Internet & Online Safety · El Salvador
Online safety & content laws in El Salvador (2026)
El Salvador shaded by its internet & online safety status
El Salvador's online safety regime is fragmented across three instruments: a cybercrime law operative since 2016 (significantly reformed effective July 2025), a Cybersecurity and Information Security Law that established the autonomous State Cybersecurity Agency (ACE, in force 23 November 2024), and a Personal Data Protection Law (November 2024). No comprehensive online-safety or platform-liability framework comparable to the EU Digital Services Act or UK Online Safety Act exists; age-verification mandates for social media and structured content-moderation obligations are absent.
Key points
The Ley Especial Contra Delitos Informáticos y Conexos (2016) criminalises unauthorised system access, computer fraud, data manipulation, and identity theft, with penalties of 1–12 years. Legislative Decree No. 332 (effective 3 July 2025) raised computer-fraud penalties to 10–12 years and extended direct-victim standing to data-custodian entities.
Enacted 12 November 2024 and in force from 23 November 2024, this law creates the autonomous ACE (director appointed by the president), requires critical-infrastructure operators to adopt cybersecurity management systems aligned with the National Cybersecurity Policy, and imposes three-tier administrative sanctions for infringements.
Also enacted 12 November 2024, the law regulates personal-data processing and cross-border transfers under a consent framework. It includes a 'right to be forgotten' provision that Human Rights Watch and the OAS Special Rapporteur for Freedom of Expression have warned grants the ACE overly broad powers to order deletion of online content, potentially suppressing criticism of public officials.
El Salvador has enacted no law equivalent to the EU DSA or UK OSA. There are no legislated platform content-moderation obligations, no structured intermediary-liability safe harbours, and no age-verification mandates for social media platforms. Latin America broadly lacks settled intermediary-liability rules, and El Salvador is no exception.
Freedom House (2025) and the Committee to Protect Journalists document use of Pegasus spyware against at least 35 journalists (2020–2021), state-of-emergency surveillance powers deployed against government critics since March 2022, and government-affiliated disinformation/troll campaigns — indicating practical constraints on online expression beyond the formal legal framework.
El Salvador has not enacted dedicated age-verification requirements for social media or standalone children's online safety legislation. Protections for minors online derive only from general data-protection provisions in the 2024 Personal Data Protection Law.
El Salvador - other topics
Last verified 5/24/2026 · Orientation, not legal advice - verify against the primary sources linked above. Explore the full world map →