Online safety & content laws in South Africa (2026)

The DCDT published a revised Draft White Paper for public comment (deadline August 2025), proposing a new convergence regulator to replace both ICASA and the FPB and imposing duty-of-care obligations on online platforms, including age-verification and algorithmic harm-reduction requirements. This is the most far-reaching proposed overhaul of South Africa's digital content laws to date.

The Information Regulator issued revised POPIA regulations (effective 1 April 2025) mandating that all data-breach notifications be filed exclusively through a new eServices Portal, and tightening consent requirements for electronic direct marketing, objection mechanisms, and cross-border data transfers. The amendments represent the most significant update to South Africa's data-protection compliance regime since POPIA became enforceable.

The Film and Publication Board briefed the Portfolio Committee on Communications, revealing that in just eight months under the live online-content regime: 574 inspections conducted, 108 compliance notices and 14 take-down notices issued, 19 raids carried out, and 18 CSAM cases involving 178,411 files identified — the first major accountability report on the 2022 online content framework in practice.

President Ramaphosa signed Act 16 of 2023, criminalising hate speech disseminated through any medium — explicitly including social media, messaging apps, and other online platforms — with penalties of up to five years' imprisonment. The law closes a longstanding gap in South Africa's online content framework by making digital hate speech a standalone criminal offence.

The FPB had issued a notice under sections 18H and 27A of the Films and Publications Act directing social media platforms to combat disinformation ahead of the May 2024 national elections, but withdrew it on 11 April 2024 — and tendered partial costs — following an urgent court application by Media Monitoring Africa and other civil-society groups. The episode exposed the contested boundary between election-period online safety powers and constitutional free expression rights.

The Film and Publication Board withdrew draft regulations that would have required internet service providers to take active measures against election misinformation and disinformation, following a successful legal challenge. The withdrawal exposed the limits of the FPB's statutory authority over political speech online and left a significant governance gap ahead of the 2024 general election.

The Film and Publication Board released for public comment a draft industry code on prevention of online harm, guidelines governing peer-to-peer video-sharing platforms (covering services like WhatsApp and Facebook), and criteria for determining the harmfulness of online content — the first self-regulatory instruments operationalising the 2022 online content regime.

The Department of Communications and Digital Technologies published its policy blueprint proposing a single convergence regulator, co-regulatory duties on streaming services and social-media platforms, and a comprehensive online safety framework including take-down obligations and child-protection measures — signalling intent to pass dedicated online safety legislation in the 2024/25 financial year.

President Ramaphosa declared the FPAA operative, extending South Africa's content-classification regime to commercial online distributors and user-generated content on social media and video-sharing platforms for the first time. The Act criminalised non-consensual sharing of intimate images, required ISPs to block prohibited content (hate speech, CSAM, incitement to violence), and introduced self-classification with FPB audit oversight.

After a two-and-a-half-year delay since gazette publication, the Amendment Act took effect, extending the Film and Publication Board's mandate to online content including streaming platforms, social media, and all user-generated content. Commercial online distributors must now register with the FPB and comply with classification requirements, making South Africa's content regulator one of the first on the continent with statutory jurisdiction over digital platforms.

The Minister of Justice announced the full commencement of the Cybercrimes Act, creating 20 new cybercrime offences, criminalising harmful online data messages (incitement to violence, threats, unlawful interception), and imposing a 72-hour mandatory reporting obligation on electronic communications service providers and financial institutions — consolidating all cybercrime law into a single statute.

The bulk of the Cybercrimes Act entered into force, criminalising unlawful system access, cyber fraud, the distribution of malicious communications (including online threats and intimate-image abuse), and imposing 72-hour cybercrime reporting duties on electronic communications providers and financial institutions. South Africa's first comprehensive cybercrime statute replaced piecemeal provisions that had been scattered across the ECTA and other legislation since 2002.

The one-year compliance grace period under the Protection of Personal Information Act expired, activating the Information Regulator's full enforcement powers: issuing enforcement notices, imposing administrative fines of up to R10 million, and pursuing criminal prosecution. This made data-protection compliance — including for online platforms processing South Africans' data — legally mandatory for the first time.

The one-year compliance grace period expired, making the Protection of Personal Information Act enforceable in full and activating the Information Regulator's power to investigate, issue enforcement notices, and impose fines of up to R10 million. All organisations processing South Africans' personal data online or offline became immediately subject to sanctions.

A presidential proclamation brought the substantive data-protection provisions of POPIA into operation (sections 2–38, 55–109, 111, 114) and formally constituted the Information Regulator as South Africa's independent data-protection authority, starting a one-year countdown for compliance by all responsible parties.

President Ramaphosa assented to the FPAA, fundamentally modernising the 1996 Films and Publications Act by extending classification obligations to online content and user-generated content, prohibiting online distribution of hate speech and CSAM, and enabling self-classification by accredited commercial distributors — though the law's commencement was held back until March 2022 pending regulations.

South Africa's foundational internet-governance statute came into force, covering the legal recognition of electronic contracts and signatures, ISP liability limitations, online consumer protection, domain name dispute resolution, and the country's first cybercrime provisions. It remained the primary framework for online conduct regulation for nearly two decades until the Cybercrimes Act superseded its criminal provisions.

South Africa enacted the foundational content regulation statute, establishing the Film and Publication Board (FPB) with a mandate to classify and regulate films, games, and publications. Though originally focused on physical media, the FPB's mandate and this Act's framework were later amended to cover online content, making it the direct institutional ancestor of all subsequent internet content regulation in South Africa.

South Africa created the Film and Publication Board as its content classification authority, establishing the legal architecture that — after the 2019 amendments — became the statutory basis for regulating online content including social media and streaming. The Act prohibited distribution of child sexual abuse material and hate propaganda across all media, providing a foundation that was later extended explicitly to digital platforms.