The case for regulating, and where it stops
The strongest argument for Bangladesh's new rules is a fair one. Online harassment, blackmail and non-consensual intimate imagery are real harms, and women and minors bear most of them. A state that does nothing leaves victims without a remedy. Platforms that ignore local-language complaints also leave a gap that regulators can reasonably try to close.
The problem is what has been built on top of that case. An analysis published by the Oxford Human Rights Hub on 21 October 2026 argues that Bangladesh's new cyber law shrinks the space for online expression. The author, Shakhawat Hossain of UNSW's Faculty of Law, traces the sequence. The Digital Security Act of 2018 was replaced by the Cyber Security Act in 2023. The interim government then replaced that with the Cyber Protection Ordinance in 2025, which the BNP-led government enacted in 2026. The piece gives no exact day for enactment or for a June amendment. Reporting is also inconsistent on the instrument's name, which appears as Cyber Protection Act, Cyber Security Act and Cyber Security Bill. We could not reconcile the names against a gazette text, so this article describes the instrument generally.
What the Oxford analysis actually flags
Most of the Oxford critique targets proposed amendments, not settled law, and the distinction matters. According to the analysis, existing law already allows restrictions on grounds such as national security, public order and communal harmony. The proposed change to section 8(2) would go further and let authorities block or remove content based on apprehension rather than established harm. It would also cover information considered "defamatory" or "derogatory" towards a person or the state.
A July report in Prothom Alo describes the draft in more detail. A new section 26A would punish publishing "rumours" or "disinformation" with up to 10 years' imprisonment, a fine of up to Tk 4 million, or both. The draft defines a rumour as any unsubstantiated or unverified claim that creates, or risks creating, confusion, panic, unrest or social instability. Section 25, covering defamation and derogatory content, would carry up to five years and Tk 2 million. Those figures double for offences against a woman or a person under 18. The Oxford piece adds that the draft would expand powers to search and seize devices "even for press media", and would try some offences before mobile courts presided over by executive magistrates.
The Prothom Alo report quotes technology experts who say the move marks a return to the era of the Digital Security Act. That reading is plausible. The 2018 act became notorious for the same pattern: vague harm categories, heavy penalties and executive discretion.
Why the definitions fail the constitution's own test
Article 39(2) of Bangladesh's Constitution guarantees freedom of speech and the press, subject to "reasonable restrictions imposed by law". It lists security of the State, friendly relations with foreign states, public order, decency or morality, contempt of court, defamation and incitement to an offence as the permitted grounds. Defamation is on that list, so a defamation offence is not unconstitutional in itself. The weakness is the standard used. "Risks creating confusion" is a prediction about audience reaction, not a harm anyone must prove. Under a definition like that, a good-faith error about a flood forecast or a mistaken post about a minister's remarks can both qualify.
A proportionate design would look different. It would require intent and demonstrable harm, create a public-interest defence, and give courts, not executive magistrates, the power to order takedowns. It would also keep criminal penalties for the narrow category of incitement and fraud, and use civil remedies for the rest.
The platform layer
The second pillar is telecom regulation. A February 2026 report from Digi Bangla Tech describes a Bangladesh Telecommunication Regulation (Amendment) Ordinance, 2026. It says the ordinance defines OTT services and intermediaries, requires platforms such as Facebook, YouTube and WhatsApp to operate in line with BTRC guidelines, and gives the commission authority to write intermediary guidelines. Our fetch of that page returned only a partial extract, so these details rest on a secondary summary.
BSS reporting in Bonik Barta dates final cabinet-level approval of a telecommunication amendment ordinance to 24 December 2025. It describes real reforms: the ordinance restores BTRC's independence from the ministry, revises the speech offence in section 66A to criminalise only incitement to violence, and, in the article's words, "permanently prohibits" internet shutdowns (section 97). That article does not mention OTT services. The 2025 and 2026 reports may describe the same instrument or successive ones, and we could not settle that from the pages we read.
The tension is clear. The telecom reform removes a shutdown power and trims one speech offence, while the cyber-law amendments would broaden others. Platform guidelines written by a regulator, without a statutory standard for what must come down, can turn into the same executive discretion by another route.
What happens next
The ICTD website currently lists a notice dated 10 November 2026 seeking public comment on proposed amendments to the Cyber Protection Act 2026. We saw it only as a homepage listing and did not open the notice or the draft text. If it is what it appears to be, consultation is still open.
The constructive path is narrow. Drop section 26A or confine it to knowing falsehoods that cause demonstrable harm. Replace "apprehension" in section 8(2) with a harm standard and judicial authorisation. Keep the telecom ordinance's shutdown ban, and make sure BTRC intermediary guidelines contain notice-and-appeal procedures. Bangladesh has just shown it can remove a shutdown power. The open question is whether it will apply the same discipline to speech.