Online safety & content laws in Ethiopia (2026)

Ethiopia enacted its first comprehensive personal data protection law, approved by parliament on 4 April 2024 and gazetted on 24 July 2024. The law grants individuals rights to access, rectify, erase and restrict processing of their data, mandates domestic data storage by default, and designates the Ethiopian Communications Authority (ECA) as the enforcement regulator — completing a foundational pillar of the online-safety framework.

Mobile internet services were gradually restored in 19 cities in Amhara region — including Bahir Dar, Gondar and Dessie — ending an 11-month shutdown imposed since August 2023. Connection speeds remained slow and inconsistent; the blackout had ranked Ethiopia second globally in internet-shutdown economic losses (est. $1.9 billion for 2023 per Top10VPN).

Authorities blocked Facebook, TikTok, Instagram, Telegram and YouTube across Ethiopia following tensions involving the Ethiopian Orthodox Tewahdo Church; YouTube was added the next day. The shutdown lasted approximately five months and cost the economy an estimated $140 million, marking Ethiopia's eleventh forced internet disruption since 2015.

Ethiopia's parliament passed the country's first dedicated law targeting online hate speech and disinformation, triggered by deadly inter-ethnic violence linked to viral social-media content. Platforms must remove flagged content within 24 hours and develop internal compliance policies; the Ethiopian Broadcast Authority oversees enforcement. Human-rights groups warned the broad definitions risk suppressing legitimate speech and journalism.

Ethiopia's first comprehensive cybercrime law criminalised unauthorised computer access, data damage, cyber fraud, child pornography, cyber-terrorism and attacks on critical infrastructure with severe penalties. Internet service providers must retain all traffic data for at least one year and produce it on court or public-prosecutor order, laying the legal basis for state-mandated data retention.

The law criminalised the use of VoIP services (Skype, Google Talk) and extended the Anti-Terrorism Proclamation's reach to electronic communications, making intercepted digital evidence expressly admissible in court. Press-freedom groups condemned it as extending the state's online surveillance powers far beyond fraud prevention.

The Council of Ministers created INSA by Regulation No. 130/2007 as Ethiopia's national signals-intelligence and cybersecurity agency, mandated to protect critical information infrastructure from electronic attack. INSA became the operational centrepiece of internet control, deploying commercial spyware to monitor dissidents, journalists and activists and coordinating with the Ethio Telecom monopoly to implement content filtering and shutdowns.

The 1994 Constitution enshrined the right to privacy of all postal and electronic communications under Article 26, establishing the foundational constitutional norm against which all subsequent internet-surveillance and content-regulation laws would be benchmarked — and frequently found deficient by human-rights bodies.