update builds on obligations phased in from 2023 onward under the Broadcasting (Amendment) Act 2022 and Online Safety Code of Practice. The 2026 revisions primarily expand scope to AI-generated content, deepfakes, and stricter penalties for repeat offenders. Most provisions apply immediately, with a limited transition window for smaller services.

2. Does the Act apply to my company if we don't have a Singapore office?

Yes. The Act has extraterritorial reach. If your online service is accessible to end-users in Singapore, you must comply with reactive duties such as responding to takedown directions. Designated services face additional proactive obligations regardless of where they are headquartered.

3. What are the penalties for ignoring an IMDA takedown direction?

Fines can reach S$1 million per breach, with additional daily penalties for continued non-compliance. IMDA can also order Singapore internet service providers to block access to your platform and direct app stores to delist your app. Officers may face criminal liability in cases of obstruction or false statements.

4. How does the Act treat AI-generated content and deepfakes?

The 2026 update explicitly covers synthetic media. Non-consensual intimate deepfakes, impersonation deepfakes used for scams, and AI-generated content that promotes violence or self-harm are treated as egregious content requiring rapid removal. Provenance and disclosure requirements for AI content are expected to strengthen further.

5. As a user, how do I report harmful content?

First use the in-app reporting tool on the platform where the content appears—platforms must acknowledge reports within 24 hours. If the platform fails to act appropriately, you can escalate to IMDA via its online reporting portal. For criminal matters such as scams or intimate image abuse, you can also file a police report, which may trigger action under OCHA.

Final Thoughts

The Singapore Online Safety Act 2026 reflects a global trend: governments are shifting responsibility for online harm from individual users to the platforms and businesses that shape the digital environment. For companies operating in or targeting Singapore, the practical reality is that safety, moderation, and rapid-response capabilities are now core business infrastructure—on par with billing systems or customer support.

The good news is that the Act is largely principles-based and risk-proportionate. A small business with a well-monitored reporting inbox, clear policies, and controllable link infrastructure can meet its obligations without enterprise-scale investment. A large platform, on the other hand, will need dedicated trust-and-safety teams, transparent reporting, and close engagement with IMDA. Either way, the direction is clear: online safety in Singapore is no longer optional—it is the price of doing digital business here.