Seismic Shifts on the Global Internet

Key Findings

Global internet freedom declined for the 16th consecutive year. Iran joined the world’s worst environments for internet freedom and marked the most significant deterioration during the coverage period, as authorities brutally repressed an antigovernment protest movement in January and enacted extreme online censorship after the United States and Israel attacked the country in February, starting a monthslong war. China and Myanmar remained among the world’s worst environments, while Estonia was the freest online environment.

Authoritarians advanced efforts to isolate their populations from the global internet. Iranian authorities imposed the longest nationwide internet shutdown Freedom on the Net has ever recorded, and restructured internet services in the country so that only a privileged few could access global platforms. In Russia, President Vladimir Putin consolidated control over internet service providers (ISPs) to maintain access to state-approved websites during internet shutdowns, as authorities enacted connectivity restrictions across the country.

Age assurance is reshaping the internet, as laws mandating age checks for social media use take effect around the world. Policymakers have pursued these measures at full speed since Australia’s under-16 social media ban, the first in the world, took effect in December 2025. As the laws entered into force, people encountered new barriers to online content and new risks to privacy and security. The world’s repressive leaders have already sought to leverage so-called age-gating mandates for their own ends, such as invasive online surveillance.

Policymakers took narrow approaches to challenges posed by AI-generated content, addressing meaningful problems but raising concerns about overreach in some countries. During the coverage period, policymakers advanced measures to address artificial intelligence (AI)-enabled impersonation, harassment, and child protection. These narrowly tailored frameworks aim to address concrete policy problems. However, government actors abused some laws in ways that curtailed online expression.

The ouster of repressive leaders has led to strong improvements in internet freedom. Bangladesh notched the largest improvement for the second year in a row as the country carried out reforms in the aftermath of the removal of Sheikh Hasina, whose decade-long rule was marked by expansive censorship and surveillance. The Gambia continued its steady gain in internet freedom since the ouster of its own repressive leader Yahya Jammeh almost a decade ago.

Internet freedom should serve as a guidepost in the AI era. The rapid adoption of agentic AI services, which perform tasks independently, is already transforming the internet. Around the world, societies will grapple with how to configure the internet in response. Those efforts should work to preserve open exchange and free expression as fundamental values.

Seismic Shifts on the Global Internet

The shape of the internet is changing, as governments across the ideological spectrum erect new barriers to how people access information and express themselves online. Authorities in Iran and Russia accelerated efforts to cut connections to the global internet over the past year, advancing a playbook for how repressive governments can isolate their populations in the digital era. Countries around the world implemented new measures to age-gate access to social media platforms, introducing a landmark change in how platforms operate and introducing new privacy and security risks.

Global internet freedom declined for the 16th consecutive year amid these significant shifts. During this report’s coverage period, from June 2025 through May 2026, conditions deteriorated in 16 of the 38 countries assessed, while 8 countries registered overall gains. The year’s largest decline occurred in Iran, which joined China and Myanmar as the world’s worst environments for internet freedom. Other significant declines were marked in Jordan, where the government cracked down on online discussion of conflicts in the region, and Nigeria, because of months-long localized internet disruptions affecting parts of Zamfara State. Bangladesh earned the largest improvement, followed by the Gambia, while Estonia was the freest online environment. Georgia’s status changed from Free to Partly Free, as authorities continued to suppress online activism and speech perceived to be critical of the ruling Georgian Dream party.

A Note about this Edition of the Report

Freedom House paused coverage of 34 countries in this edition of Freedom on the Net. The 38 countries covered by Freedom on the Net 2026 were selected to assess a range of environments across geography, regime types, and types of internet controls. Please consider making a donation to Freedom on the Net using the "Donate" button at the top of this page to support essential research on threats to freedom online.

A New Era of Digital Isolation

For years, the world’s most repressive governments have been working to separate people in their countries from the global internet, a phenomenon known as “internet fragmentation.” These efforts accelerated during the coverage period as authoritarians imposed severe censorship measures and prevented people from circumventing them. In Iran and Russia, expansive internet shutdowns, state-backed alternatives to censored platforms, and restrictions on commercial anticensorship technology point to the adoption of a harsher, more aggressive playbook for digital isolationism.

