Singapore Online Safety Act 2026: Complete Guide for Businesses and Users

Singapore has steadily positioned itself as one of Asia's most forward-looking jurisdictions when it comes to digital regulation. The Singapore Online Safety Act 2026 represents the next major evolution of the country's online safety framework, building on the foundational amendments introduced to the Broadcasting Act in 2023 and incorporating new provisions targeting generative AI harms, deepfakes, scams, and cross-border enforcement. This complete guide breaks down what the Act means for businesses, platform operators, content creators, and everyday users in Singapore.

What Is the Singapore Online Safety Act 2026?

The Singapore Online Safety Act 2026 is a consolidated piece of legislation that strengthens the Infocomm Media Development Authority's (IMDA) powers to regulate online communication services, social media platforms, and user-generated content accessible in Singapore. It expands on the Online Safety (Miscellaneous Amendments) Act 2022 by introducing clearer obligations for designated services, broader categories of harmful content, and a dedicated statutory body — provisionally referred to as the Online Safety Commission — to handle victim complaints and direct takedowns.

At its core, the Act exists to protect Singapore users from exposure to egregious content, cyber harassment, intimate image abuse, child exploitation material, terrorism-related content, and increasingly, AI-generated synthetic media used for scams or defamation.

Why Singapore Updated Its Online Safety Framework

Several converging pressures drove the 2026 update:

1. Scam proliferation: Singapore recorded record-high scam losses in 2024 and 2025, many originating from manipulated social media posts, phishing links, and impersonation accounts.
2. Generative AI misuse: Deepfake videos of public figures, voice cloning for scam calls, and AI-generated intimate imagery became mainstream threats.
3. Platform accountability gaps: Existing codes of practice applied mainly to the largest social media services, leaving smaller but influential platforms outside the net.
4. Cross-border harm: Content hosted overseas but targeting Singaporeans needed faster enforcement pathways.

The 2026 Act closes these gaps while aligning Singapore with similar regimes in the UK (Online Safety Act 2023), Australia (Online Safety Act 2021), and the EU (Digital Services Act).

Who the Act Applies To

The Act operates on a tiered scope. Not every website or app faces identical obligations.

1. Designated Online Communication Services (DOCS)

These are large social media and messaging platforms with significant Singapore reach. They face the heaviest obligations, including proactive content moderation, systemic risk assessments, and transparency reporting.

2. Regulated Online Services

A broader category covering any interactive service — forums, marketplaces, dating apps, livestreaming services, and gaming platforms — accessible to users in Singapore.

3. Internet Access Service Providers (IASPs)

Telcos and ISPs may be directed to block access to non-compliant overseas services.

4. App Distribution Services

App stores can be directed to delist non-compliant applications targeting Singapore users.

Categories of Harmful Content Covered

The Act defines several categories of content that platforms must act on when notified or when identified through their systems:

• Child sexual exploitation and abuse material (CSAM)
• Terrorism and violent extremism content
• Content inciting self-harm or suicide
• Content promoting organised crime or illegal weapons
• Non-consensual intimate images, including AI-generated deepfakes
• Cyberbullying, doxxing, and online harassment targeting Singapore residents
• Scam and impersonation content, including phishing links and fraudulent investment schemes
• Content undermining racial or religious harmony
• Election-related falsehoods and manipulated media during cooling-off periods

Key Obligations for Platforms

Designated services must comply with a Code of Practice covering several pillars:

User Safety by Design

Platforms must build safety into product design — default-safe settings for minors, friction before sharing suspicious links, warning labels on AI-generated content, and easy-to-find reporting tools.

Content Moderation and Takedown Timeframes

The 2026 Act introduces stricter response windows:

Content Category	Required Action Time
Child sexual exploitation material	Immediate (within hours)
Terrorism content	Within 24 hours
Non-consensual intimate images	Within 24 hours
Scam / impersonation content	Within 24-48 hours
Cyberbullying / harassment	Within 48-72 hours
Other harmful content	As prescribed in Codes

Risk Assessments

DOCS must conduct annual systemic risk assessments covering algorithmic amplification, child safety, and misinformation risks, submitting summaries to IMDA.

Transparency Reporting

Platforms publish semi-annual reports detailing content removed, accounts actioned, average response times, and appeals handled.

User Reporting and Appeals

Services must provide accessible reporting mechanisms and a clear appeals process for users whose content was removed.

New Powers for IMDA and the Online Safety Commission

The 2026 Act expands enforcement tools significantly:

• Directions to disable access: IMDA can order removal of specific content accessible in Singapore.
• Account restriction directions: Platforms can be ordered to suspend accounts repeatedly posting harmful content.
• App removal directions: Non-compliant apps can be delisted from Singapore app stores.
• Access blocking: ISPs may be required to block non-compliant overseas sites.
• Victim-initiated takedowns: The Online Safety Commission accepts complaints directly from victims of intimate image abuse, doxxing, and harassment, with power to issue takedown notices.

Penalties for Non-Compliance

Financial penalties under the 2026 Act are structured to be meaningful even for the largest platforms:

Breach Type	Maximum Penalty
Failure to comply with Code of Practice	Up to S$1 million per breach
Failure to comply with a direction	Up to S$1 million + S$100,000 per day of continuing breach
Serious systemic failures	Up to 10% of annual Singapore turnover (new in 2026)
Individual officer liability	Fines and, in egregious cases, imprisonment

Impact on Businesses Operating in Singapore

Even if your business is not a social media giant, the Act has indirect impact.

