Singapore Online Safety Act 2026: Complete Guide for Businesses and Users

Singapore has steadily built one of the most structured digital safety frameworks in Asia, and the Online Safety Act 2026 represents the most significant expansion of those rules since the original Online Safety (Miscellaneous Amendments) Act of 2022. For businesses operating online services, marketers running campaigns in Singapore, and everyday users navigating social platforms, understanding what the Act covers in 2026 is essential.

This complete guide explains what the Singapore Online Safety Act 2026 is, who it applies to, what new duties it creates, how enforcement works under the Infocomm Media Development Authority (IMDA), and what practical steps organisations should take to stay compliant.

What Is the Singapore Online Safety Act 2026?

The Singapore Online Safety Act 2026 is an updated legislative framework that strengthens obligations on online communication services, social media platforms, and user-generated content providers that are accessible to Singapore users. It builds on the 2022 amendments to the Broadcasting Act and the Online Criminal Harms Act (OCHA) 2023, creating a more unified approach to harmful content, scams, child safety, and platform accountability.

In short, the Act empowers regulators to issue directions to platforms, demand content takedowns, require risk assessments, and impose financial penalties on services that fail to protect Singapore users from specified online harms.

Key Objectives

Reduce exposure of Singapore users to "egregious content" such as child sexual exploitation material, terrorism content, and content inciting violence.
Tackle online scams, phishing, and malicious cyber activity more aggressively.
Strengthen protections for children and young people on social media services.
Introduce platform-level transparency, risk assessment, and reporting obligations.
Give victims of online harms faster, more accessible remedies.

Background: How Singapore Got Here

Singapore's online safety landscape has evolved rapidly:

2019 – Protection from Online Falsehoods and Manipulation Act (POFMA).
2022 – Online Safety (Miscellaneous Amendments) Act, amending the Broadcasting Act to regulate social media services.
2023 – Online Criminal Harms Act (OCHA) targeting scams and cyber-enabled crime.
2024–2025 – Code of Practice for Online Safety expanded; consultations on a dedicated Online Safety Commission.
2026 – Consolidated Online Safety Act with broader scope, new victim remedies, and stronger penalties.

The 2026 Act essentially consolidates lessons learned from earlier laws and aligns Singapore more closely with frameworks such as the UK Online Safety Act and the EU Digital Services Act, while preserving local priorities around racial and religious harmony, national security, and scam prevention.

Who Does the Act Apply To?

The Act applies extraterritorially: a service does not need to be based in Singapore to fall within scope. If it is accessible to Singapore end users and meets defined thresholds, it must comply.

Covered Services

Designated Social Media Services (DSMS) – large platforms designated by IMDA, typically with significant Singapore reach.
Online Communication Services – messaging apps, forums, livestreaming services, and user-generated content platforms.
App stores and intermediary services – with specific obligations around child safety and scam apps.
Search services – for indexing and surfacing harmful content.

Who Is Mostly Unaffected

Purely private one-to-one communications (subject to lawful interception rules).
Internal enterprise communication tools not open to the public.
Small personal blogs and websites that do not host user-generated content at scale.

That said, even small operators should pay attention: directions issued under the Act can still reach individual websites hosting harmful material or facilitating scams.

Categories of Online Harm Under the 2026 Act

The Act groups online harms into tiered categories, each with different duties and response timelines.

1. Egregious Content (Highest Priority)

Child sexual exploitation and abuse material.
Terrorism and violent extremism content.
Content inciting racial or religious disharmony.
Content endangering public health or security.

2. Criminal Harms

Scams, phishing, and fraudulent e-commerce listings.
Malware distribution and unauthorised access tools.
Illegal gambling, drugs, and firearms-related content.

3. Harms to Children and Young Users

Content promoting self-harm, eating disorders, or suicide.
Cyberbullying and harassment targeting minors.
Age-inappropriate content accessible without adequate safeguards.

