Internet & Online Safety · Gibraltar
Online safety & content laws in Gibraltar (2026)
Gibraltar shaded by its internet & online safety status
Online safety rules in Gibraltar: partial.
FrameworkPatchwork: Electronic Commerce Act 2001 (intermediary/hosting liability, transposing the EU e-Commerce Directive), Communications Act 2006 (Gibraltar Regulatory Authority as sector regulator), Broadcasting Act 2012 (transposing the Audiovisual Media Services Directive, incl. On-Demand AVMS Code) and the Gibraltar GDPR / Data Protection Act 2004. No dedicated online-safety / content-moderation statute equivalent to the UK Online Safety Act 2023 or the EU Digital Services Act.
Gibraltar regulates online activity through a set of sectoral EU-legacy laws rather than a single dedicated online-safety regime. Platform/host liability follows the EU e-Commerce Directive rules transposed by the Electronic Commerce Act 2001 (a 'safe harbour' where the host lacks actual knowledge and acts expeditiously to remove unlawful content), while on-demand audiovisual providers are supervised by the Gibraltar Regulatory Authority under the Broadcasting Act 2012 / On-Demand AVMS Code. As a British Overseas Territory outside the EU and outside the UK's Online Safety Act 2023, Gibraltar has not enacted its own comprehensive duty-of-care regime or statutory age-verification/'legal-but-harmful' obligations for user-to-user platforms.
Key points
The Electronic Commerce Act 2001 transposes the EU e-Commerce Directive into Gibraltar law, giving hosts, caches and mere conduits a conditional liability exemption: a host is not liable for stored user content where it lacks actual knowledge of illegality and acts expeditiously to remove or disable access once notified.
The Gibraltar Regulatory Authority, constituted under the Gibraltar Regulatory Authority Act 2000 and empowered by the Communications Act 2006, regulates electronic communications, spectrum and broadcasting, and is tasked with promoting media literacy and public awareness of material published on electronic media.
The Broadcasting Act 2012 transposed the EU Audiovisual Media Services Directive; the GRA issues codes of practice including an On-Demand Audiovisual Media Services Code and a Code for Broadcasters covering standards, protection of minors, impartiality and election/referendum content.
Following Brexit, the GDPR was domesticated as the 'Gibraltar GDPR' alongside the Data Protection Act 2004, and cookies/e-privacy rules sit in the Communications (Personal Data and Privacy) Regulations 2006 — the primary vehicle for restraining platform data-processing practices in the absence of a bespoke online-safety law.
Gibraltar has not enacted a UK Online Safety Act-style duty of care or an EU Digital Services Act-equivalent regime; there is no Gibraltar-specific statutory age-verification requirement for pornography or user-to-user platforms, and the UK OSA does not extend to Gibraltar (Gibraltar is outside both the EU and the OSA's territorial scope).
Substantive unlawful online content is addressed via general criminal law (e.g. Crimes Act 2011 offences covering indecent images, harassment, malicious communications) and the Gibraltar cybercrime framework, rather than a platform-focused takedown regime.
Timeline - major decisions & events
Gibraltar's Parliament amended the Broadcasting Act 2012, updating the regulatory framework for licensed media service providers (radio, TV and on-demand) overseen by the GRA. Reflects ongoing modernisation of broadcast/online-content oversight.
Parliament of Gibraltar ↗The Gibraltar Regulatory Authority released findings from a 6,240-respondent survey showing nearly 40% of adults felt unable to spot online misinformation and that 78% of children aged 10-17 spend 3+ hours daily on social media, shaping its media-literacy and online-harms work.
Gibraltar Regulatory Authority ↗The Crimes and Communications (Online Safety) Act took effect and the GRA's statutory responsibility to promote media literacy and public awareness of online content risks formally commenced on 27 July 2023.
Gibraltar Regulatory Authority ↗Parliament approved new criminal offences targeting online harms (including in social-media spaces) and aligned extreme-pornography law with the UK, while imposing a new media-literacy duty on the GRA, Gibraltar's first dedicated online-safety statute.
HM Government of Gibraltar ↗Following stakeholder consultation including the GRA, the Justice Minister published the Online Safety Bill to create specific offences for serious online acts and strengthen protection of the public from online harms.
HM Government of Gibraltar ↗After the Brexit transition period, the EU GDPR was superseded by the domestic Gibraltar GDPR, supplemented by the Data Protection Act 2004, with the GRA acting as Information Commissioner and supervisory authority over data and online privacy.
Gibraltar Regulatory Authority ↗As an EU territory at the time, Gibraltar applied the EU General Data Protection Regulation (2016/679) from 25 May 2018, establishing the modern data-protection baseline that governs online personal-data handling.
Gibraltar Regulatory Authority ↗Parliament passed the Broadcasting Act 2012, giving the GRA powers to license and regulate media service providers, including on-demand services, and to set broadcasting standards, codes of practice and promote media literacy.
GBC ↗Passed to transpose EU electronic-communications directives (resolving Commission infringement proceedings), the Act established the framework for regulating telecoms, internet and broadcasting transmission under the GRA, the backbone of Gibraltar's electronic-media oversight.
Laws of Gibraltar ↗Gibraltar implemented EU ePrivacy rules governing privacy and personal data in electronic communications (cookies, traffic data, direct marketing), complementing the Communications Act's online-services regime.
Laws of Gibraltar ↗Established Gibraltar's first comprehensive data-protection regime and supervisory enforcement structure, later retained as domestic law supplementing the Gibraltar GDPR.
Laws of Gibraltar ↗Transposed the EU E-Commerce Directive (2000/31/EC) into Gibraltar law, setting rules for information-society services and intermediary liability, the foundational legal basis for regulating online services.
Laws of Gibraltar ↗The GRA was created under the Gibraltar Regulatory Authority Act 2000 as the statutory body regulating electronic communications, broadcasting and (later) data protection, the institution that anchors today's online-content and safety framework.
Gibraltar Regulatory Authority ↗Gibraltar - other topics
Internet & Online Safety in other countries
Last verified 9/18/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →