Saudi Arabia has one of the most legally explicit internet control frameworks in the world — and in 2025 and 2026, the record shows those powers exercised with growing frequency against targets that go well beyond any reasonable security threshold.
The Legal Architecture
Saudi Arabia's Telecommunications and Information Technology Act, enacted under Royal Decree in 2022, gave the Communications, Space and Technology Commission (CST) explicit statutory power to "filter the internet and limit access to specific content online, and to prevent or restrict access to internet services on the gateways" after coordinating with other competent authorities. The Act also criminalises any attempt to bypass or circumvent the filtering system — extending enforcement responsibility from the state to the population. Before 2022, filtering had been informal practice without explicit legal grounding; the new law formalised it as statutory authority.
A second instrument sits alongside the Telecom Act. The Anti-Cyber Crime Law, issued under Royal Decree M/17 in 2007, provides further tools: Article 13 authorises the permanent or temporary shutdown of a website used as a source of criminal activity, and Article 7 imposes penalties of up to ten years' imprisonment and five million riyals for content deemed to threaten state security or public order — a category broad enough in practice to cover political commentary and human rights documentation.
The Strongest Case for State Network Authority
Proponents of government shutdown capability make a genuinely non-trivial argument. No liberal democracy fully surrenders network regulatory authority: filtering of child sexual abuse material and terrorist recruitment content is standard practice across the EU, UK, and United States. Network restrictions during active armed conflict — specifically to prevent real-time operational coordination by hostile actors — have defensible precedents. Exam-integrity shutdowns, deployed by Iraq, Jordan, and Ethiopia to prevent mobile-enabled cheating on national examinations, represent a time-limited and administratively transparent use of shutdown authority that many civil society organisations have come to treat as a distinct, more acceptable category. Saudi Arabia faces genuine regional security pressures that make some form of network emergency authority hard to argue away entirely.
What the 2025–26 Record Actually Shows
The problem is that Saudi Arabia's legal framework is not constrained to those categories, and the practice it has produced reflects that absence of constraint.
Access Now's KeepItOn coalition documented one internet shutdown in Saudi Arabia in 2025, out of a record 52 shutdowns across fifteen MENA countries that year. The specific trigger for the Saudi incident was not made public — an absence of transparency that is itself a governance failure, since accountability is impossible without disclosure.
The geo-blocking record is more detailed and more troubling. From 30 April 2026, Saudi authorities requested Meta restrict the Facebook and Instagram accounts of ALQST for Human Rights, the advocacy group Democratic Diwan, researcher Abdullah Alaoudh, and human rights defender Yahya Assiri from reaching audiences in the kingdom, citing cybercrime laws. Over 100 Facebook and Instagram accounts had been restricted at Saudi government request since March 2026. These accounts were not distributing malware or coordinating violence — they were covering regional geopolitical developments and documenting human rights conditions.
This pattern does not arise in isolation. Freedom House's Freedom on the Net 2025 report scored Saudi Arabia 25 out of 100, classifying it as "Not Free." The same report documents a cartoonist sentenced to 23 years for online content, a British national imprisoned for a decade over a deleted social media post, and the June 2025 execution of journalist Turki al-Jasser on terrorism charges rooted in his digital publications. Mobile internet shutdowns and platform geo-blocking are not isolated instruments in this environment — they form a reinforcing set within a broader architecture of digital suppression.
The Economic Stakes Are Unusually High
Saudi Arabia's digital exposure to this architecture is substantial and growing. As of early 2026, the kingdom reports approximately 99 percent internet penetration, 48.7 million active mobile connections representing 140 percent of the population — nearly all broadband-capable — and a median mobile download speed of 194 Mbps, a 59 percent year-on-year increase. More economic activity is transacting over mobile networks at higher velocities than at any prior point in the kingdom's history.
Vision 2030 designates the digital economy as a structural pillar of transition away from oil. The NEOM flagship project markets itself internationally as a global technology hub. Foreign direct investment in cloud infrastructure, data centre construction, and semiconductor capacity depends on network reliability as a baseline condition. International technology companies applying political risk frameworks treat network stability — specifically, the probability of arbitrary government-directed disruption — as a key variable in investment location decisions. A country courting AWS, Google Cloud, and hyperscale operators while maintaining unilateral and unaccountable shutdown authority sends a contradictory signal that sophisticated investors read clearly.
What Proportionate Policy Looks Like
None of this requires concluding that Saudi Arabia should abandon network regulatory authority. The pro-innovation position is not anarchy — it is accountability with enforceable constraints. Proportionate shutdown policy has identifiable characteristics: statutory thresholds before any network restriction, requiring either a judicial order or an independent regulatory board decision; mandatory post-restriction transparency reports published within thirty days; clear statutory distinction between content-level moderation requests to platforms and network-level shutdown, which should be reserved for genuine emergencies, time-limited, and independently reviewed; and public logging of all government geo-blocking requests to social media platforms.
Several of these already operate as law elsewhere. The EU's Digital Services Act requires large platforms to publish government-requested content restriction orders in a publicly searchable database. That transparency obligation has not undermined security cooperation — it has made the exercise of state authority legible and contestable. Saudi Arabia's Vision 2030 architects are intelligent enough to know the difference between a regulatory regime that attracts capital and one that repels it.
The kingdom has invested enormous resources in building one of the world's most capable mobile networks. The question for its policymakers is whether the legal framework governing when that network can be disrupted will keep pace with the economic stakes. An explicit legal foundation for shutdown authority without an equally explicit legal foundation for limiting and overseeing it is not a sustainable basis for the digital economy Saudi Arabia says it intends to build.