Online safety & content laws in Albania (2026)

Albania's Constitutional Court declared the government's one-year TikTok ban unconstitutional, finding it violated freedom of expression and press freedom. The ruling came shortly after the ban expired in February 2026 and established important constitutional limits on executive authority to block platforms.

Albania's Council of Ministers decision blocking TikTok took effect, requiring ISPs to block access nationwide, making Albania the first European country to impose a full platform-level ban on a major social media app. The government pledged to use the period to negotiate child-safety controls with TikTok.

Prime Minister Edi Rama announced a one-year national ban on TikTok after a 14-year-old was stabbed to death following a social media dispute, citing the platform's role in fuelling youth violence. The decision was challenged by opposition politicians and journalists as a disproportionate curb on free expression.

Parliament enacted a comprehensive new data protection law fully aligned with the EU GDPR (Regulation 2016/679) and the Law Enforcement Directive, repealing the 2008 Law No. 9887. The law, published in the Official Gazette on 17 January 2025, expanded the powers of the independent Commissioner for the Right to Information and Protection of Personal Data.

Parliament approved a new electronic communications law replacing the 2008 framework and transposing EU Directive 2018/1972 (the European Electronic Communications Code). The law strengthened AKEP's regulatory mandate and updated spectrum management, net neutrality, and consumer-protection rules for internet services.

A new comprehensive cybersecurity law replacing Law 2/2017 entered into force after publication in the Official Gazette, mandating incident reporting for operators of critical and important information infrastructure and introducing administrative fines up to ALL 10 million (≈€90,000). The law aligns Albania with the EU NIS2 Directive and is overseen by the national authority AKSK.

Albania became the 36th state to sign the Budapest Convention's Second Additional Protocol on enhanced cooperation and disclosure of electronic evidence, committing to streamlined cross-border access to e-evidence for criminal investigations. Legislative harmonisation work with the Protocol began in November 2024 under the EU-CoE CyberSEE project.

Albania expelled Iranian diplomats and cut diplomatic relations in direct response to the July 2022 state-sponsored cyberattack, the first time any country has severed diplomatic ties specifically because of a cyberattack. The US Treasury simultaneously sanctioned Iran's Ministry of Intelligence and Security for its role in the attack.

Iranian state-sponsored threat actors (acting as 'HomeLand Justice') deployed ransomware and disk-wiping malware against Albanian government networks, disabling public-facing e-government services for weeks. The FBI and CISA jointly attributed the attack to Iran's Ministry of Intelligence and Security, marking a landmark moment in state-sponsored cyber operations against a NATO member.

Decision No. 1084 approved Albania's first multiyear national cybersecurity strategy, covering legislative harmonisation, critical infrastructure protection, capacity building, and, for the first time in any Albanian policy document, a dedicated chapter on children's online safety. Coordination and implementation is assigned to AKSK/AKCESK.

Albania enacted its first dedicated cybersecurity law, formally defining critical and important information infrastructure categories and imposing mandatory incident-reporting obligations on their operators. The law established the National Authority for Electronic Certification and Cyber Security (AKCESK/AKSK) as the national competent authority and government CSIRT.

Parliament adopted a comprehensive electronic communications law replacing the 2000 Telecommunications Law, establishing AKEP (Electronic and Postal Communications Authority) as the independent sector regulator and setting rules on data retention, lawful interception, confidentiality of communications, and licensing for internet service providers.

Albania enacted its first dedicated personal data protection law, creating the independent Commissioner for the Right to Information and Protection of Personal Data with powers to investigate, issue guidance, and impose sanctions on online and offline data processors. The law followed Council of Europe Convention 108 standards.

Albania's Parliament ratified the Council of Europe's Budapest Convention on Cybercrime, one of the earliest countries to do so after signing at the opening ceremony in November 2001. The ratification committed Albania to criminalising computer intrusion, data interference, and device misuse, and set the international legal foundation for all subsequent cybercrime and online-safety legislation.