Marketers and Advertisers

Ad campaigns using paid influencers, link-sharing, or user-generated content must consider how the content is moderated on the host platform. Links to misleading landing pages or scam-adjacent offers can trigger takedowns.

E-commerce and Marketplaces

Operators of online marketplaces fall under "regulated online services" and need basic trust-and-safety processes: reporting tools, seller verification, and rapid response to notices.

Content Creators and SMEs

Creators sharing branded short links should prioritise reputable, transparent URL shorteners. Clean, trusted short links reduce the risk of being flagged as impersonation or scam content. Tools like Lunyb provide branded short links with analytics and link management, which helps businesses present trustworthy URLs rather than opaque redirects frequently abused in phishing. For more context, see our overview of the best URL shorteners for 2026.

Fintech and Crypto Firms

Given scams dominate enforcement priorities, fintech and crypto platforms face heightened scrutiny on impersonation accounts, fake customer-support channels, and ad placements.

What the Act Means for Everyday Users

The Act gives Singapore residents stronger practical rights:

1. Right to request takedown: Victims of intimate image abuse, doxxing, or targeted harassment can file complaints directly with the Online Safety Commission.
2. Faster response: Statutory timeframes mean platforms cannot drag their feet.
3. Clearer labelling: AI-generated content must be labelled on major platforms, helping users detect deepfakes.
4. Better child protections: Default-safe settings for users under 18, with restrictions on direct messages from strangers and reduced algorithmic exposure to risky content.
5. Appeal rights: If your content is wrongly removed, platforms must offer a review mechanism.

How the Act Compares to Other Jurisdictions

Jurisdiction	Law	Max Penalty	Covers AI/Deepfakes
Singapore	Online Safety Act 2026	Up to 10% SG turnover	Yes (explicit)
UK	Online Safety Act 2023	Up to 10% global turnover	Partial
Australia	Online Safety Act 2021	Up to A$782,500 per breach	Partial (via amendments)
EU	Digital Services Act	Up to 6% global turnover	Yes

Compliance Checklist for Platforms and Businesses

If you operate an interactive online service with Singapore users, use this checklist as a starting point:

1. Determine whether your service is likely to be designated or regulated under the Act.
2. Appoint a Singapore-based point of contact for IMDA directions.
3. Publish clear Community Guidelines covering all content categories defined in the Act.
4. Implement an accessible reporting mechanism (ideally one or two taps from any post).
5. Set internal SLAs that meet statutory takedown windows.
6. Introduce default-safe settings for minors.
7. Label AI-generated content and require creator disclosure.
8. Produce an annual systemic risk assessment.
9. Prepare a transparency report template now.
10. Train moderators on Singapore-specific sensitivities (racial, religious, political).

Protecting Yourself Online in Singapore

While the Act strengthens institutional protections, individual digital hygiene remains essential:

• Hover-check short links before clicking; prefer branded short URLs from recognisable domains.
• Enable two-factor authentication on social and banking accounts.
• Use encrypted DNS (such as DoH or DoT) in your browser to reduce exposure to malicious domains.
• Verify suspected deepfake content through official channels before sharing.
• Report scams through ScamShield and the Online Safety Commission.
• If running a business, audit your short-link stack. Our honest Lunyb review and the Rebrandly 2026 review can help you choose a provider that supports safer link practices.

Timeline and Implementation

The Act is being rolled out in phases through 2026:

1. Q1 2026: Act comes into force; Online Safety Commission established.
2. Q2 2026: First wave of designations under DOCS category; updated Code of Practice published.
3. Q3 2026: Victim complaint portal goes live.
4. Q4 2026: First transparency reports due from designated services.
5. 2027 onwards: Expansion to additional service categories and refined AI-specific obligations.

Frequently Asked Questions

Does the Singapore Online Safety Act 2026 apply to overseas platforms?

Yes. The Act applies to any service with significant reach into Singapore, regardless of where the operator is based. IMDA can issue directions to overseas platforms and, if ignored, direct Singapore ISPs to block access or require app stores to delist the service.

Can individuals be fined under the Act?

The Act primarily targets service providers rather than ordinary users. However, officers of a corporate body may face personal liability for serious systemic failures, and existing laws such as the Protection from Harassment Act still cover individual bad actors.

How do I report harmful content targeting me?

From Q3 2026, victims can file complaints directly with the Online Safety Commission for categories like non-consensual intimate images, doxxing, and sustained harassment. You can also use in-platform reporting and, for scams, the national ScamShield service.

Does the Act regulate private messages?

End-to-end encrypted private messaging is largely out of scope for proactive moderation, but platforms must act on user reports and cannot host illegal content on open channels. The Act focuses on public and semi-public communications and amplification systems rather than private one-to-one messages.

How does the Act handle AI-generated deepfakes?

Deepfakes used for non-consensual intimate imagery, scams, impersonation, or election interference are explicitly covered. Designated platforms must label AI-generated content, provide rapid takedown pathways, and incorporate deepfake detection into their trust-and-safety stack.

Final Thoughts

The Singapore Online Safety Act 2026 is a significant step forward in balancing innovation, free expression, and user protection. For platforms, the message is clear: trust and safety is no longer a cost centre — it is a regulatory requirement with real penalties. For businesses, it is an opportunity to build more trustworthy digital experiences, from how you moderate your community to the very links you share. And for users, it offers meaningful, enforceable protections against the online harms that have grown alongside the digital economy.

Whether you are a platform operator preparing your compliance roadmap or a marketer rethinking your link and content practices, now is the time to act — not when the first enforcement notice arrives.