While Iranian authorities have long carried out repressive internet shutdowns, this year marked a further reconfiguration of the Iranian internet into a two-tiered system where most people are cut off from the global internet and only a privileged few are able to freely connect. This tiered internet system enabled Iranian authorities to maintain a stranglehold on online information amid successive crises but also to cater to the country’s elites, who still enjoy the benefits of the global internet.

In January 2026, demonstrations that had begun in Tehran over deteriorating economic conditions and dissatisfaction with the government spread across the country, organized partly through social media. In response, Iranian authorities killed thousands of people (with some estimates extending to 30,000 deaths) and imprisoned around 50,000, including some who had simply posted on social media to criticize authorities or support the protesters. Amid this wave of violent repression, the government imposed a near-total internet shutdown for 20 days to suppress the outpouring of popular dissent.

In February, Iranian authorities initiated the longest nationwide internet shutdown in Freedom on the Net’s 16 years of publication, as the United States and Israel launched military strikes against the country. For approximately 88 days, the majority of Iran’s population was prevented from accessing the internet, even as missiles dropped across the country. By May, telecommunications providers began offering Iranians “Internet Pro” packages to connect to the global internet, which were five times the cost of conventional service and required subscribers to consent to surveillance by authorities. The Iranian government also fought circumvention of the blackout, raising the prices of state-backed virtual private networks (VPNs), jamming signals from the satellite provider Starlink, and, in at least one case, violently arresting a man alleged to possess a Starlink terminal, resulting in his death.

Russian authorities also moved to sever the country from the global internet while maintaining public access to state-approved internet services. In September 2025, authorities introduced a “register of socially significant services” to which internet providers should maintain access during shutdowns, including state media outlets, state-aligned platforms like VK and Odnoklassniki, and the state-owned messenger Max. The government passed new rules in November that identified “external information influences” as a threat to the Russian internet and authorized the communications regulator Roskomnadzor to carry out a range of censorship measures in response. In February, the government passed a law authorizing the Federal Security Service (FSB) to enact shutdowns on receipt of a presidential decree—effectively empowering Vladimir Putin to shut down the internet for any reason.

The slate of Russian censorship laws was accompanied by an escalation of technical restrictions on the internet. Authorities enforced extensive short-term mobile internet shutdowns across the country around the commemoration of the Victory Day holiday in May 2026, and people reported that even websites listed as “socially significant services” were not accessible during the restrictions. Longer-term restrictions on mobile internet were also reported, including a 19-day shutdown in Moscow in March 2026. In November 2025, authorities restricted mobile internet in parts of Ulyanovsk Oblast, which officials stated would last until the end of the “special military operation,” the term Russian authorities use to refer to the full-scale Russian military invasion of Ukraine. The impacts of these shutdowns were exacerbated by escalating restrictions on VPNs, which can be used to sidestep internet censorship. In March, authorities reportedly instructed ISPs to bar access to people using VPNs, and the research group RKS Global soon after found that many mainstream Russian services were surveilling users for indicators of VPN traffic.

Other governments introduced new efforts to disconnect people from the global internet. In Kyrgyzstan, where authorities have increasingly persecuted independent media, President Sadyr Japarov enacted a novel measure granting a state-run ISP a monopoly on international internet traffic. Under a July 2025 presidential decree, all service providers in the country were required to route international internet traffic to the telecommunications company ElKat, which Kyrgyzstani authorities had nationalized earlier that month. The ability to force all traffic through a state-controlled entity effectively enables the authorities to surveil and censor with ease. While the original decree specified that this “temporary monopoly” would last for a one-year period starting in August 2025, authorities proposed extending it at the end of that term, in August 2026.

As authoritarians pursue internet fragmentation as a method of political control, the global internet offers a precious space for people living under repression to access independent information and express themselves freely. In these contexts, technology that enables people to sidestep government censorship becomes a lifeline. Investments in anticensorship innovation and service delivery are sorely needed to ensure that that lifeline reaches those who need it most.

Age-gating Transforms the Internet

Governments around the world have advanced policies to prevent minors from accessing certain internet content, usually citing concerns about children’s safety and mental health. Policymakers in 10 of the 38 countries covered by FOTN had proposed, passed, or implemented age-assurance laws for social media platforms or other nonpornographic online content as of June 2026. Age-assurance mandates require services to deploy certain methods to assess the likely age of users, including methods that involve the collection of sensitive personal data like face scans and photos of government identification. While protecting children online is an important policy aim, the first wave of age-assurance laws presented new risks for privacy and security and threatened online anonymity.

