Singapore Online Safety Act 2026: Complete Guide for Businesses and Users

Singapore continues to strengthen its digital regulatory framework, and the Online Safety Act 2026 represents one of the most consequential updates yet. Building on the original 2022 amendments to the Broadcasting Act and the 2023 Online Safety (Miscellaneous Amendments) Act, the 2026 iteration expands scope, tightens obligations, and introduces new categories of designated services. Whether you operate a platform, run a small business with a Singapore audience, or simply want to understand how the law affects you, this complete guide breaks down everything you need to know.

What Is the Singapore Online Safety Act 2026?

The Singapore Online Safety Act 2026 is a legislative framework administered by the Infocomm Media Development Authority (IMDA) that regulates online communication services accessible in Singapore. It sets out mandatory duties for platforms to prevent, detect, and remove harmful content, while giving regulators powers to issue directions, impose fines, and block non-compliant services.

The 2026 update extends previous rules in three key ways: it broadens the definition of "regulated online services," introduces a tiered risk-classification model, and adds explicit obligations around scams, deepfakes, and AI-generated content. It applies not only to social media giants but to any online communication service with significant reach in Singapore.

Why Singapore Updated the Law in 2026

Three factors drove the update:

1. Rising scam losses: Singapore residents lost record sums to online scams in 2024 and 2025, prompting demands for stronger platform accountability.
2. Generative AI risks: Deepfakes targeting public figures and ordinary citizens have grown rapidly, requiring specific legal tools.
3. Cross-border harm: Much harmful content originates overseas, so the Act extends extraterritorial reach to services accessible from Singapore.

Who Does the Act Apply To?

The Act applies to any online communication service that is accessible to end-users in Singapore, regardless of where the operator is based. This includes social media platforms, messaging apps, video-sharing sites, online marketplaces, forums, and increasingly, generative AI services that produce publicly distributed content.

Tiered Classification of Services

The 2026 Act formalizes a three-tier system that determines how heavy compliance obligations are:

Tier	Definition	Key Obligations
Tier 1: Designated Online Communication Services (DOCS)	Very large platforms with significant Singapore user base (typically 1M+ monthly users)	Full code of practice, annual reporting, risk assessments, appointed local representative
Tier 2: Regulated Services	Mid-size platforms and higher-risk niche services	Content moderation systems, user reporting tools, transparency reports
Tier 3: General Online Services	Smaller platforms and websites accessible in Singapore	Reactive takedown on IMDA directions, basic user safeguards

Categories of Harmful Content Covered

The Act defines several categories of "egregious content" that platforms must proactively address. Understanding these categories is essential for compliance officers and product teams.

1. Content Endangering Public Safety and National Security

This includes incitement to violence, terrorism-related material, and content promoting weapons or explosives. The Act allows IMDA to issue rapid-takedown directions with deadlines as short as 24 hours.

2. Sexual Harm Content

Child sexual abuse material, non-consensual intimate imagery, and content sexualizing minors carry the strictest requirements. Platforms must implement proactive detection using hashing databases and reporting mechanisms.

3. Self-Harm and Suicide Content

Content that encourages or facilitates self-harm must be removed or age-gated, with support resources displayed to affected users.

4. Scam and Fraud Content

New in 2026: platforms hosting scam advertisements, phishing links, or fraudulent commerce listings face liability if they fail to act on reports within specified windows. This is a major shift, as Singapore aligns with the UK and Australian approach of treating scams as core online safety harms.

5. Deepfakes and Manipulated Media

The 2026 Act introduces specific rules for synthetic media, especially non-consensual deepfakes and AI-generated content used for fraud or defamation. Platforms hosting generative AI tools must label output and maintain provenance metadata where feasible.

6. Cyberbullying and Harassment

Targeted harassment, doxxing, and coordinated pile-ons against Singapore residents are covered, with expedited processes for victims to request takedowns.

Core Compliance Obligations for Platforms

If your service falls within the Act's scope, you will need to implement a compliance program that addresses the following areas.