4. Harms to Adult Users

Non-consensual intimate imagery.
Doxxing and coordinated online harassment.
Deepfakes used for impersonation, fraud, or defamation.

Core Obligations for Platforms in 2026

Designated services carry the heaviest burden, but all in-scope platforms must meet baseline requirements. The table below summarises the main duties.

Obligation	Applies To	What It Means
Risk Assessments	Designated services	Annual assessments of exposure to each harm category, submitted to IMDA.
Content Standards & Moderation	All in-scope services	Clear policies, enforcement, and human review for high-severity reports.
User Reporting Tools	All in-scope services	Easy, accessible mechanisms for Singapore users to flag harmful content.
Child Safety by Design	Services likely accessed by minors	Default privacy, restricted DMs, and age-appropriate recommendations.
Scam & Fraud Controls	Platforms with commerce or advertising	Verification of advertisers, takedown of scam listings, anti-impersonation tools.
Transparency Reporting	Designated services	Public reports on takedowns, appeals, and enforcement outcomes.
Compliance with Directions	All providers	Act on IMDA takedown, restriction, or access-blocking directions within set timeframes.

New Features in the 2026 Act

1. A Dedicated Online Safety Commission

The Act establishes (or formalises) a central body to handle victim complaints, especially for harassment, doxxing, and intimate image abuse. Victims can seek rapid takedown orders without going through lengthy court proceedings.

2. Expanded Scam-Fighting Powers

Building on OCHA, the 2026 Act gives authorities broader ability to:

Order platforms to disable scam accounts and ads.
Require payment and messaging services to implement anti-scam friction (warnings, cooling-off periods).
Mandate link-scanning and URL reputation checks on major messaging platforms.

3. Deepfake and Synthetic Media Rules

Platforms must label or restrict synthetic media that could mislead users, particularly around elections, financial products, and public officials.

4. App Store Accountability

App stores must take reasonable steps to prevent scam apps, enforce age ratings, and respond to IMDA directions targeting specific listings.

5. Stronger User Rights

Right to appeal moderation decisions.
Right to request removal of specified personal content causing harm.
Right to information about how recommender systems use their data.

Penalties and Enforcement

Non-compliance carries meaningful consequences. While exact figures depend on the final subsidiary legislation, the framework includes:

Financial penalties up to S$1 million per breach for serious violations by designated services, with additional daily fines for ongoing non-compliance.
Access blocking orders directing local internet access service providers to restrict non-compliant services.
App store removal directions for apps that repeatedly facilitate harm.
Potential criminal liability for individuals who knowingly disseminate egregious content or obstruct investigations.

IMDA typically follows a graduated approach: informal engagement, formal directions, financial penalties, then access blocking. However, for child safety and terrorism content, enforcement can be immediate.

What the Act Means for Businesses in Singapore

For Social Platforms and Online Communities

If you run a forum, community site, or user-generated content platform with meaningful Singapore reach, you need documented content policies, functional reporting tools, and a point of contact for regulatory directions.

For E-commerce and Marketplaces

Expect tighter scrutiny of seller verification, product listings, and ad placements. Marketplaces should invest in automated fraud detection and clear escalation paths for scam reports.

For Digital Marketers and Agencies

Advertising networks and agencies running Singapore campaigns should ensure landing pages, creatives, and tracking links comply with scam and misleading content rules. Using a reputable, transparent link management platform matters: when you share campaign URLs, destination transparency and safe-browsing checks reduce the chance of your links being flagged or blocked. Privacy-first tools like Lunyb focus on clean, trackable short links without aggressive data harvesting — see our honest review of Lunyb for more context.

For SaaS and App Developers

If your app targets or is likely to be used by minors, implement age-appropriate defaults, parental controls where relevant, and clear data minimisation. Prepare documentation of your child safety design choices.

