A Warning Written for Phones, Not Just Borders
On August 30, 2026, the U.S. State Department kept its Saudi Arabia advisory at Level 3, "Reconsider Travel," but the update said less about missiles than about phones. Alongside the standard warnings on Houthi strikes near the Yemeni border, the advisory instructs travelers to delete sensitive photos, comments, or past content before arrival and to stop posting, sharing, or liking such material for the duration of a trip — covering "social media accounts, cameras, laptops, phones, and other accounts and devices." It states plainly that local cybercrime and terrorism laws have produced prison sentences of up to 45 years for social media activity, that U.S. citizens have been arrested over posts made before they entered the country, and that Saudi authorities "may not take into account when, where, or in what context posts are made."
That last clause is the story. A travel advisory is normally about what happens to you in a country. This one is about what you did anywhere, at any time, on an account Saudi authorities can read.
The Statute Behind the Warning
The advisory's legal basis is Saudi Arabia's 2007 Anti-Cyber Crime Law, whose Article 6 criminalizes producing, transmitting, or storing material online that violates "public order, religious values, public morals, or privacy" — a five-year, SAR 3 million ($800,000) maximum on paper. Article 7 covers terrorism-linked offenses with a ten-year cap. Neither provision defines "public order" or "religious values," and Saudi Arabia's Specialized Criminal Court — created to try terrorism cases — has for years applied both articles to ordinary political commentary, extending sentences well past the statutory caps through cumulative charges.
The case animating this year's advisory update is that of Ahmed al-Doush, a British bank analyst arrested at Riyadh airport on August 31, 2024, over old social media posts and a tenuous link to a Saudi dissident's son in the UK. The Specialized Criminal Court sentenced him to 10 years in May 2025; an appeal cut that to 8 years, then to 5 in April 2026. The UN Working Group on Arbitrary Detention has since found his detention arbitrary and called for immediate release. Two years after his arrest, he remains at Al-Ha'ir prison. Amnesty International documented eight comparable cases of foreign visitors — tourists, Hajj and Umrah pilgrims, dual nationals — arrested between July 2022 and late 2025 for social media conduct, several involving posts made outside Saudi territory.
Steelmanning Riyadh's Position
The case for a robust cybercrime statute is not frivolous. Saudi Arabia is a live target for cross-border fraud, disinformation campaigns, and — as its own officials argue — incitement that has previously translated into real-world unrest. Plenty of democracies, including the US and EU members, criminalize incitement, doxxing, and terrorist-content sharing, and no state is obligated to let its territorial laws stop at its border when a threat clearly originates or lands inside it. Saudi officials would also note, fairly, that content moderation regimes everywhere involve some balancing between order and expression, and that Vision 2030's economic opening does not require abandoning restrictions the government considers core to social cohesion.
Where the Argument Breaks Down
That case collapses once the law is applied the way it evidently is being applied here. Article 6's terms — "religious values," "public morals" — are vague enough to cover almost any political speech a prosecutor dislikes, which is a due-process problem distinct from whether cybercrime law itself is legitimate. Retroactive reach compounds it: punishing a post made in London before a person ever books a flight is not content moderation, it is extraterritorial speech policing enforced through the accident of a layover. And the sentences documented — a British professional facing a decade, tourists and pilgrims held without trial for over a year, a nominal five-year cap stretched into effectively unappealable terms — are disproportionate to any plausible public-order harm from a deleted tweet.
The commercial cost is real too. Saudi Arabia is spending hundreds of billions to build tourism and foreign investment under Vision 2030, and a Level 3 US advisory that tells visitors to sanitize their phones before landing is a direct tax on that ambition. Companies relocating regional staff, universities sending students, and ordinary tourists now have to weigh a country's stated economic openness against documented cases of years-long imprisonment for old jokes and reposts. No amount of infrastructure spending offsets a legal system foreign visitors are told, by their own government, they cannot safely trust.
What Proportionate Reform Would Look Like
A legitimate cybercrime law can survive narrowing: define "public order" and "religious values" with specificity, cap retroactive application to conduct occurring on Saudi soil or targeting Saudi nationals, and route foreign-visitor cases through ordinary courts rather than the counterterrorism system. None of that requires Saudi Arabia to adopt American speech norms — only to align enforcement with the proportionality it already claims to practice. Until it does, the State Department's advisory to delete your photos before boarding is not overcaution. It is an accurate read of the risk.