Online safety in Czechia: the EU Digital Services Act (2026)

After a formal notice (April 2024) and reasoned opinion (October 2024) went unanswered, the European Commission referred Czechia to the Court of Justice of the EU for failing to grant the Czech Telecommunications Office sufficient enforcement powers as Digital Services Coordinator and for failing to adopt national penalty rules required under the DSA — a legally binding obligation that should have been met by 17 February 2024.

The Czech Council of Ministers approved a bill on the digital economy adapting EU Regulation 2022/2065 (DSA) and Regulation 2022/868 (DGA) into national law, empowering CTU as Digital Services Coordinator with penalty-setting authority over illegal online content and platform obligations; the bill was submitted to the Chamber of Deputies on 12 December 2025 and remained pending enactment as of early 2026.

Act No. 264/2025 Coll., signed June 2025 and published in the Czech Collection of Laws on 4 August 2025, repealed the 2014 Cybersecurity Act and fully transposed the EU NIS2 Directive; it dramatically expanded the regulated population from roughly 400 to an estimated 6,000–15,000 entities across 18 sectors and imposed stricter incident-reporting timelines, supply-chain security requirements, and top-management accountability, with NÚKIB as the central enforcer.

The EU Digital Services Act became fully applicable to all in-scope online intermediaries on 17 February 2024, with the Czech Telecommunications Office (CTU) designated by government order as the national Digital Services Coordinator responsible for handling user complaints, cooperating with the European Commission, and overseeing DSA compliance by smaller platforms operating under Czech jurisdiction.

The landmark EU Digital Services Act entered into force, establishing a harmonised framework for illegal-content removal obligations, algorithmic transparency, targeted-advertising restrictions, and risk-assessment requirements for very large online platforms and search engines; Czech platforms and the CTU began preparing for compliance obligations that would become fully mandatory in February 2024.

An amendment to the Electronic Communications Act (adopted by the Chamber of Deputies on 15 September 2021) took effect, replacing the previous opt-out cookie model with a strict opt-in requirement: websites must obtain free, specific, informed, and unambiguous user consent before storing any non-essential cookies, aligning Czech law with the EU ePrivacy Directive and the GDPR framework enforced by ÚOOÚ.

Czechia enacted a dedicated Video-Sharing Platform Services Act transposing the revised EU Audiovisual Media Services Directive (2018/1808), requiring platforms such as YouTube and TikTok to implement age-verification, parental-control tools, standardised content-rating labels, and at least 30% European works quotas, with the Council for Radio and Television Broadcasting (RRTV) as the supervisory authority.

Act No. 110/2019 Coll. replaced the outdated 2000 data-protection law and formally adapted Czech legislation to the EU GDPR, empowering the Office for Personal Data Protection (ÚOOÚ) to conduct audits, issue binding orders, and impose administrative fines for breaches affecting online users; Czechia was among the last EU member states to enact its GDPR adaptation law.

Act No. 205/2017 Coll. amended the 2014 Cybersecurity Act to create the National Cyber and Information Security Agency (NÚKIB) as an independent central administrative body for cybersecurity, taking over the regulatory and supervisory role from the National Security Authority (NBÚ) and becoming the primary regulator for online infrastructure security, incident response, and national cyber strategy.

Czechia enacted its first standalone cybersecurity statute, imposing mandatory security obligations and incident-reporting duties on operators of critical information infrastructure, significant networks, and public-administration information systems; it established the regulatory and audit framework that governed online infrastructure security for over a decade until replaced by the NIS2-transposing Act No. 264/2025.

The Czech Parliament approved the Electronic Communications Act, establishing the Czech Telecommunications Office (CTU) as the independent national regulator for electronic communications, laying the foundational legal framework for internet service provision, net neutrality, spectrum management, and consumer protection that underpins all subsequent Czech internet-safety and digital-services regulation.