A South African Human Rights Commission report calls for sweeping legal reform, arguing that current laws police what children see online but ignore how platforms are built to hold their attention and harvest their data.
Published 26 October 2026 · 12:31 GMT
A South African Human Rights Commission report calls for sweeping legal reform, arguing that current laws police what children see online but ignore how platforms are built to hold their attention and harvest their data. The South African Human Rights Commission (SAHRC) launched its report, Children's Rights to Privacy and Safety on Online Platforms: Legislative Gaps and the Case for Reform , on 22 October 2026, calling for wide-ranging amendments to data protection, films and publications, cybercrime and telecommunications laws.
On 22 October 2026, the South African Human Rights Commission (SAHRC) launched its report, Children's Rights to Privacy and Safety on Online Platforms: Legislative Gaps and the Case for Reform, calling for wide-ranging amendments to data protection, films, cybercrime and telecommunications law. Reporting on 26 October, the Daily Maverick quoted Commissioner Nomahlubi Khwinana: the law was built for an earlier era, and children carry the cost of the delay. The report follows a 28 March 2026 Johannesburg conference, led by Khwinana, that gathered government, regulators, companies, civil society and children.
The Commission found children in a digital environment not designed with their best interests in mind: personal data routinely collected without meaningful consent despite the Protection of Personal Information Act (POPIA); reporting tools largely inaccessible to children; and parents often lacking digital literacy. The harms include cyberbullying, harmful content, exploitation, data misuse and privacy violations, including unauthorised sharing of children's images, among them graphic material involving scholar transport accident victims. No single law governs children's digital safety: the Cybercrimes Act, POPIA and the Film and Publications Act form a web, but none reaches design choices such as addictive feeds, default sharing or age verification at sign-up.
The report says what should change, not when. The Draft White Paper on online safety went out for comment in mid-2025, and the department had not answered questions about its timeline, the Daily Maverick reported. The Draft National Artificial Intelligence Policy was withdrawn by Minister Solly Malatsi in April 2026 after synthetic, fictitious citations were found in it, with a revised version targeted for January 2027.
Two unknowns will decide whether the report bites: jurisdiction, since most platforms are incorporated abroad and the proposed extraterritorial powers are untested; and industry cooperation, since Meta's willingness to 'come on board' in March is not compliance under a statute.
The report shifts the argument from content to design. Existing law polices what appears on screen, not how platforms are built, as the Nelson Mandela Children's Fund told the Daily Maverick. A feed maximising time-on-site, a default sharing a child's data, a sign-up with no age check: product decisions that scale to every child at once. Regulating design means regulating the factory.
The statutes predate the feed: written for websites and uploads, not infinite feeds, livestreams and synthetic material. The Commission's fix is structural: amend the Films and Publications Amendment Act to cover algorithmic content, livestreams and synthetic abuse material, with mandatory age verification and child-friendly reporting; amend the Cybercrimes Act for addictive design and targeted-advertising data exploitation, with proactive regulatory assessment. The African Union Model Law, validated but still guidance rather than treaty, is the continental frame South Africa could adopt.
The report proposes a change of regulatory posture, not just of rules. A complaints-based system waits for a harmed child to navigate a tool the Commission calls inaccessible; safety by design requires examination before harm. That is why proactive assessment and extraterritorial reach matter most: they make the state an inspector before the product ships, not a referee after the foul. The SIM-registration proposal extends the same logic to the front door of connectivity. Nor does the report treat children as passive victims: its Children's Declaration, adopted by child participants in March, affirms their rights under the Constitution, the Children's Act and the UN Convention on the Rights of the Child. South Africa's child-protection debates, this report puts that overlap at the centre of digital policy.
The first ripple runs across borders. If Pretoria legislates safety by design for platforms incorporated elsewhere, enforcement will depend on cooperation, market leverage or the proposed extraterritorial powers, none guaranteed. Analysts note platforms respond unevenly by market size, so a mid-sized market's rules can draw slower, more minimal compliance. A continental standard, adopted by several states at once, is harder to treat as a local exception. The second ripple runs toward overreach: age verification, SIM checks and proactive product assessment all touch privacy, access and expression, and the data collected to verify a child's age could itself become a new privacy risk. Getting that balance wrong would repeat, in the name of safety, the very data-harvesting the Commission condemns, as the Bureau's coverage of South Africa's digital identity debates shows.
Three markers will show whether this report becomes law or literature. The first is parliamentary: the tabling of a POPIA amendment bill, sections 34 and 35, plain-language consent, passive collection and cross-border enforcement. The second is executive: the timeline for the online safety White Paper and the revised AI policy promised for January 2027. The third is regulatory: any move toward proactive assessment, and any platform response beyond willingness.
The next chapter belongs to committees, not headlines: watch for the amendment bills, the White Paper's plan, and the first enforcement action taken without waiting for a complaint. The Factbook record on South Africa will track the framework as it changes.
How the West reads Pretoria's design argument Western regulators will recognise the argument: they are making a version of it themselves. Europe's Digital Services Act and Britain's Online Safety Act have pushed platforms toward age assurance and risk assessment, and Geneva-based observers frame the South African report in rights terms: privacy, dignity and safety alongside children's rights to access information, express themselves, learn, play and participate online. From this vantage point, Pretoria's report is a latecomer to a shared realisation: content moderation alone cannot carry child protection.
How the East reads it: Singapore's tiered safeguards, not a ban Singapore, under its Online Safety Act in force since 2023, has required app stores to verify users' ages for restricted material since April 2026, and its Online Safety Commission, launched in June 2026, can order removals and account restrictions. Channel NewsAsia reported in August 2026 that Singapore plans age checks, daily time limits and limits on messages from strangers, with legislation expected in early 2027, and that an engagement of more than 2,000 parents and young people favoured tiered access over an outright ban. For Pretoria, the Singapore path offers a template: safeguards calibrated by age.
How the Global South reads it: children as rights holders, not just victims From the Global South, the report's most distinctive feature is who wrote its moral core. The Children's Declaration was adopted by children, not drafted for them, and the Nelson Mandela Children's Fund's Digital Justice programme, whose 2025 summit involved 82 children, insists children shape the rules they live under. The African Union Model Law, validated by member states and endorsed by ministers but still guidance rather than treaty, is the continental instrument waiting for national adopters.
It is the South African Human Rights Commission's conference report, Children's Rights to Privacy and Safety on Online Platforms: Legislative Gaps and the Case for Reform, launched on 22 October 2026. It finds that current laws leave children exposed to online harms and calls for wide-ranging amendments across data protection, films and publications, cybercrime and telecommunications law.
The Commission wants sections 34 and 35 of the Protection of Personal Information Act amended so children's data is processed only with plain-language, informed consent, plus changes to the Children's Act, the Films and Publications Amendment Act, the Cybercrimes Act and the Electronic Communications and Transactions Act, covering algorithmic content, livestreams, synthetic abuse material and SIM registration.
Safety by design means platforms must be built to protect children from the start, rather than fixing harms after complaints. It covers safe default settings, age verification at sign-up, limits on addictive algorithmic feeds, child-friendly reporting tools, and proactive assessment by regulators before products cause harm, instead of enforcement that only reacts afterwards.
The Commission says it will engage parliamentary portfolio committees and government departments to advance the recommendations. The next markers are a POPIA amendment bill, the implementation timeline for the audiovisual and online safety White Paper, and the revised national AI policy targeted for re-release in January 2027 after its withdrawal over fictitious citations.
