The Online Safety (Miscellaneous Amendments) Act and Codes of Practice in Singapore

Report a live threat to the police. Do not wait for a takedown. When a social media app removes a post, people assume it is following the law. That is not true. Under Singapore's Online Safety Act codes of practice, large services face legal obligations, but a company's own moderation under its terms of use is a separate, voluntary act. The legal duties come from the Online Safety (Miscellaneous Amendments) Act 2022, which amended the Broadcasting Act 1994 (now the Broadcasting and Online Safety Act), and from the Code of Practice for Online Safety issued by the Infocomm Media Development Authority (IMDA). The Act lists social media services with at least 500,000 Singapore-based monthly active users as designated services. Those services, currently Facebook, Instagram, TikTok, X, YouTube, and HardwareZone, must comply with the Code or face directions with legal force. This page explains what the Code requires, how it differs from voluntary company rules, and where critics say it goes too far.

The Online Safety (Miscellaneous Amendments) Act 2022 did not create a new regulator. It amended the Broadcasting Act 1994 to give the Infocomm Media Development Authority (IMDA) powers to make codes of practice for online safety. The amended Act is now called the Broadcasting and Online Safety Act. The IMDA issued the Code of Practice for Online Safety on 18 July 2023, following a public consultation that closed on 19 October 2022. The Code applies to designated social media services: those with at least 500,000 monthly active users in Singapore. The IMDA has designated Facebook, Instagram, TikTok, X (formerly Twitter), YouTube, and the local forum HardwareZone. These services must comply with the Code's requirements or face directions from the IMDA, which are legally enforceable under Singapore law. The Act also gives the IMDA powers to issue directions to non-designated services in specific circumstances, but the Code itself targets the largest apps.

Mandatory User Reporting And Language Coverage

The Code of Practice for Online Safety imposes several distinct obligations on designated social media services. The most concrete is a mandatory user reporting mechanism: every designated service must provide a way for users in Singapore to report material that violates the service's own community standards or Singapore law. The service must respond to those user safety reports within 30 calendar days. The Code also requires moderation in Singapore's four official languages, English, Chinese, Malay, and Tamil. A service's moderation queue must handle reports in all four languages, not just English.

Proactive Detection And Parental Controls

The Code mandates proactive detection, but only for two categories: child sexual exploitation and abuse material (CSEAM) and terrorism material. For those categories, services cannot wait for a user report; they must actively identify and remove such material. Finally, designated services must provide parental controls for users under 18 and publish an annual online safety report by 30 June each year.

Beyond the Code's baseline requirements, the IMDA has statutory powers to issue directions. These are not suggestions. The IMDA can issue four types of directions under the Broadcasting and Online Safety Act: an account restriction direction (limiting or disabling a specific account), a content removal direction (requiring the removal of specific material), a service restriction direction (requiring the service to stop broadcasting to Singapore users), and an access blocking direction (requiring internet service providers to block the service). Critically, a content removal direction applies to material accessible by Singapore users even if it is hosted outside Singapore. This jurisdictional reach extends the IMDA's legal enforceability beyond the city-state's borders. The IMDA can issue these directions when material in the "egregious" categories, such as those involving child sexual exploitation, terrorism, or public health risks, is present and the service has failed to act.

For a user in Singapore, the most practical part of the Code is the mandated reporting mechanism. Every designated service must allow a user to report material the user believes violates the service's terms of use or Singapore law. The service must acknowledge the report and take action within 30 calendar days. What counts as "action" depends on the situation: the service may remove the material, label it, restrict its reach, or determine that it does not violate the service's rules. The Code does not require the service to remove the material; it requires the service to respond. This is a key distinction. Reporting material to a service is not the same as reporting a crime to the Singapore Police Force. Service reporting triggers a terms-of-use review; a police report initiates a legal process. They are different processes with different outcomes. The former may result in a post being removed; the latter may result in criminal charges under the Penal Code or the Protection from Harassment Act.

