Singapore Online Safety Act 2026: Complete Guide for Businesses and Users

Singapore has steadily built one of the most comprehensive digital safety frameworks in Asia, and the Online Safety Act 2026 represents the next major evolution of that effort. Building on the 2022 amendments to the Broadcasting Act and the Online Criminal Harms Act (OCHA) 2023, the 2026 update expands regulator powers, tightens obligations on online communication services, and introduces new duties around scams, deepfakes, and content targeting minors.

This guide breaks down what the Singapore Online Safety Act 2026 actually requires, who it applies to, how enforcement works under the Infocomm Media Development Authority (IMDA), and what practical steps businesses, publishers, and everyday users should take to stay compliant and protected.

What Is the Singapore Online Safety Act 2026?

The Singapore Online Safety Act 2026 is a legislative framework that regulates online communication services accessible to Singapore users, with a focus on reducing exposure to harmful content, scams, and malicious digital activity. It consolidates and extends duties introduced under earlier laws, including the Online Safety (Miscellaneous Amendments) Act 2022 and the Online Criminal Harms Act 2023.

At its core, the Act imposes proactive duties on platforms to detect, disable, and disclose harmful content, while giving Singapore authorities faster tools to issue directions against services, accounts, and websites that pose a risk to users in Singapore.

Key Objectives of the Act

• Protect Singapore users, especially children, from harmful online content
• Reduce scam-related harms, including phishing, impersonation, and fraudulent links
• Address emerging risks from generative AI, deepfakes, and synthetic media
• Increase transparency and accountability for large online platforms
• Give IMDA and the Police faster, proportionate powers to intervene

Who Must Comply With the Act

The Act applies broadly to any online communication service with end users in Singapore, regardless of where the service is headquartered. This mirrors the extraterritorial reach seen in the EU Digital Services Act and Australia's Online Safety Act.

Regulated Entities

1. Designated Online Communication Services (DOCS): Large social media platforms with significant Singapore reach, such as major networks designated by IMDA.
2. General online communication services: Smaller platforms, forums, messaging apps, and user-generated content sites.
3. Internet access service providers: Local ISPs that may be directed to block access to non-compliant services.
4. App distribution services: App stores that may be ordered to restrict downloads of offending apps.
5. Websites and publishers: Any online location communicating content to Singapore users, including blogs, news sites, and e-commerce stores.

Extraterritorial Scope

A platform does not need a Singapore office to fall under the Act. If your service is accessible from Singapore and reaches Singapore users, IMDA can issue directions and expect compliance. Non-compliance can result in access-blocking orders directed at local ISPs and app stores.

Categories of Harmful Content Under the Act

The Act defines several categories of "egregious" and "harmful" content that platforms must actively manage. Understanding these categories is critical because they determine when a takedown or disabling direction can be issued.

Egregious Content

• Child sexual exploitation material
• Content advocating suicide, self-harm, or terrorism
• Content inciting public disorder or racial and religious tensions
• Content posing risks to public health, including dangerous misinformation during health emergencies

Criminal Harms (Expanded in 2026)

• Scams and phishing operations targeting Singapore residents
• Malware distribution and links to compromised infrastructure
• Unauthorised disclosure of personal data
• Impersonation of officials, banks, and government agencies
• Deepfake content used for fraud, harassment, or election interference

Content Harmful to Children

Designated services must implement age-appropriate safeguards, including content filtering, safer default settings for minors, and tools that let parents restrict exposure to violent, sexual, or grooming-related material.

Core Duties Imposed on Platforms

The Act moves platforms from a reactive takedown model toward proactive risk management. Duties are tiered: designated services face the highest obligations, while smaller services face lighter, principle-based duties.

Duties for Designated Online Communication Services

1. Systems and processes: Implement measures to minimise Singapore users' exposure to harmful content.
2. User reporting tools: Provide clear, accessible mechanisms to report harmful content and receive timely responses.
3. Transparency reporting: Publish annual reports covering content moderation actions, response times, and enforcement outcomes.
4. Risk assessments: Conduct periodic assessments of foreseeable harms, including risks introduced by AI-generated content.
5. Cooperation with IMDA: Respond to information requests, directions, and codes of practice within specified timeframes.

Duties for All Online Services

• Act on lawful directions from IMDA to disable or remove specified content
• Preserve records that may support investigations under OCHA
• Provide account and content information when lawfully compelled
• Refrain from re-enabling content that has been the subject of a valid direction

Enforcement Powers and Directions

Enforcement is led by IMDA, with additional powers exercised by the Singapore Police Force under OCHA. The 2026 framework introduces faster response timelines and clarifies escalation paths.

Types of Directions

Direction Type	What It Requires	Typical Timeline
Disabling Direction	Block Singapore user access to specific content	Within hours for egregious content
Stop Communication Direction	Cease communicating specified content to Singapore users	24 hours
Account Restriction Direction	Restrict or suspend specified accounts	24-48 hours
App Removal Direction	App stores remove offending apps from Singapore storefronts	24 hours
Access Blocking Order	ISPs block non-compliant services	Final escalation step

Penalties for Non-Compliance

• Financial penalties up to S$1 million for designated services that fail to comply with codes of practice
• Additional daily penalties for continuing breaches
• Access-blocking orders that effectively cut a service off from Singapore users
• Criminal liability for individuals who obstruct investigations or provide false information

New 2026 Provisions: Scams, Deepfakes, and AI Content

The 2026 update responds directly to trends that dominated Singapore's threat landscape in the preceding years, including record scam losses and the rapid adoption of generative AI tools.