Systems and Processes

1. Content moderation systems: Combine automated detection with human review, tuned to Singapore's official languages and local context.
2. User reporting tools: Provide accessible, in-product mechanisms for users to flag harmful content, with acknowledgement and status updates.
3. Age assurance: For services likely to be accessed by minors, implement age-verification or age-estimation controls proportionate to risk.
4. Risk assessments: Conduct annual risk assessments documenting how the service could be misused and what mitigations are in place.
5. Transparency reports: Publish periodic reports on content actioned, user reports handled, and government requests received.

Governance and Accountability

Designated services must appoint a Singapore-based representative or agent authorized to receive IMDA communications. Senior management is expected to sign off on annual compliance statements, and larger platforms may need to demonstrate board-level oversight of online safety risk.

Penalties and Enforcement

The enforcement toolkit under the 2026 Act is considerably stronger than earlier versions. Non-compliance can result in escalating consequences.

Enforcement Action	Trigger	Maximum Penalty
Direction to remove content	Specific harmful content identified	Fines up to SGD 1 million per direction ignored
Access-blocking order	Persistent non-compliance	ISPs required to block the service in Singapore
Financial penalty for systemic failures	Failure to meet code of practice obligations	Up to 10% of annual turnover attributable to Singapore, or SGD 1 million, whichever is higher
Criminal liability	Willful obstruction or false information	Fines and, in serious cases, imprisonment for responsible officers

Beyond formal penalties, reputational damage from public IMDA directions can be significant, particularly for services that rely on trust and advertiser relationships.

What This Means for Small and Medium Businesses

Even if you are not a large platform, the Act affects you in several practical ways.

If You Run a Website or Online Community

Forums, comment sections, community platforms, and even large newsletters with user-generated content may fall under Tier 3 obligations. At minimum you should:

• Publish clear community guidelines aligned with the Act's harm categories.
• Provide a functional way for users to report harmful content.
• Have a documented process to act on IMDA directions promptly.
• Keep records of moderation decisions for at least 12 months.

If You Advertise or Market Online

Marketers should be careful about landing pages, URL shorteners, and promotional links that could be misused for scam-like patterns. Using a reputable, transparent link-management service such as Lunyb helps ensure your shortened links are traceable, brand-safe, and less likely to be mistaken for fraudulent activity by platform filters. For a broader comparison of trustworthy options, see our 2026 buyer's guide to URL shorteners.

If You Handle User Data

The Act intersects with Singapore's Personal Data Protection Act (PDPA). Content moderation records may contain personal data, so retention, access controls, and breach-notification procedures must align with both regimes.

How the Act Compares Internationally

Singapore's approach borrows from several jurisdictions while retaining its own character.

Jurisdiction	Key Law	Similarities to Singapore 2026	Differences
United Kingdom	Online Safety Act 2023	Duty of care, tiered platforms, illegal content focus	UK has stronger emphasis on children's codes; Singapore has faster takedown timelines
European Union	Digital Services Act	Risk assessments, transparency reports, systemic risk	DSA is broader on advertising and algorithmic transparency
Australia	Online Safety Act 2021 (updated)	eSafety-style directions, cyberbullying focus	Australia has a dedicated eSafety Commissioner; Singapore uses IMDA

The net effect is that global platforms already complying with EU and UK regimes will find much of Singapore's framework familiar, but the specific timelines, local-representative requirements, and scam-focused obligations require dedicated attention.

Practical Compliance Roadmap

Here is a step-by-step roadmap organizations can follow to prepare for or maintain compliance with the 2026 Act.

1. Scope assessment: Determine whether your service is accessible in Singapore, estimate user numbers, and identify which tier likely applies.
2. Gap analysis: Map current policies, moderation systems, and reporting tools against the Act's requirements and code of practice.
3. Risk assessment: Document foreseeable harms, likelihood, impact, and mitigations. Update annually or after major product changes.
4. Policy update: Refresh terms of service, community guidelines, and privacy notices to reflect the harm categories and enforcement processes.
5. Operational readiness: Train moderation teams, establish 24-hour response capability for urgent directions, and set up secure channels with IMDA.
6. Local representation: If required, appoint a Singapore-based representative and register their contact details.
7. Transparency reporting: Build data pipelines to produce required metrics without exposing user personal data unnecessarily.
8. Continuous review: Monitor IMDA guidance updates, industry codes, and enforcement decisions to refine your program.

