Online safety & content laws in Ecuador (2026)

After overcoming a partial presidential objection resolved by 83 assembly votes, Ecuador's comprehensive cybersecurity law was published in the Fifth Supplement of Official Registry No. 290 and entered into force. It establishes national digital-security standards, legally enables ethical hacking and penetration testing, mandates cybersecurity education in school curricula, strengthens CSIRT-Ecuador under the Ministry of Telecommunications, and sets incident-notification requirements for critical-infrastructure operators.

Ecuador's legislature passed the Proyecto de Ley Orgánica para el Fortalecimiento de la Ciberseguridad, creating a specialized regime for digital security, critical-infrastructure protection, and inter-institutional coordination between the Ministries of Government and Telecommunications and the National Police. The bill then faced a partial presidential objection before final promulgation.

A ruling-party legislator submitted a proposal citing national-security grounds — approximately 27% of minors recruited by criminal organizations report first contact via social media — rather than the mental-health framing typical in other countries. The bill would fine non-compliant platforms up to 5% of local annual revenue; as of early 2026 it remained under committee review.

President Noboa signed the implementing regulation to Ecuador's data-protection law, detailing procedures for data-subject rights (access, rectification, deletion, portability), governance of the Superintendencia de Protección de Datos Personales, and compliance obligations for data controllers and processors — completing the LOPDP's operational framework.

The National Assembly passed the LOPDP, Ecuador's first comprehensive data-protection statute, granting data subjects rights of access, rectification, deletion, and portability; requiring data-security safeguards; and creating the independent Superintendencia de Protección de Datos Personales. The law was catalyzed by the 2019 Novaestrat mass breach and modeled closely on the EU GDPR.

Security researchers at vpnMentor disclosed an unsecured Elasticsearch server belonging to analytics firm Novaestrat containing personal, financial, and vehicle records for more than 20 million people — effectively the entire Ecuadorian population including 6.7 million children. The company's legal representative was arrested on 16 September 2019; the incident was the direct catalyst for fast-tracking the LOPDP.

A sweeping amendment to the 2013 Organic Communication Law removed or softened content-control provisions widely criticized as censorious under the Correa government, introduced voluntary media self-regulation codes, and redefined national production. The reform significantly reduced the powers of the Superintendency of Communication (SUPERCOM) over online content.

The Electronic Frontier Foundation revealed leaked agreements between ARCOTEL and the internet-provider association AEPROVI (dating to 2012) documenting a non-transparent domain-blocking mechanism operated outside any judicial process. The disclosure triggered international condemnation and scrutiny of Ecuador's internet-freedom record.

Ecuador's new penal code (Registro Oficial Suplemento No. 180) introduced the country's first statutory cybercrime provisions covering unauthorized system access, data interception, and computer fraud. Civil society successfully defeated a proposed Article 474 that would have required ISPs to retain all user-activity logs for six months, averting mass surveillance.

Ecuador's first comprehensive media and content regulation law established the Superintendency of Communication (SUPERCOM) and the Communication Council (CORDICOM), mandated content quotas and standards, and gave ARCOTEL authority to block internet domains violating national law. Social-media posts and personal blogs were explicitly excluded from administrative control; internet-based media registered in Ecuador were held to the same obligations as broadcast outlets.

Ecuador's new constitution (promulgated 20 October 2008) guaranteed all persons the right to seek, receive, exchange, produce, and disseminate truthful information and enshrined universal access to information and communications technologies — providing the constitutional basis for all subsequent internet-safety, data-protection, and cybersecurity legislation.