Social media in Saudi Arabia is a double-edged sword—while it offers a platform for connection and expression, it also comes with risks that can be life-altering. The recent case of Ahmed al‑Doush, a British national sentenced to 10 years in a Saudi prison over a single tweet, underscores the Kingdom’s unforgiving stance on dissent and digital speech. Detained during a family trip and convicted without access to proper legal counsel, his story is not just about one man’s misfortune—it’s a stark reminder of how a moment online can spiral into years of offline consequences.
Al-Doush’s family believes the arrest stems from a single tweet he posted in 2018 to just 37 followers about the situation in Sudan—one that made no mention of Saudi Arabia and was later deleted. As global concern mounts, questions arise over the role of the UK government and the urgent need to protect citizens from such fates.
But can tweeting really get you in trouble in Saudi Arabia?
Saudi Arabia maintains highly restrictive legal policies for online content, where digital activities are subject to stringent oversight and broad interpretations of law. This report aims to provide a comprehensive overview of the legal framework governing digital expression, identify categories of content deemed prohibited, detail the sophisticated enforcement mechanisms and judicial bodies involved, outline the severe penalties and legal consequences, and illustrate these points with recent case studies. The objective is to offer a nuanced, authoritative understanding of the potential legal exposure for individuals engaging in online expression within or concerning Saudi Arabia.
I. Overview of Saudi Arabia’s Legal Framework for Online Content
The foundational legal principles and specific statutes that govern digital activities and content in Saudi Arabia are designed to control information flow and maintain public order, morality, and national security.
A. Key Legislation Governing Digital Activities
Saudi Arabia’s digital landscape is governed by a complex interplay of laws. The primary legislation addressing online offenses is the Anti-Cyber Crime Law (ACCL), enacted in 2007. This law aims to secure the safe exchange of data, protect the rights of computer and internet users, and safeguard public interest, morals, and personal privacy. The ACCL criminalizes a range of acts, including unauthorized access to computer systems, defamation of natural or legal persons through social media, breaching privacy by taking unauthorized pictures or videos, and hacking social media accounts. Recent updates to the Essential Cybersecurity Controls (ECC-2) in 2024 further reinforce the Kingdom’s commitment to safeguarding its digital infrastructure.
Complementing the ACCL is the Anti-Terrorism Law, introduced in 2014 and updated in 2017. This legislation defines terrorism in extremely broad and vague terms, encompassing acts that “disrupt public order,” “risk national unity,” or “harm the reputation of the state”. This expansive scope allows authorities to equate peaceful expression and dissent with acts of terrorism, leading to severe penalties and prosecutions by the Specialized Criminal Court (SCC).
The Press and Publications Law, originally intended for traditional media, saw its licensing requirements and penalties extended to online newspapers, blogs, and social media influencers via a 2011 royal decree. This law prohibits the dissemination of content that could harm public order, religious values, public morals, or state security.
More recently, the Personal Data Protection Law (PDPL), introduced in 2020 and fully enforceable since September 14, 2024, aims to safeguard individuals’ personal information and ensure its proper handling by organizations. While its primary focus is on data handling by entities, its provisions on the unauthorized disclosure of sensitive data can have implications for individuals.
Finally, the Telecommunications and Information Technology Law (TCIT Law) covers communication services and the protection of client and customer data and privacy. This law also grants the Communications, Space and Technology Commission (CSTC) the authority to filter internet content and restrict access to specific services by using internet gateways.