What is age assurance and how does it work? 

“Age assurance” describes methods and technologies that internet services, including websites or social media platforms, use to assign, estimate, or verify a user’s age. As governments around the world adopt laws designed to protect children on the internet, performing age assurance in a privacy-protecting way has become a pressing rights and cybersecurity issue.

Age-assurance laws require internet services to confirm a user’s self-attested age. The methods currently available for age assurance rely on previous mass data collection or involve processing sensitive information. Because the process can be technically complicated and expensive, many companies contract all or some age-assurance functions to third-party providers to manage costs, convenience, and legal liability.

The largest social media platforms collect extensive data from their users and are able to deploy “age estimation” or “age inference” techniques: trawling and analyzing data for behavioral patterns or other signals that indicate whether a user is an adult or a minor. This is possible when a service retains data that can be analyzed to estimate a user’s age, such as the content of queries and the lifespan of an account. Companies can also purchase data collected by data brokers or signals from another third party, like credit card companies, to attempt age estimation.

Other methods require the provider to capture and analyze sensitive personal information. Companies can estimate a person’s age through face analysis, which entails scanning a photo of the user’s face for indicators of age, like facial hair or wrinkles; this method often results in false positives for older teens and false negatives for young adults. Companies can also process a government-issued identification card, a method called “age verification,” which often requires a face photo for identity verification purposes.

The cybersecurity risks of age assurance only grow when a third-party company is involved. For example, the social platform Discord disclosed in October 2025 that a third-party customer service vendor had been compromised. The vendor processed requests from Discord users to challenge the platform’s age-estimation results through age verification, and 70,000 government ID photos collected for those appeals may have been exposed in the breach.

Australia’s under-16 social media ban, the first of its kind, entered into force in December 2025. The law requires covered platforms to take “reasonable steps” to verify the age of users and prevent those under the age of 16 from creating or owning accounts; guidance from Australia’s eSafety commissioner set out a range of methods deemed to be reasonable steps. Australian officials designated 10 major social media platforms—including Facebook, Instagram, Snapchat, and TikTok—as covered by that law, while several other companies voluntarily complied, such as major dating services. The law sets out privacy preservation and data minimization (collecting only what is deemed necessary data) as principles to guide the implementation of age-gating.

Initial implementation of the law resulted in the mass deletion of accounts—around 5 million as of March 2026, according to the eSafety commissioner—though broader impacts on freedom of expression and access to information were not clear. Early surveys and news reports indicate that teens have evaded the ban at significant rates, sometimes by manipulating age-estimation and age-verification algorithms. Eighty-five percent of children under 16 surveyed in one early study reported that they continued to use social media platforms after the ban; some may have circumvented or supplied false information to age checks to retain access, as one-fifth of those surveyed reported submission of a face photo and one-tenth reported use of a government ID as part of an age-assurance process. Another study found over 60 percent of 14- and 15-year olds surveyed were still using social media, some 57 percent of whom said they manipulated age-verification checks to maintain access.

Indonesian lawmakers passed and implemented an under-16 social media ban in March 2026, applying to “high-risk” platforms. The government had previously passed an age-assurance framework that adopted a risk-categorization approach, requiring companies to assess whether their platforms had features deemed “high risk” for children, like contact with strangers or pornographic content. Indonesian officials stated that some 4.7 million accounts were deleted by June, 4.1 million deletions of which were reported by TikTok. Meanwhile, Indonesian authorities have significantly lagged in implementing the country’s data-protection law, and civil society organizations in the country raised concerns that the rapid implementation of age-assurance methods would expose children’s data, such as face or identification photos, to new risks.

In the United States, a patchwork of state-level laws illustrates the tension between age-assurance laws and protections for freedom of expression. Nineteen of 50 states had passed a social media age-gating law as of June 2026, though implementation of most of them was paused in response to lawsuits. In most cases, district courts found that social-media-focused age-assurance laws would likely violate the First Amendment on the basis that they require differential treatment for different forms of online content (that is, the laws create a burden for websites featuring certain kinds of content, like social networking, and exempt others, like professional networking).

In contrast, the Supreme Court ruled in the June 2025 Free Speech Coalition v. Paxton case that a Texas law mandating age verification for websites hosting “speech that is obscene to minors” did not violate the First Amendment. The court’s ruling in Paxton affirms the many state-level age-gating requirements for adult content. In March 2026, Utah passed a law that required adult website hosts to analyze traffic to determine whether Utah-based visitors had employed VPNs to evade the state’s law mandating age assurance for adult content. The technology used by commercial VPNs is deployed widely for privacy and security, and the Utah law poses serious risk that website hosts would be forced to treat encrypted internet traffic as suspect.

