Online safety & content laws in Luxembourg (2026)

The Act of 5 May 2026 (published in Journal officiel 6 May 2026, in force 10 May 2026) transposed EU Directive 2022/2555 (NIS2), repealing the 2019 NIS1 law. It imposes mandatory risk management, 24-/72-hour incident notification, and tiered supervision across 18 critical sectors; ILR is lead authority for most sectors, CSSF for financial infrastructure.

The government submitted Bill 8625 to the Chamber of Deputies, proposing a wholesale rewrite of Luxembourg's 1991 Electronic Media Law. It would rename ALIA as ALIM, strengthen its enforcement powers over online video platforms and social media, and align national rules with evolving EU digital-services standards.

Adopted by the Chamber of Deputies on 2 April 2025 and promulgated on 4 April 2025, this law designates the Autorité de la Concurrence as Luxembourg's Digital Services Coordinator under EU Regulation 2022/2065. It empowers the authority to enforce transparency and due-diligence obligations against platforms established in Luxembourg and to impose fines up to 6% of global turnover for DSA breaches.

The Law of 20 December 2024 implemented EU Regulation 2019/881 (the EU Cybersecurity Act) in Luxembourg, designating ILNAS as the National Cybersecurity Certification Authority (NCCA). ILNAS now supervises the issuance of European ICT security certificates, covering ICT products, services, and processes placed on the Luxembourg market.

The government introduced Bill 8364 to the Chamber of Deputies to transpose EU Directive 2022/2555 (NIS2). The bill signalled a major expansion: from roughly 1,000 entities covered under NIS1 to an estimated 6,000–8,000, including mid-sized manufacturers and all municipalities with more than 50,000 residents.

The EU Digital Services Act became fully applicable to all intermediary service providers on 17 February 2024. Having not yet enacted national implementing legislation, Luxembourg was among six member states the European Commission formally called upon to designate a Digital Services Coordinator and fulfil DSA institutional obligations.

The Luxembourg Chamber of Deputies enacted Bill 8164 implementing EU Regulation 2022/1925 (the Digital Markets Act), giving the Autorité de la Concurrence new enforcement powers over digital gatekeepers. The DMA imposes ex-ante obligations on large online platforms to ensure contestability and fairness in digital markets.

The Act of 26 February 2021 (in force 12 March 2021) transposed the revised EU AVMSD (2018/1808), extending ALIA's supervision to video-sharing platforms such as YouTube and social networks with significant video content. VSP providers established in Luxembourg must protect minors from harmful content and remove material constituting criminal offences (CSAM, terrorist incitement, hate speech).

The Law of 28 May 2019 transposed EU Directive 2016/1148 (NIS), imposing network-security and incident-reporting obligations on operators of essential services across energy, transport, health, water, banking, and digital infrastructure sectors. ILR was designated competent authority for most sectors; CSSF for banking and financial-market infrastructure.

The Law of 1 August 2018 reorganised the CNPD (national data protection authority) and completed GDPR transposition for Luxembourg, repealing the 2002 data protection act. It sets out national derogations and supplementary rules—including for online processing of special-category data—that directly bear on platform operators established in Luxembourg.

The Law of 5 July 2004 updated Luxembourg's 2000 e-commerce framework by replacing an opt-out regime for unsolicited commercial emails with a mandatory opt-in requirement, aligning with EU Directive 2002/58/EC. It also clarified rules on electronic contract formation and consumer protection for online transactions.

Luxembourg enacted the Law of 14 August 2000 on electronic commerce, transposing the EU E-Commerce Directive (2000/31/EC). It established liability exemptions for internet intermediaries (mere conduit, caching, hosting) and laid the legal foundation for platform liability that governed online content in Luxembourg for two decades until the EU DSA superseded it.