The IMDA does not have a fixed statutory interval for reviewing the Code. Instead, it reviews the Code periodically, and the version issued on 18 July 2023 is the one currently in force. Compliance is measured through the annual online safety report that each designated service must submit by 30 June. The report must detail the service's moderation actions, the number of user reports received, and the service's proactive detection efforts. Failure to comply with the Code or with an IMDA direction can result in a financial penalty of up to 10% of the service's annual turnover in Singapore. The IMDA can also issue an access blocking direction against an entire online service if it finds systemic non-compliance. This is a significant escalation: it means the service is not just removing a post but the entire service is blocked for Singapore users. The IMDA has not yet resorted to this remedy for a major app as of this writing, but the power exists in law.

A durable error in public discussion is the equivalence error: assuming that a service's removal of material is the same as a legal finding that the material is illegal. It is not. When a service removes a post for violating its terms of use, it is exercising voluntary moderation. The terms of use are a private contract between the user and the service. The service can remove material for any reason, or no reason at all, as long as it does not violate Singapore's anti-discrimination laws. The Code of Practice for Online Safety changes this by adding a layer of legal obligation on top of the voluntary rules. The Code requires the service to act on certain material, but it does not require the service to adopt any particular terms of use. The legal enforceability comes from the IMDA's directions, not from the service's own rules. A service that removes a post under its terms of use is not complying with Singapore law; it is complying with its own contract. The law applies when the IMDA issues a direction, and that direction has the full force of Singapore law behind it.

Other Laws Governing Online Material

The Online Safety Act and its Code are not the only online material laws in Singapore. The Protection from Online Falsehoods and Manipulation Act (POFMA) 2019 addresses disinformation, defined as false statements of fact that threaten public interest. POFMA has its own correction and takedown directions, which are separate from the IMDA's powers under the Broadcasting and Online Safety Act. The Protection from Harassment Act (POHA) 2014 covers online harassment, including doxxing. The Personal Data Protection Act (PDPA) 2012 regulates the collection, use, and disclosure of personal data, enforced by the Personal Data Protection Commission (PDPC).

The Online Criminal Harms Act

More recently, the Online Criminal Harms Act (OCHA) commenced on 1 February 2024, but it is not covered by the Code of Practice for Online Safety. OCHA is administered by the Ministry of Home Affairs and the Singapore Police Force and targets scams, malicious cyber activities, and other specified criminal offences. It has its own direction types, stop communication, disabling, access blocking, account restriction, and app removal, that operate under a different framework.

The Code has drawn criticism from civil liberties groups and academic commentators in Singapore. The core concern is over-removal. Because the Code requires services to act on "egregious" material and to respond to user reports within 30 days, services face an incentive to err on the side of removing material that might be protected speech. The Code's definitions of harmful material, particularly around terrorism and child sexual exploitation, are clear, but its broader categories, such as material that "undermines public health" or "threatens public safety", give services wide latitude. The Media Literacy Council, a Singapore charity that runs public education campaigns, has noted that over-removal risks suppressing legitimate speech. The IMDA's response is that the Code is content-neutral, applying the same rules to all designated services, and that services can appeal directions to the Minister. But critics point out that the appeal mechanism is not an independent court, and the IMDA is both the rule-maker and the enforcer.

Suppose a user in Singapore sees a video on TikTok that they believe is a scam, specifically, a phishing scam that impersonates a local bank. The user has two options. The first is to use TikTok's in-app reporting feature, which falls under the Code's user reporting mechanism. The user taps "Report," selects "Scam or fraud," and submits the video. TikTok must respond within 30 calendar days. The response might be a removal, a label, or a message that the video does not violate TikTok's terms of service. If TikTok fails to respond, the user can complain to the IMDA, which can issue a direction. The second option is to report the video to the Singapore Police Force's Anti-Scam Command by calling 1799 or using the ScamShield app. This is a police report, not a service report. It initiates a criminal investigation under the Penal Code. The police can seek a court order to remove the video or to disable the scammer's account, but this is a slower process than a service takedown. Do both: report to the app to get the material removed quickly, and report to the police to help prevent future scams.