A Note on the United States Score

The United States scored 73 out of a possible 100 points in Freedom on the Net 2026. While the score did not change this year, restrictions on civic space that drove a three-point decline in the previous edition have persisted.

Federal authorities continued to exert pressure on digital activism and other online speech expressing criticism of the government. For example, federal law enforcement carried out extensive surveillance of online activists mobilizing in response to the presence of Immigration and Customs Enforcement (ICE) agents in Minnesota, and prosecuted online journalists who reported on those protests.

US officials continued to enforce steeper penalties on people for their online activities than in previous years. In one case, Tennessee police arrested and jailed a man for 37 days after he posted a meme on Facebook that made light of the murder of conservative activist Charlie Kirk.

The government advanced some positive efforts to address online harms. In May 2026, content-removal provisions of the TAKE IT DOWN Act entered into effect. The law, which President Donald Trump signed the previous year, criminalized the nonconsensual distribution of intimate images, an important step to combatting online sexual abuse. However, the law’s content-removal framework was broadly framed in a way that civil society organizations argued may be prone to abuse, particularly its lack of safeguards against false reports.

Age-assurance laws also open a new potential vector for abuse, with identification requirements enabling bad actors and repressive governments to create a footprint of people’s online activities. Turkey’s parliament passed a bill in April 2026 that would restrict children under 15 from social media platforms, though it was not fully approved by the end of the coverage period. The bill would enforce age-gating for social media platforms solely through the e-Devlet portal, a government-run digital identity system, effectively tying all social media accounts to individuals’ real names. People in Turkey are routinely arrested and imprisoned over their online expression, particularly for criticism of President Recep Tayyip Erdoğan, and the proposed e-Devlet age-assurance framework poses significant risks for Turkish citizens who turn to the internet to discuss problems in their country.

The Chinese Communist Party (CCP) has adopted the language of child protection in its long-standing efforts to erode anonymity on the Chinese internet. Chinese authorities have mandated real-name registration for internet services since at least 2012 as part of the CCP’s repressive censorship regime. In June 2025, Chinese officials promulgated a draft regulation that sets out a laundry list of “harmful” information that internet services should be required to suppress for minors, largely aligned with the maintenance of CCP narratives about its own governance and China’s place in the world.

The speedy adoption of age-assurance social media bans represents the most significant live experiment in internet regulation in years, and the consequences for internet freedom demand due consideration. The current state of age-inference and age-verification technology, for example, cannot mitigate the privacy and security risks introduced by their large-scale use; further technical research is needed to advance age-assurance methods that are truly privacy-preserving. Meanwhile, children have evaded age-assurance mechanisms at considerable scale, remaining connected to social media platforms that are still rife with problems of the digital age. A rights-respecting pursuit of child safety requires action by policymakers and the private sector to resolve

AI Regulation in Practice

Much of the policy conversation about the AI boom has centered around the value of comprehensive regulatory frameworks and safety concerns. Recent regulation has taken a narrower approach aimed at solving particular issues, such as impersonation or harassment. Some measures raised concerns about overreach, such as in India and Mexico, as described below. Broader concerns persist about how AI models can reinforce censorship practices of authoritarian regimes like those that rule Russia and China.

Child protection: Lawmakers sought to limit children’s access to AI services deemed especially sensitive. For example, Australia’s eSafety commissioner announced in September 2025 that the country’s under-16 age-assurance framework would apply to certain AI companies, particularly those that host “AI companions” designed to simulate friendship or romantic relationships. While the privacy and security risks around age assurance persist, early research on AI companion services indicate they threaten emotional and psychological harms for vulnerable users, particularly minors.

Online harassment: Bad actors abuse AI tools to generate sexual imagery of people without their consent. Governments have rightly taken up efforts to push tech platforms to remove these images and create barriers to their generation. UK authorities amended a law penalizing people who create or commission nonconsensual imagery to include AI tools in February 2026, and launched an investigation into X’s Grok service after the platform failed to remove such images, including abuse material depicting children.

