Singapore Online Safety Act 2026: Complete Guide for Businesses and Users

Singapore has steadily built one of the most comprehensive digital safety frameworks in Asia, and the Online Safety Act 2026 represents the next major step in that evolution. Building on the Online Safety (Miscellaneous Amendments) Act of 2022 and the Online Criminal Harms Act of 2023, the 2026 framework consolidates platform obligations, user protections, and regulator powers under a single, more coherent regime. This guide explains what the Act covers, who it applies to, what compliance looks like in practice, and what everyday Singaporeans should know.

What Is the Singapore Online Safety Act 2026?

The Singapore Online Safety Act 2026 is a consolidated piece of legislation administered by the Infocomm Media Development Authority (IMDA) that governs how online services operate within Singapore, with a focus on reducing exposure to harmful content, protecting minors, and enabling faster response to criminal and malicious online activity. It extends and streamlines earlier online safety amendments to the Broadcasting Act and aligns Singapore's framework with international standards such as the EU Digital Services Act and the UK Online Safety Act.

At its core, the Act does three things:

1. Imposes systemic duties on designated online services, especially large social media platforms.
2. Grants regulators clearer powers to issue directions, including content removal and access blocking.
3. Strengthens protections for Singapore users, with particular attention to children and victims of online harms.

Why Singapore Updated the Online Safety Framework

Earlier legislation was effective but fragmented across the Broadcasting Act, the Online Criminal Harms Act, and the Protection from Online Falsehoods and Manipulation Act (POFMA). As harms evolved—AI-generated deepfakes, coordinated scams, livestreamed abuse, and algorithmic amplification of harmful content—regulators needed a more unified toolkit.

The 2026 Act responds to several trends:

• Rising scam losses: Singapore residents lost record amounts to online scams in recent years, prompting demand for faster disruption powers.
• Child safety concerns: Increased exposure of minors to inappropriate content and grooming on messaging and social platforms.
• Deepfakes and synthetic media: Non-consensual intimate imagery and election-related manipulation.
• Cross-border enforcement gaps: Many harmful services are hosted overseas, requiring access-blocking and app-store removal tools.

Who the Act Applies To

The Act applies broadly to any online service accessible to users in Singapore, but the depth of obligations scales with risk and reach. Three main categories exist.

1. Designated Online Communication Services (DOCS)

These are large-reach services—typically major social media networks, video-sharing platforms, and some messaging services—formally designated by IMDA. They face the strictest systemic duties, including risk assessments, user reporting tools, and transparency reporting.

2. General Online Services

Smaller platforms, forums, SaaS tools, link shorteners, hosting providers, and online marketplaces fall here. They have lighter default obligations but must comply with lawful directions from authorities (for example, to remove or disable access to specific content).

3. Internet Access Service Providers

Local ISPs may be directed to block access to non-compliant overseas services, mirroring the access-blocking tools already used under earlier legislation.

Key Categories of Harmful Content

The Act identifies several categories of "egregious content" that platforms must act on quickly, typically within 24 hours of a direction or valid user report:

• Child sexual exploitation and abuse material (CSAM)
• Content advocating or facilitating suicide and self-harm
• Terrorism and violent extremism content
• Non-consensual intimate images, including deepfakes
• Content inciting violence, racial or religious hatred
• Scam and fraud-related content, including impersonation
• Cyberbullying and harassment targeting minors

Core Obligations for Platforms

Designated services must implement a layered compliance program. The following obligations are central under the 2026 framework.

Risk Assessments

Platforms must conduct and periodically update written risk assessments covering the likelihood of Singapore users encountering each category of harmful content, including risks to minors and risks created by recommender algorithms.

Safety by Design

Default settings for users under 18 must be privacy- and safety-oriented. This includes limits on direct messages from strangers, restrictions on algorithmic amplification of sensitive content, and clear age-appropriate design standards.

User Reporting and Appeals

Services must provide an accessible mechanism for users in Singapore to report harmful content and must offer an appeal process when content or accounts are actioned.

Transparency Reporting

Designated services must publish annual transparency reports covering volume of reports received, action timelines, moderation resources dedicated to Singapore, and effectiveness of safety features.

Cooperation with Directions

Platforms must comply with lawful directions to remove, disable, or restrict access to specified content, accounts, or functionalities within prescribed timeframes.

Regulator Powers Under the Act

The Act consolidates and expands directions-making powers available to IMDA and, for criminal harms, the Police and other designated officers.

Direction Type	What It Does	Typical Timeframe
Content Removal Direction	Requires removal or disabling of specific content	Within hours to 24 hours
Access Blocking Direction	Directs ISPs to block an overseas service	24–48 hours
Account Restriction Direction	Requires suspension of specific accounts	24 hours
App Removal Direction	Requires app stores to delist an app in Singapore	Within 24 hours
Service Restriction Direction	Limits specific features (e.g., livestreaming, DMs)	As specified
Information Direction	Compels disclosure of user or activity information	As specified

Penalties for Non-Compliance

The Act significantly raises the ceiling for non-compliance, bringing Singapore closer to EU-style financial deterrents.

• Corporate fines: Up to S$1 million per offence, with higher tiers for repeated or systemic breaches.
• Daily default penalties: Additional fines for each day of continued non-compliance with a direction.
• Access blocking: Non-cooperative overseas services can be blocked at the ISP level.
• App store removal: Non-compliant apps can be removed from Singapore listings.
• Individual liability: Senior officers may face liability where offences are committed with their consent or neglect.

