Online safety & content laws in Georgia (2026)

Passed by parliament on 1 April 2025 and signed the next day, the FARA came into legal force on 1 June 2025. It requires media outlets and civil-society organisations receiving over 20% foreign funding to register as 'foreign agents,' label all online publications accordingly, and face up to five years' imprisonment for non-compliance — escalating the 2024 foreign-influence law's administrative-fines-only regime into criminal territory.

Passed on 17 September 2024 and signed on 3 October 2024, this legislation bans online and broadcast content depicting same-sex relationships, restricts LGBTQ+ 'propaganda' in education and public spaces, and empowers the Georgian National Communications Commission (ComCom) to enforce the content ban against online platforms — materially extending state content-regulation to the internet.

Parliament adopted amendments to the Law of Georgia on Broadcasting, shifting authority over hate speech, incitement to terrorism, and obscenity from media self-regulatory bodies to the Georgian National Communications Commission (GNCC/ComCom). The change was widely criticised for concentrating content-regulation power in a government-aligned regulator without sufficient editorial independence.

Parliament replaced the previous personal data protection statute with a modernised law structured around EU GDPR principles, establishing lawful-basis requirements, expanded data-subject rights, and updated rules on cross-border transfers for online services. Further amendments aligning with EU standards came into force on 1 March 2024.

A mass web-defacement attack — attributed with high confidence to a nation-state actor by the Carnegie Endowment for International Peace — took down or defaced roughly 15,000 Georgian websites in a single day, including government agencies, courts, TV stations, and commercial banks. The attack exposed critical gaps in national cyber-resilience and intensified calls for centralised incident-response capacity.

The amended Constitution of Georgia, which entered into force in December 2018, added Article 17 guaranteeing that 'everyone has the right to access and freely use the internet.' Georgia became one of the first countries worldwide to elevate internet access to constitutional status, providing a legal basis for challenging disproportionate online restrictions.

Following the April 2016 Constitutional Court ruling, parliament enacted new surveillance legislation on 31 March 2017 and established the Operative Technical Agency (OTA) under the State Security Service to manage lawful-interception infrastructure. The reform abolished the prior 'two-key' direct-access system, shifted judicial authorisation to the Supreme Court, and granted the Personal Data Protection Inspector oversight of surveillance legality.

On 14 April 2016, Georgia's Constitutional Court ruled that mandatory two-year metadata retention by ISPs and unrestricted real-time access to telecommunications networks by security agencies were unconstitutional. The court set 31 March 2017 as the deadline for parliament to enact a compliant replacement framework, directly triggering the 2017 surveillance reform.

By Decree No. 8 of the Defence Minister, the Legal Entity of Public Law (LEPL) Cyber Security Bureau commenced operations on 28 February 2014 as Georgia's first national CERT, mandated under the 2012 Law on Information Security to manage cybersecurity incidents across state and critical-infrastructure information systems.

Georgia's foundational cybersecurity statute — adopted by parliament and in force from 1 July 2012 — established legal obligations for protecting state and critical-infrastructure information systems, defined agency responsibilities, and mandated the creation of a national computer emergency response team (CERT). Substantive amendments followed in December 2013.

Parliament enacted the Law on Freedom of Speech and Expression (adopted 17 June 2004, promulgated 15 July 2004), providing that no entity would be held liable for defamatory or other harmful content generated by unknown or anonymous online users. This became the foundational statutory norm protecting Georgian ISPs and online platforms from content-based liability.