Labeling: In February 2026, the Indian government passed new rules requiring technology companies and social media platforms to ensure that “synthetically generated information” content features prominent labels. While labeling AI-generated content is a positive step, the new law also mandated social media platforms to remove any content flagged by the authorities within 3 hours, reduced from 36 hours under previous law. The Indian government has built expansive infrastructure for internet censorship, prompting concerns from civil society that the new rules would be abused to silence online content deemed unfavorable by the government, including independent journalism and satire, particularly because the 3-hour period limits careful evaluation of reported material, forcing platforms to err on the side of removal.

Impersonation: Policymakers around the world expressed concern about how generative AI tools could be used to impersonate people to cause reputational harm or carry out scams. In some countries, lawmakers sought to criminalize such impersonation. For example, in Mexico, the state of San Luis Potosí reformed the penal code to bar unauthorized AI-generated use of a person’s image or voice, as well as the intentional dissemination of disinformation generated through AI. Despite a carveout for journalism, authorities used the law to arrest and detain two online journalists in May 2026, apparently because they reported on a video in which a local gang accused the state’s governor of corruption; the governor said the video was AI-generated.

Government Transitions Drive Improvements

Improvements in Bangladesh and the Gambia showcased how mass movements that overthrow repressive leaders can drive short- and long-term gains in internet freedom.

Bangladesh marked the strongest improvement in Freedom on the Net 2026, as the country’s interim government continued to implement an agenda of reforms since a mass uprising ousted former Prime Minister Sheikh Hasina in August 2024. The country saw its first year with no internet shutdown since 2016, marking a stark contrast to Hasina’s Awami League (AL) government, which routinely cut off internet connectivity during opposition rallies and protests including during the 2024 uprising. The new interim government reportedly established a prohibition on the shutdown of telecommunications networks in the Bangladesh Telecommunication (Amendment) Ordinance 2025, passed that December, though the final text of the law has not been published and the legislative process was rushed and nontransparent.

However, the interim authorities also sought to suppress real or perceived support for the AL, sometimes deploying the former government’s same repressive tactics. The interim government banned the AL from participating in the February 2026 general election. More than 280 journalists, some of whom work for online outlets, faced politicized charges as of May 2026, with most cases linked to coverage of the 2024 uprising perceived to be too favorable toward the AL. In December 2025, rumors spread online that accused Prothom Alo and The Daily Star, the country’s two most prominent independent media outlets, of pro-India sentiment—shorthand used as a signifier of support for Hasina—and mobs attacked their offices, burning down the buildings and endangering the journalists who worked there.

The Gambia continued its long-term trajectory of democratic gains in the aftermath of the ouster of Yahya Jammeh nearly a decade ago. The environment for online expression continued to improve, as Gambian officials worked with civil society to loosen the censorship framework of the Jammeh era. While bloggers and online journalists occasionally reported arrests or violence in retaliation for their work in recent years, no such incidents were reported during the coverage period. Separately, the government of President Adama Barrow passed a landmark data-protection law in December 2025, marking another significant legal reform as the Gambia rebuilds its democratic institutions. 

Improvements in Bangladesh showcase the gains brought by a mass mobilization reversing long-standing practices of digital repression, though significant challenges to a sustainable democratic transition remain for the country’s new government, which assumed power after the longtime opposition Bangladesh Nationalist Party won the February 2026 election. The Gambia, which notched steep improvements in the immediate aftermath of the post-Jammeh transition, offers a model of such an effort. The country’s recent trajectory reflects steady efforts to repair its democratic institutions, and offers a lesson in how long-term internet freedom improvements require sustained investment and collaboration with civil society.

Freedom on the Internet of the Future

The acceleration of digital isolation as a tool of authoritarian governments and the rapid adoption of age-assurance frameworks pose novel challenges, even as the rise of AI services that perform tasks autonomously promises transformative consequences for the internet. Around the world, societies will grapple with questions about how to ensure that people in repressive environments can stay connected, balance the need to build safer online spaces against the right to free expression, and ensure access to reliable information as AI services become more deeply embedded in daily life.

The societal response to these challenges will shape how people exercise and access their fundamental rights online. New barriers to online spaces and the rapid adoption of AI services threaten to undermine the power of exchange and expression, benefits that have embedded internet services deeply in today’s societies. Interconnected networks enable people to learn and speak more freely, building stronger democratic systems even when powerful actors control other sources of information. This is the long vision of internet freedom and should serve as a guidepost for the internet of the AI era.