To provide a clear, at-a-glance reference for the primary legal instruments governing online activity in Saudi Arabia, the following table summarizes their key aspects:
| Law Name | Enactment/Update Year | Primary Regulatory Body/Enforcer | Key Scope/Purpose Related to Online Content | Relevant Sections/Articles (Examples) |
| Anti-Cyber Crime Law (ACCL) | 2007 (updated 2024 for ECC-2) | National Cybersecurity Authority (NCA), Public Prosecution Office | Secures data exchange, protects user rights, public interest, morals, privacy; criminalizes unauthorized access, defamation, privacy breaches, objectionable content. | Article 6 (Public Order, Morality, Religious Values, Privacy) |
| Anti-Terrorism Law | 2014, 2017 | Specialized Criminal Court (SCC), Presidency of State Security | Combats terrorism, but broadly defines it to include acts that disrupt public order, risk national unity, or harm state reputation. | Vague provisions criminalizing dissent |
| Press and Publications Law | 2011 (extended to online) | Ministry of Information | Regulates traditional and online media; prohibits content harming public order, religious values, public morals, or state security. | Licensing requirements for online publishers/bloggers |
| Personal Data Protection Law (PDPL) | 2020 (enforceable Sept 2024) | Saudi Data and Artificial Intelligence Authority (SDAIA) | Safeguards personal information, regulates data handling by organizations; implications for unauthorized disclosure of sensitive data. | Penalties for unauthorized disclosure |
| Telecommunications and Information Technology Law (TCIT Law) | 2005 (updated 2022) | Communications, Space and Technology Commission (CSTC) | Covers communication services, client data protection; allows internet filtering and restriction of access to content/services. | Article 24 (Internet filtering, access restriction) |
B. Characteristics of Saudi Laws: Broad Interpretations and Vague Provisions
A defining characteristic of Saudi Arabia’s legal framework concerning online content is the deliberate use of broad and vaguely defined provisions. This ambiguity grants authorities extensive discretion in interpreting and enforcing laws, often leading to the criminalization of peaceful expression.
The Anti-Cyber Crime Law’s Article 6 is frequently cited for criminalizing the “production, preparation, transmission, or storage of material impinging on public order, religious values, public morals, or privacy, through an information network or computer”. The terms “public order,” “morality,” and “religious values” are not precisely defined within the statute, allowing for a wide scope of interpretation by authorities and courts. Similarly, the 2014 and 2017
Anti-Terrorism Laws define terrorism in sweeping terms, including acts that “disrupt public order,” “risk national unity,” or “harm the reputation of the state”. This enables the government to equate peaceful dissent, criticism, or even the expression of certain views with acts of terrorism, leading to prosecution by the Specialized Criminal Court (SCC).
Human rights organizations consistently criticize these laws for their overly broad definitions, which are frequently employed to suppress criticism and dissent. This legal framework is observed to create a “hostile environment for freedom of speech and democratic discourse”. The deliberate vagueness in legal drafting, particularly in terms like “public order” and “religious values,” confers immense discretionary power upon authorities. This allows for the arbitrary interpretation and application of laws, effectively enabling the state to criminalize speech retroactively based on evolving political sensitivities, without the need to amend specific statutes.
This inherent lack of precise legal boundaries creates a profound chilling effect, compelling individuals to engage in self-censorship as they cannot predict with certainty what content might be deemed illegal. This approach fundamentally undermines the principle of legal certainty, a cornerstone of predictable justice systems. Instead, the legal framework is transformed into a potent tool for political control. This has significant ramifications for both domestic citizens and international entities operating within or engaging with Saudi Arabia’s digital space, as the interpretation of laws can shift over time, potentially leading to prosecution for even old or deleted posts.
II. Categories of Prohibited Online Content and Activities
The broad legal framework in Saudi Arabia translates into a wide array of online content and activities that are prohibited, carrying significant legal risks for individuals.
A. Content Deemed Inconsistent with Public Order, Morality, or Religious Values
A primary category of prohibited content includes anything deemed “inconsistent with public order or morality, religious values”. This extends to any “news, pictures and videos” transmitted, posted, or tweeted if their content is considered objectionable. Specific examples of forbidden material include pornography, which is explicitly a cybercrime to publish or transmit through social media. Similarly, the promotion or facilitation of the use or distribution of narcotics or psychotropic substances via social media is a distinct cybercrime, prosecutable in conjunction with the main offense of drug use.
Beyond these, the government actively monitors and filters online content to ensure compliance with societal and cultural norms. This includes blocking sites that are deemed “immoral” (often pornographic or supportive of LGBT-rights) or those promoting Shia ideology. The authorities even encourage citizens to actively report “immoral” sites for blocking using a provided web form on the government’s website. Users are advised to be cautious about sharing any content that may be deemed offensive, defamatory, or against the principles of Islam.
B. Defamation, Harassment, and Privacy Breaches
The Saudi legal system has clear provisions to address defamation and online harassment. Defamation of a natural or legal person through social media is explicitly listed as a cybercrime. Users must exercise caution when sharing information or making statements that could harm the reputation of individuals or organizations. Additionally, cyberbullying, hate speech, and online harassment are considered serious offenses that can result in legal consequences, underscoring the importance of maintaining respectful and responsible behavior on social media.
