On May 22, 2026, Dr. Jamal Mohammed Al Kaabi, Secretary General of the UAE's National Media Authority (NMA), told an Abu Dhabi audience that the regulator had removed 10,000 TikTok accounts for publishing AI-generated and other content it judged harmful to the country's reputation. He paired the figure with a wider claim about reach: under UAE law, he said, even a private family WhatsApp group counts as a "media platform," so content shared inside it is subject to legal accountability. He illustrated the point with seven enforcement examples spanning religious insult, misuse of national symbols and the currency, privacy breaches, and fake news — including a fabricated Covid-19 case and false claims about a security arrest.
The legal scaffolding is real and broad. The NMA's 2026 Media Content Standards prohibit content that harms "national unity and social cohesion," offends monotheistic religions, damages "the State's foreign relations," or circulates "false news" and "rumours." Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes supplies the criminal teeth, with fines that can reach Dh500,000 alongside imprisonment and, for expatriates, deportation.
The case Abu Dhabi can fairly make
Start with the strongest version of the regulator's position. Generative AI has made convincing fabrications cheap and instantaneous, and a small, hyper-connected economy that sells itself on stability and trust has a genuine interest in policing impersonation scams, financial fraud, and deepfakes that can defame residents or move markets. The UAE is also one of the most demographically diverse societies on earth — roughly 88% of residents are foreign nationals — and officials argue that sectarian or hate-driven incitement carries real social risk in that context. Protecting children from violent or extremist material is a legitimate aim that almost every democracy pursues too. None of this is exotic; the EU's Digital Services Act and the UK's Online Safety Act rest on adjacent concerns.
"Reputation harm" is not a content standard
The problem is the standard being applied. "Content harmful to the UAE's reputation" is not a defined offence with knowable elements — it is a mood, and an infinitely elastic one. A satirical video, a critical news report, or an unflattering but true account of an incident can all be folded into it. The 10,000 TikTok takedowns were described as a bulk result, not a series of adjudicated cases, and the NMA has published no removal criteria, no breakdown of what tripped the threshold, and no disclosed appeal mechanism. When the rule is "don't make us look bad" and the penalty is a six-figure fine or deportation, the predictable response is not better content — it is silence about anything sensitive.
This is where proportionality breaks down. A narrow rule against fraudulent impersonation or AI deepfakes used to deceive would be defensible and enforceable. A standard that sweeps "reputation" and "foreign relations" into the same net as scams gives a regulator open-ended discretion over ordinary expression, which is the opposite of the legal certainty that good regulation provides.
Private chats are not broadcast
The most consequential line Al Kaabi drew was around scope: a family WhatsApp group, he said, is a regulated media platform. That collapses the distinction between publishing and private conversation — a distinction every workable speech framework depends on. Broadcasting to thousands and forwarding a message to relatives are different acts with different harms, and treating them identically means the same authority that polices national television also polices the dinner-table group chat. The chilling effect is the point: when people cannot be sure whether a private aside is "media," they self-censor everywhere. It also sits awkwardly against the UAE's own data-protection commitments under Federal Decree-Law No. 45 of 2021, which frames private communications as something the state safeguards rather than monitors as a publishing channel.
Platforms become the enforcement layer
Note the mechanism. The 10,000 accounts were removed on TikTok, and the same pressure is visible elsewhere. Since March 2026, according to ALQST and a coalition of rights groups citing Meta's own transparency reports, over 100 Facebook pages and Instagram accounts have been restricted from reaching audiences in the UAE and Saudi Arabia at government request, with Meta pointing to the two countries' cybercrime laws. Some of the geo-blocked accounts belonged to human-rights researchers and NGOs. Whatever one thinks of any individual account, the structural result is that private platforms are converted into the enforcement arm of a content regime they did not write and cannot meaningfully contest. That is a poor model: it offloads censorship onto companies while insulating the rule-maker from accountability.
The contradiction with Abu Dhabi's own bet
None of this is happening in a vacuum. The UAE has staked its post-oil future on becoming a global hub for AI, data centres, and digital media. Its exit from OPEC on May 1, 2026 freed an estimated $61 billion a year in oil revenue that state funds are channelling into AI infrastructure, per Rest of World. But talent and capital in those industries are mobile, and they price in legal risk. It is hard to recruit the world's AI engineers, founders, and creators while telling them that a WhatsApp message can be a media offence and that "reputation harm" is a prosecutable category. A jurisdiction cannot simultaneously be the open, frictionless platform economy it markets to investors and a place where the regulator audits family group chats.
A proportionate path exists
The fix is not deregulation; it is precision. Narrow enforcement to genuine fraud, impersonation, and deceptive deepfakes. Publish the criteria the NMA actually applies, and offer a real appeal. Keep private interpersonal messaging outside media law entirely. Require transparency reports on takedown and geo-block requests, so the public can see what is being removed and why. Those are the hallmarks of regulation that protects people without smothering the open internet the UAE says it wants to lead. Removing 10,000 accounts on a "reputation" standard, and reclassifying private chats as broadcast, moves in the other direction.