Online safety & content laws in Costa Rica (2026)

Costa Rica deposited its instrument of ratification for CETS No. 224 on enhanced co-operation and disclosure of electronic evidence, becoming the fourth country globally to ratify. The protocol expands cross-border access to electronic evidence and direct cooperation with service providers for cybercrime investigations.

The Costa Rican legislature advanced a bill prohibiting children under 14 from accessing mainstream social platforms and requiring platforms to disable addictive design features (infinite scroll, autoplay, dark patterns) for all users under 18. SUTEL would oversee enforcement with fines of 15–50 base salaries for non-compliant platforms.

The Ministry of Science, Innovation, Technology and Telecommunications published Costa Rica's second national cybersecurity strategy, building directly on lessons from the 2022 ransomware crisis. The five-pillar framework covers governance, legal reform, risk management, a national security culture, and international cooperation.

In the immediate aftermath of the 2022 ransomware crisis, Costa Rica's representative signed the Second Additional Protocol on enhanced co-operation and disclosure of electronic evidence, signalling commitment to stronger cross-border law enforcement cooperation on cybercrime.

The Hive ransomware group struck the Costa Rican Social Security Fund (CCSS) on May 31, 2022, compromising 759 servers and more than 10,400 computers and forcing cancellation of over 30,000 medical appointments. The attack on critical public health infrastructure came just weeks after the Conti emergency and demonstrated systemic vulnerability across state institutions.

Costa Rica deposited its instrument of accession to the Council of Europe's Budapest Convention on Cybercrime, becoming one of only three Central American states party to the treaty. Ratification gave law enforcement access to the T-CY network for real-time cross-border cooperation and aligned domestic law with international cybercrime standards.

President Laura Chinchilla signed Law 9048, overhauling the Penal Code's cybercrime section to criminalise system intrusion, malware deployment, cyber-espionage, disclosure of government secrets via ICT, and social-media impersonation, with sentences of five to ten years. The law raised controversy over potential restrictions on press freedom but was ultimately upheld.

Published in La Gaceta on 5 September 2011, Law 8968 established Costa Rica's first comprehensive personal data protection framework and created the independent Agency for the Protection of Personal Data of the Inhabitants (PRODHAB) as enforcement authority, empowered to investigate complaints, impose fines of $3,000–$18,000, and suspend non-compliant databases.

Law 8934 required operators of public internet access facilities to install content-filtering software blocking pornography, drug content, and other material harmful to children and adolescents, with SUTEL assigned oversight responsibilities. It became the foundational child-safety internet law and a direct precursor to later social-media regulation proposals.

In ruling 2010-012790, Costa Rica's Constitutional Chamber declared internet access a constitutionally protected fundamental right, holding that the State must promote and guarantee universal ICT access as essential to free expression, education, and democratic participation. It was the first such ruling in Latin America and legally obligated the government to expand connectivity.