Pakistan's Social Media Protection and Regulatory Authority (SMPRA) has begun drafting the detailed content-moderation rules that will give the country's amended cybercrime law its operational teeth. Chaired by former Islamabad Advocate General Ayaz Shaukat—appointed on 18 March 2026 to a five-year term alongside five notified members—the body is now writing the fine print on platform registration, complaint handling, and the penalties platforms face for ignoring its orders. SMPRA was created by the Prevention of Electronic Crimes (Amendment) Act 2025, which the National Assembly passed on 23 January 2025 and which was gazetted six days later. The rules now being drafted will determine whether that statute becomes a workable compliance regime or a faster, more centralised blocking machine.
The case the government is making
It is worth stating the strongest version of the regulator's argument before dismantling the rest. Pakistan, like every large internet market, faces genuine harms: organised disinformation campaigns, financial scams, non-consensual imagery, and incitement that can turn deadly within hours. A named authority with a published complaint-redress mechanism is, in principle, more accountable than the ad hoc, opaque blocking the Pakistan Telecommunication Authority has practised for years—where sites simply vanished with no order, no reasons, and no appeal. If SMPRA replaced that discretion with transparent, reasoned, reviewable decisions, it could be a net improvement in the rule of law online. Requiring large platforms to register a local point of contact is also not inherently unreasonable; the EU's Digital Services Act asks something similar.
That is the charitable reading. The text of the law, and the direction of the draft rules, point the other way.
Vague offences, fast removals, weak review
The amendment's central new offence criminalises spreading "false or fake" information, punishable by up to three years in prison and a fine, as Amnesty International documented when it called for the bill's immediate withdrawal. Human Rights Watch notes that SMPRA can order platforms to remove or block content deemed "against the ideology of Pakistan" or "fake or false"—language it describes as "vague and overbroad," criminalising material that causes "fear, panic, disorder or unrest" without ever defining the core terms. When the trigger is undefined, the safe move for a platform facing criminal exposure is to over-remove. That is not a side effect of the design; it is the design.
The 24-hour window compounds the problem. SMPRA is required to issue orders within 24 hours of receiving a complaint, per reporting on its launch—a timeline that all but guarantees decisions without meaningful adjudication. Crucially, appeals run to a Social Media Protection Tribunal that, as Human Rights Watch points out, is staffed by government-appointed members rather than independent members of the judiciary. A speech regime in which the accuser, the rule-writer, the enforcer, and the appellate bench all answer to the executive is not proportionate regulation. It is the machinery of prior restraint with a complaints inbox bolted on.
Process matters too. Both Amnesty and HRW stress the bill was rushed through without consultation with civil society or the technology sector, failing the necessity-and-proportionality test that international human-rights law sets for any restriction on expression. Pakistan's own National Commission for Human Rights examined the amendments and flagged the same structural defects.
The bill the economy is paying
Here is what makes SMPRA's trajectory self-defeating on the government's own terms. Pakistan was the most economically damaged country in the world from internet shutdowns in 2024, losing $1.62 billion, according to Top10VPN's annual tracking—ahead of conflict-hit Sudan and Myanmar. The Information Technology and Innovation Foundation, costing the same year independently, found Pakistanis endured roughly 9,735 hours of partial or complete shutdowns, with the ban on X alone—imposed on 18 February 2024 and still running—accounting for hundreds of millions of dollars. The Pakistan Software Houses Association has estimated the IT sector loses about $1 million for every hour the internet is throttled.
Layer on the PTA's November 2024 VPN-registration mandate—which pushed businesses and freelancers to enlist their tools or risk disruption—and the picture is of a state already taxing its own digital economy heavily for control it struggles to exercise cleanly. SMPRA does not reverse this. It institutionalises it, handing a permanent bureaucracy the standing authority to do at scale what shutdowns did bluntly. ITIF's analysis is blunt: vague compliance standards and the threat of bans "raise operational costs and risks" for the global platforms Pakistani exporters depend on, while advantaging state-aligned Chinese rivals already built for closed environments.
What proportionate would look like
None of this requires Pakistan to abandon regulation. It requires the draft rules to do the work the statute skipped. Definitions of "false" and "unlawful" should be narrow and tied to concrete, demonstrable harm, not ideology. Takedown orders should be reasoned, published in a transparency register, and—above the most clear-cut emergencies—reviewed by actual judges, not executive appointees. Registration should be a contact requirement, not a licence the Authority can revoke on discretion. The 24-hour clock should apply to acknowledging complaints, not to final adjudication of speech.
SMPRA's rule-drafting is a genuine fork in the road. Written tightly, the rules could give Pakistan something it has lacked: predictable, reviewable, rights-respecting online governance. Written to match the statute's ambitions, they will turn a $1.62-billion-a-year habit into permanent infrastructure—and push the open, export-earning internet Pakistan's economy runs on a little further out of reach.