The 30-calendar-day response requirement is a floor, not a ceiling. A service that takes 30 days to respond to a report of a suicide livestream has failed its obligation, even if it was within the limit. The Code's emphasis is on timely action, and the IMDA has said it expects shorter response times for emergency categories. In practice, major apps respond to urgent reports within 24 to 48 hours, but the Code does not mandate that. If the material is dangerous, do not wait for the service. Report it to the police immediately. The service's 30-day clock is a separate process. This is where the user safety reporting mechanism under Singapore law diverges from the service's own terms of use. A service's terms of use might promise a 24-hour response for urgent matters, but that is a voluntary promise. The Code's 30-day limit is a legal right. A user can cite the Code when complaining to the IMDA about a slow response, but the user cannot sue the service for missing the deadline. That right belongs to the IMDA.

The Code of Practice for Online Safety focuses on material that is reported or proactively detected. It does not address the underlying algorithmic curation that determines what material users see. This is a gap. The IMDA's code requires services to moderate material, but it does not require them to change the algorithms that amplify disinformation and malinformation. The result is that a service can comply with the Code, by removing reported material within 30 days, while its algorithm continues to promote the same category of material to a wider audience. The apps themselves have acknowledged that their algorithms optimise for engagement, not accuracy. An echo chamber is the predictable result. The Online Safety Act does not mandate any change to algorithmic curation. A bill to regulate algorithms was considered during the IMDA's consultation, but it was not included in the final Code. The IMDA has said it will review the issue, but as of this writing, no specific algorithmic transparency requirements exist for designated services in Singapore.

Designation is not permanent. The IMDA can review its designation decision, and a service can be added to or removed from the list. The current list, Facebook, Instagram, TikTok, X, YouTube, and HardwareZone, reflects the apps with the largest reach in Singapore, but the IMDA has not published a precise methodology for how it calculates the 500,000-user threshold. The Code says "monthly active users in Singapore," but the IMDA has not defined whether that means unique users, logged-in users, or some other metric. A service that falls below the threshold for six consecutive months can request a review of its designation. Conversely, the IMDA can designate a new service if it surpasses the threshold. The threshold itself is set in the Code, not the Act, so the IMDA can change it without a new Act of Parliament. The 500,000 figure is therefore a policy choice, not a legal necessity. It could be changed in a future Code revision, but the steps for that revision are not specified in the Act.

Every designated service must submit an annual online safety report to the IMDA by 30 June. The report must cover the service's moderation actions across the previous calendar year. Specifically, the Code requires the report to include: the total number of user reports received, broken down by category (child sexual exploitation, terrorism, scams); the number of reports actioned within 24 hours, 48 hours, 7 days, and 30 days; the number of items removed for violating the service's terms of use; and the number of items removed due to proactive detection. The report must also disclose the number of accounts suspended for repeated violations. These reports are public. The IMDA publishes them on its website. For a researcher or a concerned citizen, these reports are a source of data on service behaviour. They show whether a service is taking the Code seriously or merely going through the motions. The problem is that the reports are self-reported. The IMDA does not audit the numbers. A service could under-report its removal figures, and the IMDA would not know unless a member of the public flagged it.

None of this is a replacement for a human being exercising judgment. The Code of Practice for Online Safety is a legal instrument, but the vast majority of harmful material is never reported through the Code's mechanism. It is seen and shared by users who do not file a report. The most effective tool for reducing the spread of disinformation in Singapore is the accumulated digital literacy of the population. The IMDA's Code is a backstop, not a frontline defence. It catches the worst excesses, but it does not change the underlying incentives of attention-based apps. A user who understands how algorithmic curation creates an echo chamber is less likely to be fooled by a forwarded message, regardless of whether the app has removed it. The law has its role, but it is a narrow one. The real work is in the minds of readers.