Anti-Scam Measures

Platforms must have detection systems for high-risk categories, including investment scams, romance scams, job scams, and government impersonation. This includes obligations to act on trusted flagger reports from agencies like the Singapore Police Force's Anti-Scam Command.

For businesses that publish links to customers, this is particularly relevant. Using a reputable link management platform like Lunyb helps ensure your branded short links are traceable, revocable, and less likely to be flagged alongside scam infrastructure. If you rely heavily on link sharing, our 2026 buyer's guide to URL shorteners covers what to look for from a compliance perspective.

Deepfake and Synthetic Media Rules

• Non-consensual intimate deepfakes are explicitly prohibited
• Deepfakes of political candidates during election periods trigger expedited takedown directions
• Platforms may be required to label or watermark AI-generated content
• Sharing deepfakes for fraud or harassment can lead to criminal charges

Protecting Minors

Designated services accessible to children must implement default privacy settings, disable targeted advertising based on sensitive data, and offer parental controls. Age assurance mechanisms may be required where content risks are elevated.

Practical Compliance Checklist for Businesses

Whether you operate a large platform or a small Singapore-facing website, the following steps will help align your operations with the Act.

For Platform Operators

1. Map your Singapore user base and confirm whether you may be designated by IMDA
2. Document your content moderation systems, escalation paths, and response times
3. Establish a Singapore point of contact for regulator communications
4. Build a scam and deepfake detection workflow, including trusted flagger channels
5. Prepare annual transparency reporting templates in line with IMDA codes
6. Run a risk assessment covering harms to minors and vulnerable users

For Publishers, Marketers, and SMEs

1. Audit outbound links and ensure any short links you distribute point to safe, verified destinations
2. Avoid link-cloaking practices that resemble scam patterns
3. Keep records of marketing campaigns and content approvals
4. Train staff to recognise phishing, impersonation, and deepfake threats targeting your brand
5. Have an incident response plan if your brand or executives are impersonated online

For Everyday Users

1. Report harmful content through official platform tools and, where relevant, ScamShield
2. Use encrypted DNS and reputable private browsers to reduce exposure to malicious infrastructure
3. Enable two-factor authentication on important accounts
4. Verify unexpected messages from banks and government agencies through official channels
5. Educate family members, especially children and seniors, on current scam patterns

How the Act Compares to Other Regional Frameworks

Singapore's approach shares DNA with international peers but is notably more direct in terms of enforcement speed.

Framework	Primary Focus	Enforcement Speed	Extraterritorial Reach
Singapore OSA 2026	Harmful content, scams, deepfakes	Very fast (hours to days)	Yes
EU Digital Services Act	Systemic risks, transparency	Moderate	Yes
UK Online Safety Act	Illegal content, child safety	Moderate	Yes
Australia Online Safety Act	Cyberbullying, image abuse	Fast	Yes

Common Misconceptions

"The Act Only Applies to Big Tech"

False. While designated services carry the heaviest duties, IMDA can issue directions to any online location communicating content to Singapore users, including small blogs and forums.

"Hosting Outside Singapore Provides Immunity"

Also false. The Act has extraterritorial effect. Services hosted overseas can still face access-blocking orders that cut them off from Singapore users.

"Compliance Means Removing All Controversial Content"

The Act targets specific categories of harm, not general controversy or political speech. Well-designed moderation policies focus on illegal content, scams, and safety risks rather than blanket removals.

Building a Safer Online Presence

Compliance is not just about avoiding penalties. Businesses that invest in transparent content practices, secure link infrastructure, and responsible moderation typically see stronger user trust and lower fraud exposure. If you are reviewing your link stack as part of a broader safety audit, our honest review of Lunyb and our Rebrandly review for 2026 can help you compare options that support click tracking, revocation, and abuse reporting.

Frequently Asked Questions

When does the Singapore Online Safety Act 2026 take effect?

The 2026 updates build on provisions already in force since 2023, with new obligations phased in through 2026. Designated services typically receive a grace period, but core duties around scams, egregious content, and cooperation with IMDA apply from the effective date announced in the gazette.

Does the Act apply to overseas platforms with Singapore users?

Yes. The Act has extraterritorial reach. Any online communication service accessible to Singapore users may receive directions from IMDA, and non-compliance can trigger access-blocking orders directed at local ISPs and app stores.

What happens if a platform ignores an IMDA direction?

Consequences escalate quickly. Financial penalties can reach S$1 million for designated services, with additional daily penalties for continuing breaches. IMDA can also order Singapore ISPs and app stores to block the service entirely.

How does the Act handle AI-generated content and deepfakes?

The 2026 framework treats malicious deepfakes as a priority harm. Non-consensual intimate deepfakes are prohibited, political deepfakes during election periods face expedited takedowns, and platforms may be required to label AI-generated content under future codes of practice.

What should small businesses do to stay compliant?

Focus on the basics: keep your website free of malicious or misleading content, maintain accurate contact information, ensure any links you distribute are safe and revocable, respond promptly to lawful requests, and train your team on scams and impersonation. If you use link management tools, choose providers that offer abuse reporting and quick disabling of compromised links.

Conclusion

The Singapore Online Safety Act 2026 signals a mature, risk-based approach to online harms. It rewards platforms and businesses that build safety into their operations from the start and penalises those that treat compliance as an afterthought. By understanding your obligations, tightening your content and link practices, and staying alert to emerging threats like deepfakes and AI-driven scams, you can not only comply with the law but also earn stronger trust from Singapore users in an increasingly cautious digital environment.