A Consolidated Law, a Compressed Clock
Vietnam's Law on Cybersecurity No. 116/2025/QH15 took effect on July 1, 2026, merging the country's 2018 Cybersecurity Law and 2015 Law on Network Information Security into a single statute of eight chapters and 45 articles. The National Assembly passed it on December 10, 2025 with 91.75% support — 434 of 443 delegates — a margin that reflects how little domestic political friction Hanoi's internet-governance agenda now faces (Baochinhphu.vn).
The operational core is speed. Platforms must "block or remove information" within 24 hours of a request from the Ministry of Public Security's specialised cybersecurity forces; in cases framed as threatening national security, that window compresses to six hours. User-data disclosure requests carry a parallel structure — 24 hours standard, three hours if security agencies invoke urgency (Rajah & Tann Asia). What counts as prohibited — including incitement and content "infringing national security, public order, and social safety" — is not exhaustively defined in the statute itself; the specific category list is delegated to the Prime Minister, meaning the scope of banned speech can shift by administrative decree rather than legislative amendment.
Identity as Infrastructure
The law builds on Decree 147/2024/NĐ-CP, which took effect December 25, 2024 and already requires any platform drawing more than 100,000 monthly Vietnamese visitors to authenticate accounts against a domestic mobile number or national ID, with a 90-day window to verify existing users. Only verified accounts may post, comment, livestream, or share (Ministry of Science and Technology portal). The new Cybersecurity Law extends that logic: the Ministry of Public Security is now tasked with drafting a Law on Electronic Identification and Authentication and with researching, by Q3 2026, how to link VNeID — the national digital-identity platform — directly to social media accounts.
The Case Regulators Would Make
It's worth stating that case fairly. Vietnam's digital economy is large and fast-growing — officials project it will contribute roughly 14.5% of GDP in 2026 — and fraud, impersonation, and scam networks scale with that growth across Southeast Asia. A verified-identity layer genuinely does make it easier to trace and prosecute account-takeover fraud, deepfake impersonation, and coordinated scam operations, categories the law explicitly names alongside child-safety provisions and, for the first time, protections for elderly and cognitively vulnerable users. Platforms operating in any jurisdiction face real pressure to act fast on content that facilitates ongoing harm, and a fixed 24-hour clock at least gives providers a predictable compliance target rather than open-ended discretion.
Where the Design Breaks
The problem is not that Vietnam wants faster takedowns or fraud-resistant accounts — it's that the law bundles a content-speed mandate with a blanket identity mandate, when the two serve different purposes and warrant different safeguards. A 24-hour removal window for content that a court or an independent process has found unlawful is defensible. A 24-hour window triggered by a police request alone, for a category of "incitement" whose boundaries are set by executive decree rather than statute, is not the same thing — it is a takedown power with no judicial checkpoint.
The identity mandate compounds that risk rather than offsetting it. More than 30 civil society organizations, coordinated by Access Now, argue the requirement breaches Vietnam's obligations under the International Covenant on Civil and Political Rights, which protects anonymous expression as part of the right to hold opinions without interference. Their strongest point isn't abstract: they note that Vietnam's military-linked online-influence unit, publicly known as "Force 47," can continue operating without the identity exposure ordinary users now face — a structural asymmetry between state speech and citizen speech that a genuinely security-focused law wouldn't need (Access Now).
The Compliance Reality Already Visible
Decree 147 offers a preview of enforcement intensity. The Information Technology and Innovation Foundation found that Facebook's content-restriction actions in Vietnam rose 983% in one reporting period under the decree, with major platforms now complying with 90–95% of government takedown requests — a compliance rate that leaves little room to distinguish good-faith safety removals from politically inconvenient ones (ITIF). The new law also raises the minimum share of digital-transformation budgets that public and private entities must dedicate to cybersecurity from 10% to 15%, a compliance cost increase that lands hardest on smaller domestic platforms least equipped to build parallel authentication and content-review infrastructure — while doing little to constrain the state-favored operators ITIF flags as comparatively unburdened.
A narrower law — real-time removal for court-verified illegal content, identity verification scoped to specific fraud-risk categories rather than all speech, and a published, legislatively fixed list of prohibited-content categories instead of one set by decree — could deliver most of the security benefit Hanoi is after without collapsing the distinction between platform safety and state surveillance capacity. As written, the law optimizes for enforcement speed at the direct expense of the due-process and anonymity safeguards that make online speech resilient to abuse from either private bad actors or the state itself.