Vietnam Tightens Online Speech Controls as Cyber Law Takes Effect

In June, during Hanoi’s record breaking heatwave, photos alluding to rice grains being dried under the sun and exploding into popcorn went viral. Shortly afterwards, Vietnam’s Ministry of Public Security said on its Facebook page that the person behind the photos had been fined ₫7.5 million dong ($285) for spreading false information.

“Refrain from posting or disseminating false or misleading information that affects security, public order, and the legitimate rights and interests of organizations and individuals,” the announcement said. “Any violations will be strictly dealt with according to the law.”

As of July 1, what counts as violation goes beyond a meme spreading “fake news,” as Vietnam’s new Cybersecurity Law and its related decrees have come into effect. Disinformation, anti-state content, inciting violence, defamation, harassment, and immoral content have already been illegal since the original 2018 version of the law. The updated version expands the scope to include calling for boycotts that harm businesses, causing division among the people, and hindering the policy of international solidarity, among others. The penalties have been raised too, going as high as ₫50 million ($1,900) along with account suspension.

“I think this kind of law, it kind of makes people police themselves,” an administrator of a Vietnamese pro-Palestine Facebook page who has been actively supporting the Boycott, Divestment, Sanctions (BDS) movement told Tech Policy Press. With this law in place, “the BDS movement will never happen in Vietnam.”

“Vietnam’s cybersecurity framework, while also addressing legitimate concerns such as cybercrime, online fraud, and national security risks, has raised concerns among human rights groups because some provisions are broader and can allow restrictions on legitimate expression, political speech, and access to information,” said Lana Z., lead of the human rights group ARTICLE 19’s Engaging Tech for Internet Freedom team, who requested to not use her full name for safety reasons.

The new law does come at a time of increasingly sophisticated and damaging cyber attacks, and proliferation of personal data theft. “The development of artificial intelligence (AI), big data, and new technologies like deepfakes is being exploited by cybercriminals to carry out scams and social engineering,” stated a report introducing the Cybersecurity Law’s implementing draft decree prepared by the Ministry of Public Security, which is the government body in charge of the law.

“Meanwhile, management of cross border service providers has faced difficulties due to lack of a mechanism mandating storage of data in Vietnam to serve investigation purposes,” the report added.

The law attempts to solve that by giving the Ministry of Public Security greater oversight. It streamlines previously overlapping provisions, assigning more responsibilities to specific government authorities more clearly to safeguard national security, critical information systems, digital infrastructure, and personal data.

On Facebook, Vietnamese authorities have been posting about specific users they have fined and what kinds of online speech they are being fined for. Many of these posts include the person’s initials, the area they live in, and a photo with their face obscured. Some of the posts include language warning users to think carefully about who they follow and what they post on social media.

“From a governance perspective, fining ordinary users may be a more scalable and less resource-intensive enforcement tool than criminal prosecution or detention, while still creating a significant chilling effect,” Lana Z. told Tech Policy Press. “Publicizing these penalties also sends a broader message that online conduct is under surveillance and that even seemingly minor online activity can result in legal consequences.”

In some recent cases, authorities have publicized fining people for things like interacting with a subversive or reactionary website, insulting the police, and posting offensive comments under a post promoting a product. But other examples of offenses include a user sharing a ghost story, or posting a meme about a type of biofuel that the government has recently mandated people use.

For Lana Z., these cases speak to the breadth of Vietnam’s Cybersecurity Law. “If content such as satire, memes, folklore, criticism of public officials, or engagement with politically sensitive content can trigger administrative sanctions, it suggests that the governing laws and regulations are being interpreted very broadly.”

“So much of what we post on the internet is silly, it's these attempts to make sense of the world,” said Kian Vesteinsson, deputy director for research at the nonprofit Freedom House, where he focuses on tech policy and digital rights. “When you have a censorship regime that considers any challenge to the government's view of the world to be a crime, what you have is an internet that's scrubbed of all of the things that make it pleasurable and fun and good for people.”

An important change that’s come into effect last month is a tightened window for social media platforms to respond to takedown requests from Vietnamese authorities. The law now gives platforms 24 hours to remove infringing content, but in “urgent cases,” that’s shortened further to six hours.

