Online safety & content laws in Estonia (2026)

Amendments to Estonia's Cybersecurity Act (bill passed by Riigikogu on 10 December 2025) transposing the EU NIS2 Directive entered into force, expanding covered organisations from roughly 3,500 to 6,500 and requiring self-registration with CERT-EE by 1 April 2026. Estonia missed the EU's October 2024 deadline by over a year.

Amendments to Estonia's Information Society Services Act and related laws implementing the EU Digital Services Act entered into force, designating TTJA (Consumer Protection and Technical Regulatory Authority) as Estonia's national Digital Services Coordinator responsible for receiving DSA complaints and cross-border enforcement. The European Commission had earlier opened infringement proceedings against Estonia and five other member states for insufficiently empowering their DSCs.

Estonia experienced its most significant denial-of-service attack in history: nearly three billion malicious requests in just over four hours targeted public-sector websites, demonstrating the continued cyber threat to national digital infrastructure and validating Estonia's ongoing investment in resilience through CERT-EE.

Amendments to the Cybersecurity Act and Information Society Services Act (approved by parliament July 2022, in force August 2022) explicitly empowered TTJA to order removal or blocking of online content inciting hatred, violence, or discrimination, or justifying war crimes, when necessary for national security — enacted in direct response to Russian information operations following the invasion of Ukraine.

Estonia's Media Services Act transposed the revised EU Audiovisual Media Services Directive, extending content-safety regulation to video-sharing platforms (YouTube, Vimeo, Dailymotion) for the first time, with obligations to protect minors from harmful content and the general public from hate speech, illegal content, and child sexual abuse material.

Estonia adopted EU Directive 2019/790 into national law, establishing ancillary copyright for digital news publishers and making online content-sharing platforms partially liable for user-uploaded copyright infringements — significantly altering platform obligations for major services operating in Estonia.

Estonia's updated Personal Data Protection Act entered into force, supplementing GDPR with national rules governing online data processing, defining the powers of the Data Protection Inspectorate, and establishing enforceable privacy rights for users of internet services — a core pillar of online safety for Estonian residents.

The Riigikogu passed Estonia's Cybersecurity Act, transposing the EU NIS Directive and imposing mandatory risk-based security measures and cyber-incident notification obligations on operators of essential services and digital service providers, with RIA and CERT-EE designated as national supervisory and response authorities.

By 15 votes to 2, the European Court of Human Rights Grand Chamber upheld Estonian courts' finding that news portal Delfi was civilly liable for hateful anonymous user comments, establishing a landmark European precedent that commercially operated news portals can bear primary liability for seriously unlawful user-generated content and shaping Estonia's intermediary liability framework.

Weeks of coordinated DDoS attacks overwhelmed Estonian government, parliamentary, banking, and media websites — the first recognised large-scale cyber campaign targeting an entire nation-state. The attacks catalysed Estonia's cyber defence architecture, prompted NATO to establish the Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn, and established online security as a national security priority.

Estonia enacted the Information Society Services Act (in force 1 May 2004), transposing EU Directive 2000/31/EC and establishing the foundational legal framework for online service providers — including intermediary liability exemptions for hosting, caching, and mere-conduit services that still underpin Estonia's online safety and content-moderation regime today.