Online safety & content laws in Tonga (2026)

Criminalises using any electronic communications platform to abuse, bully, harass, or harm another person; covers both originators and those who share or repost harmful content. Penalties run up to TP$10,000 or 3 years imprisonment for a first offence and TP$20,000 or 5 years for repeat serious offences; service providers must assist police and prevent misuse or face fines up to TP$20,000.

Enacted as Act 14 of 2025, the law formalises governance structures for national cybersecurity policy, mandates critical-infrastructure protection frameworks, and codifies the Tonga CERT (CERT.to, operational since July 2016). Civil-society commentators noted concerns about ministerial power concentration and weak personal-data privacy provisions during the bill stage.

The Computer Crimes Act 2003, based on the Commonwealth Model Law, is Tonga's foundational cybercrime statute. Tonga acceded to the Council of Europe Budapest Convention on Cybercrime in May 2017 (as the 55th party), enabling international cooperation on cybercrime investigation and electronic evidence.

Mandatory ISP-level filtering for age-inappropriate content and child sexual abuse material was introduced around 2015. Critics noted an absence of transparency in how 'inappropriate' content is defined and limited independent oversight of filtering decisions.

In May 2020, the Ministry of Information and Communications secretly adopted eight media regulations — including a TP$2,000 fine for publishing undefined 'sensitive' information — without consultation with the Media Association of Tonga. CIVICUS rates Tonga's civic space as 'narrowed'; RSF ranked Tonga 46th of 180 countries in its 2025 Press Freedom Index, noting erratic enforcement of constitutional press-freedom guarantees.

Tonga has no enacted data-protection or privacy law; draft legislation is under development with World Bank support, partly prompted by the 2025 launch of the TongaPass national digital-ID system. There is no age-verification mandate applicable to online platforms and no platform-liability framework analogous to the EU DSA.