Online safety & content laws in Andorra (2026)

The Andorran Data Protection Agency formally delivered legislative observations to the General Council proposing amendments to the Penal Code, including extending identity-usurpation offences to synthetic media and fake digital profiles, introducing AI as an aggravating factor, and strengthening corporate liability for online privacy violations. The submission marks a shift from reactive enforcement to proactive legislative shaping by the regulator.

Andorra hosted the second edition of the Andorra Forum, with 30 October dedicated to child online protection in partnership with the International Telecommunication Union (ITU); the Council of Europe's Deputy Secretary General underlined that AI-driven harms to children require cross-border cooperation with no room for jurisdictional gaps. The forum is a standing platform launched in 2024 within Andorra's Digital Transformation Programme 2024-2027.

At the informal Council of Europe Ministers of Justice conference in Vilnius, Andorra signed the Framework Convention on Artificial Intelligence and Human Rights, Democracy, and the Rule of Law, the first legally binding international AI treaty. Signatories must ensure AI systems respect fundamental rights and democratic processes, with direct implications for algorithmic content moderation and automated online decision-making.

New cookie guidelines issued by the Andorran Data Protection Agency took effect, requiring freely given, specific, and unambiguous consent before activating non-essential cookies across websites, mobile applications, IoT devices, smart TVs, and connected vehicles. The rules operationalise the LQPD's consent requirements for the full ecosystem of online tracking.

The General Council approved Law 22/2022 on measures for the security of networks and information systems, modelled on EU Directive 2016/1148 (NIS). The law created mandatory security obligations for critical operators, mandated incident reporting to authorities, and established the National Cybersecurity Agency (ANC) and CSIRT-AD as the country's national cyber-incident response infrastructure.

At the Council of Europe Ministerial meeting in Turin, Andorra became the 23rd signatory to the Second Additional Protocol to the Budapest Convention on Cybercrime, which establishes common cross-border rules for disclosure of electronic evidence and direct cooperation with service providers in criminal investigations. Ratification will make cross-border cybercrime investigations significantly more efficient.

The General Council enacted the Qualified Personal Data Protection Law, a comprehensive overhaul aligning Andorra with EU GDPR principles and Directive 2016/680 for law enforcement data. The law granted data subjects rights of access, rectification, erasure, portability, and objection to automated decision-making, and repositioned the APDA as a fully independent supervisory authority.

Andorra enacted Law 31/2018 establishing a comprehensive framework for information society services and e-commerce, mandating transparency in online transactions, codifying liability rules for intermediary service providers, and strengthening consumer protection in digital markets. It superseded earlier piecemeal provisions on digital operators.

Three years after signing, Andorra formally ratified the Council of Europe Budapest Convention on Cybercrime, binding itself to criminalise illegal access, data interference, computer fraud, and online child sexual abuse material, and to provide mutual legal assistance to other parties in cybercrime investigations.

Andorra enacted its foundational personal data protection statute, Law 15/2003, creating basic rules for data processing and establishing initial supervisory oversight. Though eventually superseded by the 2021 LQPD, it provided the country's first legal basis for online privacy rights and laid the institutional groundwork for what would become the APDA.