Compliance Checklist: Preparing for the 2026 Act

Map your exposure. Confirm whether your service is likely to be designated, in-scope but undesignated, or out of scope.
Conduct a harms risk assessment. Review each harm category and document mitigations.
Update terms and community guidelines. Make prohibited content and consequences explicit.
Build or upgrade reporting tools. Ensure Singapore users can report harm in no more than two or three taps.
Appoint a Singapore compliance contact. Required for responding to IMDA directions within tight deadlines.
Implement child safety defaults. Private accounts for minors, limited DMs, and restricted recommendations.
Add scam controls. Link scanning, advertiser verification, and warning interstitials.
Prepare transparency reports. Track takedowns, response times, and appeal outcomes.
Train your moderation team. Especially on local sensitivities (racial, religious, political).
Audit your vendor stack. URL shorteners, analytics, hosting, and CDN providers should align with your safety and privacy posture.

How the Act Interacts with Other Singapore Laws

PDPA (Personal Data Protection Act) – continues to govern how user data is collected and used; safety measures must respect data minimisation.
POFMA – remains in force for falsehoods affecting public interest.
OCHA – powers around criminal online harms are now more tightly integrated.
Cybersecurity Act – governs critical information infrastructure; some overlaps with scam and malware duties.

Together, these laws form a layered framework: PDPA protects data, the Online Safety Act protects users from content and conduct harms, and OCHA and the Cybersecurity Act address criminal and infrastructural threats.

What It Means for Everyday Users

For individuals in Singapore, the 2026 Act should translate into:

Faster takedowns of harassment, intimate image abuse, and scam content.
Clearer reporting flows on major platforms.
More visible warnings on suspicious links and synthetic media.
Better defaults for children and teens using social apps.

Users can still strengthen their own safety by using encrypted DNS resolvers, keeping devices updated, enabling two-factor authentication, and being cautious with links shared via SMS or messaging apps. Checking shortened links through a trusted preview tool before clicking is a simple but powerful habit.

Common Misconceptions

"The Act only applies to big tech."

False. While designated services face the strictest duties, smaller platforms accessible to Singapore users can still receive directions and penalties.

"It regulates private messages."

Largely false. The Act focuses on public and semi-public communications. Private one-to-one messages remain protected, though platforms must still act on reported content and scam patterns.

"Compliance means heavy censorship."

Not quite. The Act targets specific, defined harms. Robust moderation, transparent appeals, and user rights are built into the framework to prevent overreach.

Looking Ahead

Singapore's approach in 2026 signals a maturing regulatory environment: outcome-focused, risk-based, and increasingly aligned with international standards while retaining distinct local priorities. For businesses, early investment in safety-by-design will be far cheaper than reactive compliance after a direction or penalty.

Expect further subsidiary legislation, updated Codes of Practice, and periodic designations of new services throughout 2026 and 2027. Staying close to IMDA announcements and industry consultations is the best way to keep ahead.

Frequently Asked Questions

1. When does the Singapore Online Safety Act 2026 take effect?

Key provisions are rolling out through 2026, with transitional periods for certain duties such as risk assessments and transparency reporting. Designated services typically receive a specific commencement notice from IMDA.

2. Does the Act apply to overseas platforms?

Yes. The Act has extraterritorial reach. Any online service accessible to Singapore end users that meets the relevant thresholds can be designated and required to comply, regardless of where it is headquartered.

3. What happens if a platform ignores an IMDA direction?

Non-compliance can lead to significant financial penalties, access blocking by Singapore internet access providers, and removal from local app stores. Repeat offenders face escalating consequences.

4. How does the Act protect children online?

Platforms likely to be accessed by minors must implement child safety by design: private defaults, restricted messaging from strangers, age-appropriate content recommendations, and clearer tools for reporting bullying or exploitation.

5. What should small businesses do right now?

Start with three steps: (1) review whether your service hosts user-generated content accessible in Singapore, (2) document your moderation and reporting processes, and (3) audit your digital vendors — including analytics, hosting, and link management — to ensure they align with safety and privacy expectations.

This article is for general informational purposes and does not constitute legal advice. For specific compliance questions, consult qualified Singapore legal counsel.