A joint investigation published June 29, 2026 by Amnesty International and the Saudi human rights group ALQST documents nine cases, since July 2022, of foreign visitors — tourists, pilgrims, and family travelers — arrested and prosecuted in Saudi Arabia over social media posts, in at least one case for content published before the traveler ever entered the country. The report lands as the Kingdom is spending tens of billions of dollars to become one of the world's premier tourism destinations, exposing a direct collision between Vision 2030's growth ambitions and the domestic legal architecture built to police speech.
The Cases
Four of the nine documented visitors were arrested while performing Hajj or Umrah; the other five were on tourism or family trips. Saudi authorities detained some on arrival, some mid-stay, and others as they tried to leave.
The clearest example is Ahmed al-Doush, a British national and then-senior analyst at Bank of America, arrested at Riyadh airport on August 31, 2024 as he tried to fly home after visiting with his pregnant wife and two children. His prosecution rested on posts he had published on social media before arriving in the Kingdom. He was sentenced to 10 years, reduced to five on appeal in April 2026.
Amr Abdelfattah, a French national and father of three, was detained June 16, 2024 while performing Hajj, held for 11 months without trial, and eventually charged in May 2025 with "insulting the government" and "praising prosecuted individuals" — alongside an unrelated visa issue that Amnesty says would ordinarily carry only a fine and deportation. Fahd Ramadhan, a Dutch-Yemeni national, spent 18 months in arbitrary detention without formal charges after his November 2023 arrest before being released in June 2025 following diplomatic pressure. Haidar Slim, a Lebanese national, was prosecuted for filming himself performing a Shia religious chant during Hajj in 2022 — content Saudi authorities said "undermined public order and religious values" — and served most of a five-year sentence plus a 10,000-riyal fine before his March 2025 release.
The Legal Hook
Every one of these prosecutions traces back to the 2007 Anti-Cyber Crime Law, specifically Article 6, which criminalizes "the production, preparation, transmission, or storage of material impinging on public order, religious values, public morals, or privacy through an information network or computer" — punishable by up to five years in prison and a fine of up to 3 million riyals (about $800,000). Those terms are undefined. "Public order" and "religious values" are left to prosecutorial and judicial discretion, which is precisely how a chant filmed at Hajj and a business traveler's pre-trip tweets end up prosecuted under the same clause as incitement or defamation.
The law's reach has, if anything, widened. In April 2026 the Public Prosecution announced it had begun enforcement against anyone "harming the reputation of tourism" in the Kingdom, invoking both the Anti-Cybercrime Law and the Anti-Forgery Law — adding a tourism-specific speech offense on top of an already open-ended public-order clause, aimed at exactly the visitors the Kingdom is trying to attract.
Steelmanning the Saudi Position
Saudi Arabia is not unique in wanting foreign visitors to respect local law, and there is a real case for baseline rules: no country is obligated to let tourists incite unrest, defame private citizens, or violate religious sensitivities that its own laws protect for residents. Governments also reasonably argue that some deterrent against reputational sabotage — fabricated claims designed to damage a tourism sector residents depend on — serves a legitimate economic interest, not just a censorial one. If Article 6 were narrowly drawn and consistently applied to genuine incitement or fraud, it would sit comfortably within the range of what most sovereign states claim.
That is not what the documented cases show. A father filming a religious chant, a business traveler's posts made before landing, and a tourist's TikTok about his own trip do not resemble incitement, fraud, or defamation under any ordinary reading — they resemble ordinary expression swept up by a statute broad enough to reach almost anything. The extraterritorial reach compounds the problem: prosecuting speech published outside Saudi jurisdiction, before the traveler was even subject to Saudi law, extends the state's speech regulation beyond its own borders and into contexts the traveler had no reason to think fell under Saudi jurisdiction at all.
Why This Matters Beyond Nine Cases
The report doesn't stand alone. ALQST separately documented that Meta has geo-blocked more than 100 Facebook and Instagram pages inside Saudi Arabia and the UAE since March 2026, including the accounts of ALQST itself and other rights researchers, at government request — a parallel track where platforms enforce Saudi speech preferences on users who never left home. Read together, the visitor prosecutions and the platform geo-blocking describe the same regulatory posture applied to two audiences: residents and, increasingly, foreigners who assumed a trip abroad meant leaving their home country's speech environment, not entering one considerably more restrictive.
The commercial stakes are real. Saudi Arabia drew an estimated 122 million visitors in 2025, including 29.7 million international arrivals, and is targeting 150 million total visitors — 70 million of them international — by 2030. Every prosecution publicized by rights groups is a data point international travelers, and the corporate risk and compliance teams that advise them, will weigh against that target. Amnesty and ALQST are calling on foreign ministries to update travel advisories accordingly and on governments to provide consular protection and monitor trials — modest asks that nonetheless signal how far outside normal tourism-destination practice these prosecutions sit.
The fix does not require Saudi Arabia to abandon public-order enforcement. It requires narrowing Article 6 to defined, foreseeable offenses — incitement, credible threats, verifiable fraud — and ending prosecution of speech published before a traveler's arrival. Until then, the Kingdom is running two policies at once: a tourism strategy that needs the world to keep visiting, and a cybercrime law broad enough to jail the visitors who do.