Global Regulations Take Aim at Digital Disinformation

Governments and international organizations worldwide are rapidly developing frameworks to combat the spread of false information online while balancing free speech concerns. As disinformation continues to threaten societal stability and market integrity, corporate security leaders must understand emerging regulations to ensure compliance and prepare for their impact on crisis management, digital risk assessment, and organizational accountability.

The European Union has positioned itself at the forefront of digital content regulation with its Digital Services Act (DSA), enacted in 2022 and fully implemented in 2024. This landmark legislation specifically targets very large online platforms (VLOPs) with more than 45 million EU users, including tech giants like Meta, Google, X (formerly Twitter), and TikTok.

Under the DSA, these platforms face significant new responsibilities, including mandatory annual risk assessments, implementation of robust content moderation systems, and providing transparency about recommendation algorithms that can amplify misleading content. The regulation grants vetted researchers access to platform data to study disinformation patterns. Notably, non-compliance carries severe financial penalties—up to 6 percent of a platform’s global annual revenue, potentially amounting to billions for major tech companies.

In the United States, the approach relies less on binding regulation and more on guidance and collaboration. The Cybersecurity and Infrastructure Security Agency (CISA), operating under the Department of Homeland Security, focuses on disinformation that specifically threatens critical infrastructure, including election systems, healthcare networks, energy grids, and communications.

While lacking direct regulatory authority over private companies, CISA has developed initiatives like the Countering Foreign Influence Task Force and the Rumor Control site, which become particularly active during election cycles. The agency also facilitates public-private collaboration through the Joint Cyber Defense Collaborative (JCDC), providing early warnings about information operations linked to foreign state actors.

Brazil has taken a more stringent legislative approach with its proposed PL 2630/2020 bill, commonly referred to as the “Lei das Fake News” (Fake News Law). This pending legislation would require platforms to verify user identity, maintain records of message transmission, and create accountability mechanisms for content originators.

The Brazilian proposal goes further than many other frameworks by introducing the possibility of criminal penalties for individuals who knowingly spread false content that threatens democratic order or public safety. This has sparked significant controversy, with journalists, technology companies, and civil liberties organizations expressing concern that the law could potentially enable censorship or governmental overreach.

On the international stage, UNESCO is working to establish global standards that harmonize platform regulation while preserving freedom of expression. The organization’s 2023 Guidelines for Regulating Digital Platforms advocate for transparency, due process, and multi-stakeholder governance approaches to disinformation.

UNESCO has placed particular emphasis on media and digital literacy programs, aiming to equip citizens—especially youth and vulnerable populations—with critical thinking skills to identify and resist disinformation. The guidelines also encourage regulatory alignment between countries to prevent legal fragmentation that would allow disinformation to flourish in jurisdictional gaps.

For multinational corporations, this evolving regulatory landscape creates complex compliance challenges. Security leaders must not only track these diverse frameworks but also implement proactive strategies that satisfy the most stringent requirements across their operational footprint.

Industry experts suggest that forward-thinking organizations are already developing robust content verification protocols, implementing crisis communication plans specifically designed to counter disinformation, and training staff to recognize and respond to coordinated influence operations that could target their brands or sectors.

As regulations continue to evolve, the tension between combating harmful disinformation and protecting free expression remains a central challenge for policymakers, platforms, and security professionals alike.