Eighteen months after Vietnam's government issued Decree 147/2024/ND-CP, the country's most consequential internet regulation in a decade is moving from paper to enforcement. In force since 25 December 2024, the decree imposes a real-name verification mandate on social media users, requires platforms to remove government-flagged content within 24 hours, and pushes foreign companies toward storing Vietnamese user data inside the country. Through 2025 and into 2026, enforcement notices have begun targeting Facebook, TikTok and YouTube — the three platforms that together account for the bulk of social engagement among Vietnam's roughly 70 million internet users.
The decree replaces the long-standing Decree 72/2013 and operationalises the data localization principles set out in the 2018 Cybersecurity Law and the 2023 Personal Data Protection Decree. Its mechanics are simple and far-reaching: any account that posts on a social platform must be tied to a Vietnamese phone number or national identification number; live-streaming requires the same verification plus business registration for monetised accounts; and platforms must comply with content removal requests within 24 hours or face account-level suspension and bandwidth throttling.
What changed on the ground
For users, the most visible change is the real-name layer. Vietnamese users opening new accounts on cross-border platforms in 2025 increasingly hit identity-verification walls, and existing accounts are being asked to re-verify. For platforms, the operational lift is heavier: Decree 147 obliges providers operating in Vietnam to designate a local point of contact, retain user data for at least 24 months, and supply that data to authorities on request.
The 24-hour takedown clock is the most enforcement-relevant clause. Where the previous regime gave platforms days to evaluate requests, the new window leaves little time for legal review or appeal. Vietnamese authorities have historically issued thousands of takedown demands per year — Meta's and Google's own transparency reports show Vietnam consistently among the top requesting jurisdictions in Asia — and the new tempo effectively pre-decides those disputes in the government's favour.
A regional pattern, not an isolated move
Vietnam's approach is not happening in a vacuum. Pakistan's Prevention of Electronic Crimes Act (PECA) amendments, passed in January 2025, expanded criminal liability for online speech and introduced new authorities to order takedowns. Indonesia's MR5 ministerial regulation, India's IT Rules 2021 and 2023 amendments, and Malaysia's social media licensing regime all push in a similar direction: identity-tied accounts, faster takedowns, and local accountability for global platforms.
Each regime is justified in domestic terms — scam prevention, child safety, electoral integrity, public order — and each captures genuine harms. But the cumulative effect across Asia is a regulatory architecture in which the threshold for state-mandated removal is dropping while the cost of cross-border compliance is rising. For users, the chilling effect compounds: a Vietnamese journalist or a Pakistani activist cannot easily route around either regime by switching platforms, because the same global platforms are now subject to similar pressures everywhere.
Why proportionate regulation matters here
The case for some platform accountability is reasonable. Coordinated inauthentic behaviour, fraud, and child-safety harms are real, and platforms that operate at national scale should answer to lawful processes. The problem with Decree 147 is not that it asks platforms to cooperate — it is that it does so without the proportionality checks that distinguish liberal-democratic intermediary liability regimes from authoritarian ones.
- No independent review. Takedown orders are issued by ministries, not courts, and the 24-hour window forecloses meaningful platform pushback.
- Real-name mandates that scoop in all speech. Identity verification is sometimes appropriate for high-risk activities (financial services, monetised political ads). Applying it to ordinary posting eliminates pseudonymity for dissidents, whistleblowers, and survivors.
- Data localization without a clear privacy purpose. Forcing local storage of personal data does not, by itself, improve user safety; it does make it easier for authorities to access that data.
What good regulation could look like
Vietnam's stated goals — reducing fraud, protecting minors, curbing impersonation — could largely be met with narrower tools: notice-and-action procedures with judicial backstops, transparency reporting obligations, age-assurance for minors, and targeted real-name requirements for advertisers and high-reach accounts. The EU's Digital Services Act, whatever its flaws, demonstrates that scaled platform accountability is achievable without dismantling pseudonymous speech or compressing review windows to the point of meaninglessness.
For global platforms, the strategic question is no longer whether to comply with regimes like Decree 147 — most will — but how to comply without becoming instruments of speech suppression. That means publishing granular transparency data on Vietnamese takedown requests, contesting overbroad orders where law permits, and resisting the slow normalization of 24-hour clocks as an industry default. For Vietnamese users, the next 18 months will decide whether Decree 147 stabilises as a narrow public-order tool or becomes the template that other Southeast Asian governments cite when they want to do the same thing.