What Users Should Know

The Act is not only about platform obligations. Ordinary users in Singapore gain new rights and protections.

Your Rights Under the Act

• Right to report: Every regulated platform must offer a clear channel to report harmful content, with a response within defined timelines.
• Right to appeal: If your content is removed, platforms must offer a review or appeal path.
• Faster help with deepfakes and intimate imagery: Victims can request expedited removal and, where the platform is uncooperative, escalate to IMDA.
• Better scam protections: Platforms must act on scam reports, and repeated failures can trigger regulatory action.

Steps to Protect Yourself Online

1. Enable two-factor authentication on important accounts, preferably using an authenticator app or hardware key.
2. Use a privacy-respecting browser and consider enabling encrypted DNS to reduce exposure to malicious domains.
3. Verify shortened links before clicking, especially those received via messaging apps. Reputable link services provide previews and reporting tools.
4. Report harmful content promptly through the in-platform mechanism, and keep evidence such as screenshots and URLs.
5. If you are a victim of a deepfake or non-consensual intimate imagery, contact SPF and IMDA channels alongside the platform.

Common Misconceptions About the Act

"It Only Applies to Big Tech"

Not true. While the heaviest obligations sit with Tier 1 platforms, even small forums and community sites accessible from Singapore have baseline duties, particularly around responding to IMDA directions.

"It Restricts Free Speech"

The Act targets specific categories of egregious harm rather than general political speech. Platforms retain discretion in how they moderate lawful but disputed content, and appeal mechanisms are mandatory.

"Overseas Services Are Out of Reach"

Extraterritorial provisions and access-blocking powers mean overseas services accessible in Singapore can be effectively restricted if they refuse to cooperate. Ignoring the law is not a viable strategy for any service with meaningful Singapore users.

Looking Ahead: What to Expect After 2026

Regulators globally are moving toward continuous updates rather than one-off legislation. Expect the following developments in Singapore over the next 18-24 months:

• Detailed codes of practice for generative AI services and synthetic media provenance.
• Sector-specific guidance for e-commerce, gaming, and children's services.
• Closer cooperation between IMDA, the Monetary Authority of Singapore (MAS), and the Singapore Police Force on scam enforcement.
• Public dashboards showing enforcement actions and platform performance metrics.

FAQ: Singapore Online Safety Act 2026

1. When does the Singapore Online Safety Act 2026 take effect?

The core provisions are being phased in throughout 2026, with codes of practice and detailed subsidiary regulations rolling out over the year. Platforms should not wait for every deadline before beginning compliance work; IMDA typically expects reasonable good-faith progress even during transitional periods.

2. Does the Act apply to my small business website?

If your site is accessible in Singapore and hosts user-generated content, comments, or reviews, some baseline obligations likely apply. You should at minimum have community guidelines, a reporting mechanism, and a documented process to respond to lawful takedown requests. Most small sites will fall under Tier 3 with reactive rather than proactive duties.

3. What happens if a foreign platform ignores an IMDA direction?

IMDA can escalate to access-blocking orders, requiring Singapore internet service providers to restrict access to the platform. Financial penalties can be pursued through international enforcement channels, and reputational consequences can affect advertisers, partners, and app-store availability.

4. How is the Act different from Singapore's POFMA?

The Protection from Online Falsehoods and Manipulation Act (POFMA) targets specific false statements of fact of public interest. The Online Safety Act 2026 is broader, addressing systemic harms such as scams, sexual harm content, deepfakes, and self-harm, and imposing ongoing duties on platforms rather than only reactive corrections.

5. Where can I report harmful content?

Start with the in-platform reporting tool of the service concerned. If the platform fails to act, or the harm is urgent (such as sexual harm content or a live scam), escalate to IMDA through their official reporting channels and, where relevant, the Singapore Police Force. Keep timestamps, URLs, and screenshots as evidence.

The Singapore Online Safety Act 2026 marks a decisive step toward a safer, more accountable online environment. For platforms, the work ahead is substantial but manageable with a structured compliance program. For users, the Act delivers stronger tools and clearer rights when things go wrong. Businesses of every size should treat this as an opportunity to review their online presence, harden their processes, and adopt trustworthy tools across their digital stack.