In October 2026 the US State Department reportedly updated its Saudi Arabia travel advisory, republished by the US Embassy in Riyadh, to warn that social media activity has produced prison sentences of up to 45 years under local laws against cybercrime and terrorism, and that authorities may disregard when, where or in what context a post was made. One caveat: we could not read the advisory itself. The State Department page returned HTTP 403 to our fetch, so the wording and exact publication date are unverified and rest on the page title and search summaries. What follows analyses the legal structure behind that warning, not the advisory's text.
The strongest case for the law
A fair account starts with what the statute is meant to do. Saudi Arabia's Anti-Cyber Crime Law, issued by Royal Decree No. M/17 on 26 March 2007, covers real harms: hacking, online fraud, identity theft, trafficking sites and child exploitation material. Every state needs tools against these. A government can also reasonably argue that online speech which incites violence or exposes private data should carry consequences. If the law were confined to those aims, it would be unremarkable.
What the text actually says
The law's penalty tiers are comparatively modest. According to the English text on WIPO Lex, Article 3 offences carry up to one year in prison and a fine of up to 500,000 riyals. Article 7 offences, which concern terrorism-related use of networks, carry up to ten years and a fine of up to five million riyals. Article 6 is the provision that reaches speech. It penalises producing, transmitting or storing material "impinging on public order, religious values, public morals, and privacy" with imprisonment of up to five years and a fine of up to three million riyals, or either.
The drafting is the first problem. Terms such as "public order" and "religious values" are undefined, so a critical tweet, a retweet or a private message can all fall within them. The Ministry of Communications and IT hosts the official English translation, and the statute has no carve-out for political criticism, satire or reporting.
Where 45 years comes from
On the statute alone, the Article 6 maximum is five years. Terms of 34 or 45 years therefore cannot come from a single Article 6 conviction. They come from stacking. Prosecutors file several counts, add counter-terrorism charges, and the court runs penalties consecutively. That mechanism is why the advisory's warning is credible even though no single article reaches 45 years.
The 2022 case of Salma al-Shehab shows how this works. UPI reported that the Leeds PhD student, detained in 2021 while on holiday in Saudi Arabia, received a six-year sentence that was raised to 34 years on appeal, followed by a 34-year travel ban. The report describes her offence as tweets criticising the government, and it does not name the statutes applied. That omission is itself informative. When a defendant, a university and the press cannot readily tell which provision produced a sentence, the law gives no usable notice of what is forbidden.
The pattern is older than 2022. Reporters Without Borders documented that blogger Raef Badawi was sentenced in 2013 under Articles 6 and 7 of the same law to seven years and 600 lashes, which was already above the Article 6 ceiling because a second article was added.
Why "context" matters most
The most consequential part of the reported advisory may be the line that authorities can disregard when, where or in what context a post was made. If accurate, it describes a rule with no limits on jurisdiction or time. A post written years ago, outside the kingdom, by a person with no Saudi ties can be treated as a present offence on arrival. Because the cases above involve a student on holiday, travellers and dual nationals face the greatest exposure. The same drafting that makes the law easy to apply makes it impossible to comply with in advance.
A proportionate alternative
The policy answer does not require abandoning cybercrime law. Proportionate regimes share a few features:
- Defined offences. Speech crimes should be tied to concrete harms such as incitement to violence or threats, rather than to "public order" or "religious values."
- Sentencing ceilings that bind. Stacked counts should not multiply a five-year maximum into decades. Concurrent sentencing for a single course of conduct is a standard safeguard.
- Ordinary courts and public judgments. Published reasoning lets citizens and foreign visitors learn where the line is.
- Platform liability separated from user prosecution. Takedown notices for defined unlawful content achieve the stated aim without imprisoning the poster.
This matters beyond civil liberties. Saudi Arabia is courting global technology investment and hosting international digital events. A regime in which a tweet can lead to decades in prison, with no foreseeable boundary, raises operating risk for any company whose staff, moderators or users travel to the kingdom. Investors price legal predictability, and a vague speech law with open-ended penalties undermines it.
What to watch
Two things would test whether the advisory reflects a change or a restatement. First, whether the advisory text, once readable, cites specific new cases. Second, whether the Saudi government publishes sentencing guidance or amends Article 6's wording. Neither has been confirmed in the materials we could verify. Until then, the evidence shows a statute with a five-year ceiling, applied alongside other laws in ways that produce sentences many times longer, and a notice mechanism that fails to tell people which posts are punishable.