“This is an incredibly brief window for trust and safety staff at a platform to understand whether a notified post is something that's genuinely violative of local law, and it incentivizes platforms to over-remove content in order to not be found in breach of Vietnamese law,” Vesteinsson told Tech Policy Press. “Platforms can face incredibly excessive fines or the wholesale block of their services in Vietnam if they're found to be in breach of these really repressive content removal mandates.”

The press arm of the Ministry of Public Security said in a recent article that “The Cybersecurity Law is an important legal tool that contributes to protecting national security, maintaining social order and safety, and safeguarding the legitimate rights and interests of citizens in cyberspace.”

But that’s only one side of the coin. “Governments have an interest and a responsibility in building a more secure online environment, and certainly cybersecurity should be a priority for policymakers, but Vietnam's cybersecurity law is only nominally about cybersecurity,” said Vesteisson. Since the original law was passed in 2018, “this law has been focused on curtailing dissent on the Vietnamese internet.”

The original version of the law drew widespread criticism from rights groups, including the UN’s Human Rights Office, over provisions that require platforms to share user data, censor posts without judicial oversight, and establish local offices in the country.

This new version of the law now specifies what kinds of user data foreign companies are required to store locally in Vietnam and for how long. This includes things like IP addresses and account names.

“This is fundamentally a surveillance concern,” Vesteinsson told Tech Policy Press. “Vietnamese authorities want to be able to demand user data from these companies in order to identify online critics and go after expressions of dissent, and it's much easier to do so when that data physically resides on a server in Vietnam.”

But resistance from tech companies has been waning. Meta is the only one out of the five US Big Tech companies — the others being Amazon, Apple, Google, and Microsoft — that hasn’t established a local office in Vietnam. Facebook, YouTube, and TikTok compliance with content take down requests have consistently been at over 90% as the government had threatened cutting off access to a market of over what is now 85 million internet users.

Meta, Google, and TikTok did not respond to Tech Policy Press’ requests for comment.

The Ministry of Public Security’s newspaper compared Vietnam’s Cybersecurity Law to the EU’s Digital Services Act and Australia’s eSafety agency. The article says, “The common thread in these approaches is the refusal to empower mob justice and the refusal to allow platforms to escape the consequences of their own amplification mechanisms.”

“It is true that many countries have introduced laws and institutions to address online harms, disinformation, cybercrime, and platform accountability,” said Lana Z. But comparing Vietnam’s cybersecurity law directly with the EU’s and Australia’s frameworks “is not fully accurate because the purpose, scope, safeguards, and implementation mechanisms are different.”

Vietnam is not alone in framing control of online speech as part of maintaining cybersecurity. The Bangladesh Cyber Security Act was used to target government critics. In Myanmar, the ruling junta has used its Cybersecurity law to crack down on free speech. Meanwhile, Russia has been calling for more binding commitments from states to combat cybercrime and cybersecurity, what critics say is an excuse for UN-sanctioned online control.

Back in Vietnam, a pro-Palestine account announced in March on its Instagram page they would preemptively delete their BDS content ahead of the new Cybersecurity Law to avoid potentially getting fined. They urged followers to save the materials in their devices before they’re gone.

On Threads, which has become a go-to platform for Gen-Z netizens to discuss Vietnamese politics, users had already started reframing their BDS posts by focusing on the “good companies” instead of the “bad ones” to avoid the risk of being fined under the defamation provision of the law. In June, the government said 2026 is the first year Meta complied with the removal of content on Threads.

The Ministry of Public Security said through its newspaper that “The law does not prohibit people from using the Internet, nor does it restrict freedom of speech or freedom of the press as stipulated by law. Citizens have the right to express their opinions, reflect their thoughts and aspirations, and contribute to national development in cyberspace.”

But on Threads, the fines have already become a running joke, as users reference them to warn accounts that challenge or criticize government policies or big corporations.

Despite the uneasiness about the fines, the first major test of how the police will interpret and enforce the new Cybersecurity Law is happening now. In July, images of leveled forest along the coast of the Hai Van Pass, widely considered the most scenic drive in the country, went viral. Once netizens learned it is for a real estate development by the country’s biggest private company, Vingroup, Vietnamese Threads exploded with many users enraged by the environmental destruction and calling for the boycott of the company.

But soon, users started complaining about their posts being reported and removed for violating Threads’ terms of service. So far, there has been no public news about anyone getting fined for speaking up against the project.

“If they remove 2k (2,000) posts, we’ll post 4k,” one user commented.