SingaporeCode of Practice for Online Safety, Social Media Services
In force since .
An age-appropriate design code rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- User location
- Audit expectation
- none
What it requires
- Applies only to Social Media Services designated (or to be designated) under section 45K(1) of the Broadcasting Act 1994; six services (Facebook, HardwareZone, Instagram, TikTok, X and YouTube) were designated when the Code took effect.
- Minimise all end-users' exposure to harmful content (sexual content, violent content, suicide and self-harm content, cyberbullying content, content endangering public health, and content facilitating vice and organised crime) through published community guidelines and content moderation.no control in the NIST Privacy Framework
- Unless you restrict child access entirely, give a child's account (a child is anyone below 18) age-appropriate default settings that are more restrictive than a general account's, and show a clear warning before the child or a parent opts out of those protective defaults.no control in the NIST Privacy Framework
- Unless you restrict child access entirely, give the child or a parent or guardian tools to manage exposure to content and to limit the visibility of and interaction with the account.NIST Privacy FrameworkCT.PO-P3
- Use technology to proactively detect and swiftly remove child sexual exploitation and abuse material.no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
The designated service must file with IMDA, for publication, an annual online safety report that describes the measures taken and the actions taken on end-user reports, so it must hold records of reports and actions. The Code names no log, record or retention period, and sets no rule on keeping age-assurance data.
- Kind
- Implicit
- As of
- Provision
- Code of Practice for Online Safety, Social Media Services, para. 25
What this law does
The Code applies to Social Media Services designated or to be designated under section 45K(1) of the Broadcasting Act 1994; six services (Facebook, HardwareZone, Instagram, TikTok, X and YouTube) were designated when it took effect.
It requires a designated service to minimise all end-users' exposure to harmful content (sexual content, violent content, suicide and self-harm content, cyberbullying content, content endangering public health, and content facilitating vice and organised crime) through published community guidelines and content moderation. Beyond that baseline, the Code requires additional measures for children, defined as anyone below 18.
Unless the service restricts child access entirely, a child's account must have age-appropriate default settings that are more restrictive than a general account, tools for the child or a parent or guardian to manage exposure and limit the visibility of and interaction with the account, and a clear warning before the child or parent opts out of those protective defaults.
A designated service must also use technology to proactively detect and swiftly remove child sexual exploitation and abuse material.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .