On 20 May 2026, a coalition of 12 digital rights organisations led by Access Now and ALQST accused Meta of acting as an "enforcement arm" for two Gulf governments. According to the joint statement, more than 100 Facebook and Instagram accounts belonging to NGOs, researchers, and activists have been geo-blocked from reaching audiences inside Saudi Arabia and the United Arab Emirates since March 2026. Among those rendered "unavailable" in the Kingdom since 30 April are ALQST itself, the NGO Democratic Diwan, researcher Abdullah Alaoudh, and human rights defender Yahya Assiri. Meta's stated justification: compliance with Saudi Arabia's Anti-Cybercrime Law and the UAE's counterpart legislation.
The episode is a clean illustration of a structural problem in cross-border content moderation. A platform headquartered in California is now policing speech inside the Gulf according to a 19-year-old criminal statute whose terms would not survive a First Amendment challenge for a single afternoon, and it is doing so largely in the dark.
The statute doing the work
The instrument at issue is Saudi Arabia's Anti-Cyber Crime Law, enacted by Royal Decree No. M/17 on 26 March 2007. Its content provision, Article 6, criminalises "production, preparation, transmission, or storage" of material "impinging on public order, religious values, public morals, or privacy." The penalty is up to five years' imprisonment and a fine of up to three million riyals.
Those four categories — public order, religious values, public morals, privacy — are not legal standards so much as mood lighting. They contain no definitions, no harm threshold, and no carve-out for political speech, journalism, or human rights documentation. That open texture is precisely why the law has become Riyadh's preferred tool against speech. The Electronic Frontier Foundation is currently campaigning for Osama Khalid, a Saudi Wikipedia editor and blogger whose sentence for online writing was inflated to 32 years before being reduced to 14 in September 2024. The same vagueness that puts a Wikipedian in prison is now the basis on which a US company decides who Saudi users may follow.
Steelmanning compliance
The case for Meta's conduct is not frivolous, and it deserves to be stated at full strength. A platform that operates in a country is bound by that country's laws; "legal localism" is the same principle under which Western democracies expect platforms to honour their own court orders. Geo-blocking is also genuinely less restrictive than the alternatives: the content remains live everywhere else in the world, the account is not deleted, and the company avoids a total ban that would cut tens of millions of ordinary Saudi and Emirati users off from the service entirely. Faced with a binary of "comply narrowly or exit the market," narrow compliance plausibly preserves more speech than scorched earth.
That argument has real force where the underlying law targets defined harms — fraud, child sexual abuse material, genuine incitement to violence. The problem is that Article 6 is not that law, and the accounts being throttled are not those harms.
Where the argument breaks
Meta's own commitments are the measure here. The company's human rights policy, and the UN Guiding Principles on Business and Human Rights it claims to follow, expect a company receiving a government demand to assess whether that demand is consistent with international human rights standards, to narrow or resist over-broad requests, and to be transparent about how it reached its conclusion. A demand to silence the documentation accounts of human rights organisations, sourced to a statute with no speech protections, is the textbook case the Guiding Principles exist to catch.
The coalition's central complaint is not merely that Meta complied — it is that Meta complied invisibly. The company has not published the legal requests it received, the human rights due-diligence assessment it says it conducts, the standard it applied, or who signed off. Meta's own Content Restrictions report discloses aggregate counts of locally restricted content but does not surface the request text or the reasoning behind a given geo-block. So users learn that an account has gone dark, but not why, under what specific provision, or whether anyone weighed their rights at all. The reported trigger — coverage of regional geopolitical events following the 28 February 2026 US-Israel strikes on Iran — suggests the restrictions track political sensitivity, not any cognisable harm.
The proportionality test
This is where a pro-innovation, proportionate-regulation lens cuts cleanly. Nobody benefits from a rule that platforms must defy every foreign law; that path ends in market exits that harm ordinary users most. The workable principle is narrower and well established in the platform-governance literature: comply only with requests that are specific, legally grounded in a defined harm, and accompanied by due process — and make the compliance legible. Publish the demand. Publish the assessment. Notify the affected user with the actual legal basis and a route to appeal. Geo-fence to the narrowest territory required.
Meta meets almost none of these on the current facts. The harm is undefined, the process is opaque, and the affected parties are precisely the civil-society actors international human rights law is meant to shield. A government's request being technically "legal" under its own statute is the beginning of the due-diligence inquiry, not the end of it — otherwise the human rights policy is decorative.
The open internet's promise was that a researcher in Riyadh and a reader in Berlin could see the same page. Geo-blocking quietly retires that promise jurisdiction by jurisdiction. There may be cases where it is the least-bad option. But a company cannot claim that defence while refusing to show the request, the reasoning, or the review. The fix is not for Meta to abandon the Gulf market. It is to make every geo-block a documented, appealable, narrowly-scoped act — and to treat a demand built on Article 6's mood lighting as exactly the kind of over-broad request its own policy promises to push back against.