Privacy is also strongly protected under the Saudi Anti-Cyber Crime Law. The unauthorized taking of pictures or recording of videos using camera-equipped mobile phones constitutes a crime. Furthermore, hacking a social media account, gaining unauthorized access, and preventing or obstructing the owner’s access to their account is a serious cybercrime.
C. Content Critical of the Government, Royal Family, or State Policies
Perhaps the most significant area of risk for online expression in Saudi Arabia pertains to content that is critical of the government, the royal family, or state policies. The Anti-Terrorism Law is frequently invoked in such cases, where dissent is explicitly equated with terrorism. This includes content that “disrupts public order,” “risks national unity,” or “harms the reputation of the state”. A newer anti-terrorism law, enacted in November 2017, further expanded these definitions to include content that depicts the King or Crown Prince “in a manner that brings religion or justice into disrepute,” or using one’s “social status or media influence to promote terrorism”.
Individuals have faced severe repercussions for criticizing government initiatives, such as Vision 2030. Support for women’s rights or calls for an end to the male guardianship system are also considered highly sensitive topics that have led to arrests and lengthy prison sentences. Even sympathizing online with a critic of the Saudi royal family can lead to detention. Joining online groups that include individuals wanted for security purposes or are deemed “outlawed” can also result in charges. The Saudi government reportedly employs an “electronic army” to promote pro-government views, particularly on social media, and to counter perceived dissent. This indicates a comprehensive strategy to control the online narrative and suppress any opposing voices.
III. Enforcement Mechanisms and Judicial Bodies
The enforcement of Saudi Arabia’s stringent online content laws relies on extensive monitoring capabilities and a centralized judicial process involving several key governmental and judicial bodies.
A. Government Monitoring and Surveillance
Saudi Arabia directs all international internet traffic through a proxy farm, where a content filter is implemented. The Communications and Information Technology Commission (CITC) handles the DNS structure and filtering, blocking sites based on lists of “immoral” content or directions from a security committee. The government actively monitors for unusual spikes in internet traffic related to content it wishes to censor.
Overall, authorities operate extensive censorship and surveillance systems, closely monitoring websites, blogs, chat rooms, social media, emails, and text messages. Since September 2017, after lifting a ban on online voice and video call services, the government announced that all such calls would be monitored and censored. Reports have also emerged of spyware being used against journalists, and social media accounts of critics being deactivated by authorities. This pervasive threat of digital surveillance significantly impacts freedom of speech.
B. Regulatory and Enforcement Authorities
Several authorities play crucial roles in regulating and enforcing online content laws. The Communications and Information Technology Commission (CITC), also referred to as the Communications, Space and Technology Commission (CSTC), monitors and filters online content to ensure compliance with societal and cultural norms. It is responsible for handling the DNS structure, implementing filtering, and regulating internet services, with the power to introduce internet filtering and limit access to specific content or restrict access to internet services through gateways. The CITC can also impose fines on service providers for various violations.
The National Cybersecurity Authority (NCA) is responsible for enforcing the Anti-Cyber Crime Law. It issues and updates crucial cybersecurity controls, such as the Essential Cybersecurity Controls (ECC-2), which are a framework for protecting the Kingdom’s digital infrastructure. The
Saudi Data and Artificial Intelligence Authority (SDAIA) is the regulatory body empowered to supervise and enforce the implementation of the Personal Data Protection Law (PDPL). The
Ministry of Interior issues public advisories and warnings, including against fraudulent online activities like unauthorized Hajj services.
At the core of the prosecution process is the Public Prosecution Office, also known as the Saudi Bureau of Investigation and Public Prosecution (BIPP). This body is responsible for investigating cybercrimes and other violations, ordering suspects to appear for interrogation, preparing charge sheets, and forwarding cases to the Criminal Court. The
Presidency of State Security is another security agency that has been implicated in arrests and alleged rights violations.
C. Judicial Process and Specialized Courts
When an online crime is reported, it is typically submitted to the nearest police station, which then forwards the report to the Saudi Bureau of Investigation and Public Prosecution (BIPP) for investigation. The BIPP investigates the identity of the suspect in cooperation with other authorities, orders the suspect to appear for interrogation, and then prepares a charge sheet before forwarding the case file to the Criminal Court. Victims of cybercrimes can join the public prosecution’s case to demand damages or compensation.