Protections and Remedies for Users

A major theme in the 2026 Act is giving ordinary users faster, clearer remedies. Victims of online harms—particularly non-consensual intimate imagery, doxxing, and targeted harassment—can seek rapid takedown orders through a dedicated statutory process without needing to pursue full civil litigation.

Users also benefit from:

1. Clearer reporting pathways directly within platforms.
2. A statutory right of appeal when content or accounts are actioned.
3. Enhanced child safety defaults on designated services.
4. Public transparency reports that allow informed platform choice.

Impact on Businesses Operating in Singapore

Even organisations that are not "designated" services should expect indirect impact. Marketers, publishers, e-commerce operators, and SaaS providers all touch user-generated content or distribute links at scale.

Marketing and Link Distribution

Scam content frequently reaches victims through shortened or obfuscated links. Businesses that use URL shorteners for campaigns should choose providers that enforce anti-abuse policies, scan destination URLs, and respond to lawful takedown requests. Tools like Lunyb emphasise safe-link practices and transparent moderation, which align with the direction of travel under the Act. For a broader market view, see our 2026 buyer's guide to URL shorteners.

User-Generated Content Platforms

Forums, review sites, and community apps should implement reporting workflows, logging, and response SLAs now, even if not formally designated. Having documentation ready reduces friction if a direction is received.

Advertising and Affiliate Networks

Ad networks must tighten screening for scam ads, impersonation, and misleading financial content. Expect more scrutiny of advertiser verification and landing pages.

How the 2026 Act Compares with Earlier Laws

Feature	Pre-2026 Framework	Online Safety Act 2026
Governing instruments	Spread across Broadcasting Act, OCHA, POFMA	Consolidated primary Act
Scope	Mainly large social media	Tiered: all online services, scaled by risk
Child safety duties	General codes of practice	Explicit safety-by-design requirements
Deepfake coverage	Limited	Explicit, including non-consensual synthetic imagery
Maximum fines	Up to S$1 million (per offence)	Up to S$1 million plus daily default penalties
User remedies	Platform-dependent	Statutory takedown pathway

Compliance Roadmap: What to Do in the First 90 Days

Organisations should treat compliance as a program, not a one-off task. A practical first 90-day plan looks like this:

1. Days 1–15: Map your services to the Act's tiers. Identify whether you are likely to be designated or treated as a general service.
2. Days 15–30: Conduct an initial harm risk assessment. Document categories of content most relevant to your platform.
3. Days 30–45: Review user terms, community guidelines, and age-gating. Update to reflect prohibited content categories.
4. Days 45–60: Build or improve in-product reporting and appeals flows. Establish SLAs aligned with 24-hour direction response windows.
5. Days 60–75: Set up a Singapore point of contact, legal escalation workflow, and law enforcement liaison process.
6. Days 75–90: Prepare a draft transparency report template and train moderation and trust-and-safety staff.

Practical Tips for Everyday Users

The Act gives users more tools, but personal online safety habits remain essential. A few practical steps:

• Enable two-factor authentication on email, banking, and social accounts.
• Verify suspicious links by hovering, checking the domain, or using a link preview tool before clicking.
• Report scams promptly through the ScamShield app and the relevant platform's in-app reporting.
• Use encrypted DNS and a reputable private browser to reduce exposure to malicious domains.
• For parents: review age-appropriate defaults on children's accounts and keep an open conversation about online risks.

Common Misconceptions

"The Act censors free speech online."

The Act targets specific categories of egregious and illegal content, not general political speech or criticism. Standard journalism, satire, and public debate remain protected under existing constitutional and statutory safeguards.

"Only big platforms need to care."

Designated services carry the heaviest duties, but smaller platforms can still receive lawful directions and must respond. Preparing processes early is less costly than reacting under pressure.

"Overseas services are out of reach."

The Act's access-blocking and app-store removal powers specifically address overseas non-compliance. Reach is not geographic—it is user-based.

Looking Ahead

The Online Safety Act 2026 marks a maturing of Singapore's digital governance. Expect subsidiary codes of practice to follow, covering specific areas such as AI-generated content, algorithmic transparency, and child safety design standards. Businesses that invest early in trust-and-safety capabilities—moderation tooling, link hygiene, incident response—will find compliance much smoother as the regime beds in.

Frequently Asked Questions

When does the Singapore Online Safety Act 2026 take effect?

Core provisions come into force in 2026, with subsidiary codes and designation decisions phased in over the following months. Platforms should monitor IMDA announcements and prepare for staggered compliance deadlines rather than a single "go-live" date.

Does the Act apply to overseas websites and apps?

Yes. If a service is accessible to users in Singapore and meets thresholds for designation or receives a lawful direction, it must comply. Overseas services that refuse can be access-blocked by ISPs or removed from local app store listings.

How does the Act differ from POFMA?

POFMA focuses on false statements of fact that affect the public interest. The Online Safety Act 2026 focuses on broader categories of harmful content such as CSAM, terrorism, self-harm, scams, and non-consensual intimate imagery, along with systemic platform duties. The two regimes operate alongside each other.

Can individuals be fined under the Act?

Most financial penalties target corporations. However, senior officers can face personal liability where offences are committed with their consent, connivance, or through neglect. Users who post illegal content remain liable under other criminal laws.

What should small businesses using URL shorteners do?

Choose link providers with clear anti-abuse policies and takedown procedures, avoid cloaking destination URLs, and keep internal records of campaigns. Reputable providers such as those compared in our URL shortener buyer's guide make it easier to demonstrate good-faith compliance if a direction or complaint arises.