Online safety & content laws in El Salvador (2026)

The Legislative Assembly approved a 'foreign agents' law requiring individuals and organizations receiving international funding to register with the Interior Ministry and pay a 30% tax on those funds. The CPJ, HRW, and Amnesty International warned the law's vague, broad language empowers authorities to surveil, fine, or shut down independent online media and NGOs that report on government conduct.

El Salvador's Legislative Assembly approved Decreto 143 (Cybersecurity and Information Security Law) and Decreto 144 (Personal Data Protection Law), published in the Official Gazette November 15 and effective November 23. Decreto 143 created the State Cybersecurity Agency (ACE) under a presidential appointee; Decreto 144 established data subject rights and a sweeping 'right to be forgotten' that critics — including Human Rights Watch — say grants the executive undue power to order removal of news articles and public-interest content from the internet.

President Bukele proclaimed a state of exception in response to gang violence (renewed over 41 times through 2025), suspending rights to counsel and assembly. Separately, 2022 reforms to the Criminal Procedure Code granted the Attorney General's Office sweeping authority to conduct undercover digital monitoring — including interception of private communications — without a court warrant and without restrictions on scope or duration, raising serious concerns about surveillance of journalists and opponents.

Citizen Lab, Access Now, and Amnesty International's Security Lab published verified forensic findings that 35 Salvadoran journalists, activists, and civil society figures — including 22 El Faro staff infected 226 times — had their phones compromised with NSO Group's Pegasus spyware between July 2020 and November 2021. The government denied responsibility; the Inter-American Commission on Human Rights subsequently held hearings on the case, making it one of the largest known Pegasus operations against the press worldwide.

El Salvador's Legislative Assembly enacted its first dedicated cybercrime statute, Decreto 260, published in the Diario Oficial No. 40 on February 26, 2016. The law criminalized unauthorized system access, cyber fraud, identity theft, data manipulation, espionage, and unlawful disclosure of confidential data, with penalties from one to twelve years' imprisonment, establishing the country's primary instrument for online criminal prosecution for nearly a decade.

El Salvador replaced its state telecommunications monopoly with a liberalized, competition-based system through Decreto Legislativo No. 142, published in Official Gazette No. 218. The law created the General Superintendency of Electricity and Telecommunications (SIGET) as the independent sector regulator and required only a concession for public telephone service, forming the foundational institutional and legal infrastructure that would subsequently govern internet service provision across the country.