CYBER SAFETY: SA Human Rights Commission urges stronger laws to protect children online

The law and institutions of South Africa were built for an earlier era of technology, and children are carrying the cost of the delay in reform. Commissioner Nomahlubi Khwinana of the South African Human Rights Commission (SAHRC) noted that with many children already online, the question was not whether they should be there, but if duty bearers were doing enough to keep them safe.

Khwinana was presenting an SAHRC report, Children’s Rights to Privacy and Safety on Online Platforms, that looked at legislative gaps for child protection, and the case for reform. The commission found that existing legal frameworks, including the Protection of Personal Information Act (Popia) and the Cybercrimes Act, did not address platform design choices such as addictive algorithmic feeds, default data-sharing settings or age verification at sign-up, allowing technology companies to profit from children’s engagement while bearing insufficient accountability for resulting harms.

The SAHRC report follows a stakeholders’ conference held on 28 March 2026 in Johannesburg, under the leadership of Khwinana, which brought together government departments, UN agencies, industry regulators, technology companies, civil society organisations and children themselves. The event highlighted the urgent need to safeguard children in an increasingly digital world.

“Children told us in March exactly what they need: safe-by-default platforms; reporting they can use; privacy they understand; and a seat at the table… The task is no longer to find the gaps. It is to close them together in the right way,” said Khwinana.

Gaps in legislation

There is no one policy framework in South Africa that deals with all aspects of children’s digital safety, but rather a web of different pieces of legislation that collectively seek to protect children from online harms. They include:

• The Cybercrimes Act, which makes it an offence to disclose intimate images without consent, and strictly penalises the manufacturing, distribution or possession of child sexual abuse material, among other crimes;

• The Protection of Personal Information Act, which treats children as a special category of the population requiring stricter safeguards, prohibiting the processing of a child’s personal information by apps, websites or social media platforms unless a “competent person” (a parent or legal guardian) gives consent; and

• The Film and Publications Act, which enables the Film and Publication Board to issue take-down notices for harmful content, hate speech or explicit material involving children, and mandates that commercial online distributors adhere to age-rating and classification laws to protect children from seeing mature, violent or sexually explicit digital media.

The Department of Communications and Digital Technologies published the Draft White Paper on Audio and Audiovisual Media Services and Online Safety for public comment in mid-2025. Daily Maverick asked the department about the timeline for implementation of the white paper, but had not received a response by the time of publishing.

Another piece of legislation in the works is the Draft National Artificial Intelligence (AI) Policy, which was withdrawn by Minister of Communications and Digital Technologies Solly Malatsi in April 2026 after it was discovered to contain AI-generated, fictitious academic citations. The target deadline for re-releasing the revised policy for a new public comment period is January 2027.

Among the recommendations in the SAHRC report are:

• The amendment of sections 34 and 35 of Popia by Parliament and relevant government departments to ensure children’s data is processed only with plain-language, meaningfully informed consent;

• Extending Popia’s mandate to address passive data collection, harmful platform design and cross-border enforcement;

• Amending the Children’s Act to address the abusive posting of children’s images and information by parents and caregivers;

• Amending the Films and Publications Amendment Act to cover algorithmically served content, livestreams and AI-generated child sexual abuse material, while also introducing mandatory age verification and child-friendly reporting tools;

• Empowering the Information Regulator and the Film and Publications Board to proactively assess platform safety by design, rather than relying solely on complaints-based enforcement; and

• Amending the Cybercrimes Act to address addictive algorithmic design and the commercial exploitation of children’s data for targeted advertising.

The commission also recommended an amendment to the Electronic Communications and Transactions Act to require age verification for SIM registration, with parental involvement for minors.

“Jurisdiction and cross-border reach is a huge policy question. Most platforms are incorporated abroad, so investigation and accountability is hard. We have recommended extra-territorial investigative powers [for regulators],” said Khwinana.

Responding to a question from Daily Maverick, Khwinana said that big technology companies such as Meta were represented at the conference in March, where they indicated a willingness to “come on board” in order to bridge the gap for children’s online safety.

“The beauty of it is really that they are there, they are willing to participate, but of course, with this report, we’re hoping that with the recommendations we have come up with, we’ll take it forward,” she said.

Children’s participation

The SAHRC emphasised the importance of including children’s voices in shaping the rules around online safety. Khwinana noted that a Children’s Declaration was adopted by child participants at the conference in March, affirming children’s rights and setting out a direct call to action for the government, technology companies, schools, parents and civil society.

“This declaration builds on many calls to action by children around the continent, including the Nelson Mandela Children’s Fund’s 2025 [Digital Justice] Summit, which involved 82 children,” she said.

The Nelson Mandela Children’s Foundation (NMCF) told Daily Maverick that the SAHRC’s most important findings concerned design, noting that laws regulated content, conduct and the processing of information, but did not reach how platforms were built.

“The timing is important. The African Union Model Law on Child Online Safety has been validated by member states and endorsed by ministers, yet it remains guidance rather than a treaty; South Africa should adopt it with amendments shaped by children as rights holders,” said the NMCF.

“The Nelson Mandela Children’s Fund is working with many stakeholders to align efforts across areas affected by AI and digital progress, under our programme titled Digital Justice. The [SAHRC] report notes that recommendations will reach portfolio committees, but their impact will depend on subsequent steps. We aim to continue engaging the commissioner... to strengthen key areas; no single entity can manage this issue alone, as the risk to children is too high.”

It highlighted the recommendation around regulation of design and the commercial use of children’s data, with regulators able to act before products launch and to investigate companies based abroad, as critical.

However, the NMCF also spotlighted certain issues that had not been included in the report, including the need clarify social workers’ roles in online safety incidents, and providing support to teachers by building digital safety education into school-based psychosocial and child-protection programmes.

It noted that “online harm is not separate from offline harm”.

“Children experiencing violence, abuse or neglect offline face heightened risk online, because digital spaces amplify the reach, frequency and duration of harm. South Africa should use existing child protection and psychosocial programme data, alongside evidence on children’s digital experiences, to identify vulnerable communities and target prevention,” the NMCF said. DM