A critical component of the judicial system for online expression is the Specialized Criminal Court (SCC). Originally established to try terrorism-related crimes, the SCC has been repurposed to prosecute political activists, human rights defenders, and critics. This court handles cases involving peaceful online expression that authorities equate with “terrorism”. Trials in the SCC are frequently criticized by human rights organizations for being grossly unfair, often involving human rights violations such as the acceptance of confessions obtained under torture and the denial of legal representation.
The analysis reveals that Saudi Arabia’s legal and enforcement apparatus, while ostensibly designed for cybersecurity and counter-terrorism, functions as a comprehensive system of social and political control. Laws such as the Anti-Cyber Crime Law and the Anti-Terrorism Law, alongside the Press and Publications Law, are not merely about securing digital infrastructure or preventing violence. Instead, their broad interpretations allow them to be applied to suppress any form of dissent or expression deemed critical of the state or inconsistent with its values. This application is evident in the repurposing of the Specialized Criminal Court (SCC) to prosecute peaceful activists under “terrorism” charges.
The state’s investment in sophisticated monitoring technologies and content filtering mechanisms further solidifies this control, allowing for real-time surveillance and rapid suppression of objectionable content. This indicates a strategic convergence where national security and digital infrastructure protection are leveraged as justifications for extensive censorship and the criminalization of online speech. The continuous updates to cybersecurity controls and data protection laws, while appearing to modernize the legal landscape, simultaneously enhance the state’s capacity for oversight and enforcement, creating a dynamic environment where technological advancement directly supports the maintenance of political and social order.
IV. Penalties and Legal Consequences
The legal consequences for online content violations in Saudi Arabia are severe, encompassing lengthy imprisonment, substantial fines, and other restrictive measures.
A. Imprisonment and Fines
For general cybercrimes, such as breaching the privacy of a natural person by taking unauthorized pictures or videos, or defamation, the penalty can include imprisonment for a term not exceeding one year and/or a fine not exceeding SAR 500,000. Hacking a social media account, which involves obtaining unauthorized access and obstructing the owner’s access, carries a more severe penalty of imprisonment for a term not exceeding four years and/or a fine not exceeding SAR 3,000,000.
Content deemed inconsistent with public order, morality, or religious values, as stipulated under Article 6 of the Anti-Cyber Crime Law, can result in imprisonment for up to five years and/or a fine not exceeding SAR 3,000,000. For offenses prosecuted under the Anti-Terrorism Law, particularly those related to peaceful online activity equated with “terrorism,” individuals have faced exceptionally long prison sentences, ranging from 10 to 45 years. In some extreme cases, the death penalty has been imposed for such charges.
Violations of the Personal Data Protection Law (PDPL), specifically the unauthorized disclosure or publication of sensitive data with intent to harm or for personal gain, can lead to fines of up to SAR 3,000,000 and potential imprisonment for up to two years for individuals. For legal entities, a fine of SAR 5,000,000 can be imposed for violating PDPL provisions. Furthermore, individuals involved in promoting fraudulent Hajj services online face legal action, which may include fines, imprisonment, and deportation depending on the severity of the offense.
B. Travel Bans and Other Restrictions
Beyond imprisonment and fines, individuals convicted of online offenses often face additional, long-term restrictions. Travel bans are commonly imposed following prison terms, such as the 10-year travel ban issued to Mohammed al-Qahtani after his release from a 10-year prison sentence. More severe cases have seen individuals subjected to exceptionally long travel bans, including 34 years for Salma al-Shehab and 45 years for Noura al-Qahtani.
Other significant restrictions include the confiscation of mobile phones and the mandated closure of social media accounts. During detention, individuals may be held in solitary confinement for extended periods, sometimes for months, and often denied access to legal representation throughout their pre-trial detention. For foreign nationals, deportation is a possible consequence following conviction.
C. Broader Societal Impact and Self-Censorship
The cumulative effect of these severe penalties and pervasive surveillance is the creation of a pervasive climate of fear within Saudi society, which compels individuals to engage in self-censorship when expressing themselves online. This chilling effect significantly curtails freedom of speech. The severity of these restrictions on online expression is reflected in international assessments, with Saudi Arabia ranked 170th out of 180 countries in the 2023 World Press Freedom Index by Reporters Without Borders. This low ranking underscores the profound limitations on freedom of expression and press freedom within the Kingdom.
