Internet & Online Safety - Hong Kong

Unlike the EU DSA or UK Online Safety Act, Hong Kong has no unified online-safety statute or single regulator. The regime is decentralised, enforcement-reactive, and generally does not impose pre-emptive content-monitoring or safety-by-design obligations on platforms.

The Personal Data (Privacy)(Amendment) Ordinance 2021 (in force 8 Oct 2021) criminalises doxxing (up to HK$1m fine and 5 years' imprisonment) and empowers the Privacy Commissioner to investigate, prosecute, and issue cessation notices to remove doxxing content, including extra-territorially.

The Control of Obscene and Indecent Articles Ordinance (Cap. 390) applies to internet material, classifying articles as Class I/II/III. Online enforcement is complaint-driven and relies on a self-regulatory Code of Practice with ISPs (HKISPA): warning notices for indecent (Class II) and removal of obscene (Class III) material.

Article 43 implementation rules of the National Security Law and the 2024 Safeguarding National Security Ordinance grant authorities powers to order removal/restriction of online information, demand platform assistance, and conduct device searches and surveillance to curb content deemed to endanger national security.

Since Article 23 took effect in March 2024, sedition (over online posts) has become the most common charge; e.g. in April 2025 an ex-League of Social Democrats member was jailed one year over 145 social-media comments. Authorities openly monitor social media.

There is no statutory online age-verification regime for platforms. Child online safety is pursued through education, the complaint-based COIAO controls, codes for internet-cafe operators (filtering/minor restrictions), and the Mandatory Reporting of Child Abuse Ordinance (effective 2026, not internet-specific).