V. Recent Case Studies Illustrating Risks
Numerous documented cases highlight the tangible risks associated with online expression in Saudi Arabia, demonstrating the application of the laws and the severity of penalties.
Salma al-Shehab, a Leeds University PhD student and mother of two, was detained in 2021 and initially sentenced to 34 years in prison based solely on her peaceful social media activity related to women’s rights issues. Her sentence was later reduced to four years in September 2024, leading to her release in February 2025. Her case, widely publicized, underscored the state’s intolerance for online advocacy on sensitive social issues.
Manahel al-Otaibi, a Saudi fitness instructor and women’s rights activist, was arrested in Riyadh in November 2022 under the anti-cybercrime law. Her charges stemmed from supporting women’s rights on X (formerly Twitter) and posting photos of herself without an abaya on Snapchat. In January 2024, she was sentenced to 11 years in prison in a secret hearing.
The cases of brothers Mohammed al-Ghamdi and Asaad al-Ghamdi further illustrate the risks. Mohammed al-Ghamdi, a retired teacher, was arrested in June 2022 and sentenced to death in July 2023 on terrorism charges based solely on his peaceful activity on X and YouTube. He remains imprisoned. His brother, Asaad al-Ghamdi, a teacher, was sentenced by the Specialized Criminal Court (SCC) in May 2024 to 20 years in prison for social media posts criticizing the government’s Vision 2030 social and economic program and expressing condolences for a deceased human rights defender. He was reportedly released in February.
Noura al-Qahtani, a Saudi woman and mother of five, had her sentence increased from 13 to 45 years in prison in August 2022 for peaceful online activity. This is believed to be the longest sentence ever imposed on a Saudi woman for peaceful online expression, highlighting the escalating severity of penalties.
Saad Ibrahim Almadi, a 72-year-old Saudi-US citizen and retired engineer, had his prison sentence increased to 19 years plus a travel ban of the same duration in February 2022. His charges were based on a series of tweets critical of the Kingdom posted while he was in the United States.
Even foreign nationals are not immune. Ahmed al-Doush, a British national, was arrested on August 31, 2024, at the Riyadh airport. Charges against him were based on deleted social media activity on his X account dating back six years and an alleged association with an unidentified individual in the UK who is critical of Saudi Arabia.
Other notable cases include the sentencing of ten Egyptian Nubian men to between 10 and 18 years in prison in October 2022 for posting on social media and showing solidarity with an outlawed Islamist organization. Additionally, Mohammed al-Rabiah, a supporter of women’s right to drive, saw his prison sentence increased from six to 17 years in December 2022, despite having completed his initial sentence. Fahd Ramadhan, a Yemeni-Dutch national, was detained for sympathizing online with a critic of the Saudi royal family. These cases collectively underscore the significant and unpredictable risks associated with online expression in Saudi Arabia, regardless of the individual’s nationality or the perceived innocuousness of their posts.
Conclusion
Engaging in online expression, particularly tweeting, in Saudi Arabia carries significant and unpredictable legal risks. The Kingdom employs a robust and evolving legal framework, characterized by broadly worded laws such as the Anti-Cyber Crime Law and the Anti-Terrorism Law, which grant authorities extensive discretion in interpreting and enforcing online content regulations. This deliberate ambiguity allows for the criminalization of a wide range of content, from material deemed inconsistent with public order, morality, or religious values, to criticism of the government, royal family, or state policies.
The enforcement mechanisms are comprehensive, involving extensive government monitoring and surveillance of digital communications, supported by specialized regulatory bodies like the CITC, NCA, and SDAIA. The judicial process, particularly through the Specialized Criminal Court (SCC), is frequently used to prosecute individuals for peaceful online activities under vague “terrorism” charges.
The consequences for those who run afoul of these laws are severe, including lengthy prison sentences (ranging from years to decades, and in some instances, the death penalty), substantial fines, and additional restrictions such as travel bans, confiscation of devices, and solitary confinement. These measures, coupled with the pervasive surveillance, foster a climate of fear that compels self-censorship among individuals.
In essence, the Saudi legal system leverages its cybersecurity and counter-terrorism frameworks as instruments of social and political control, effectively suppressing dissent and limiting freedom of expression in the digital sphere. This environment necessitates extreme caution for anyone engaging with or within Saudi Arabia’s digital landscape, as even seemingly innocuous online activity can lead to profound and life-altering legal consequences.
