An F&B client came to me after a complaint had already landed with ASAS. They had been gifting a local influencer free meals in exchange for posts for months. No written agreement. No disclosure hashtag. No one had told them that counted as a commercial arrangement under Singapore’s social media marketing rules.
That situation is more common than it should be. With 5.13 million social media user identities in Singapore (85% of the population) and social media ad spend hitting SG$573.5 million (approx. US$427 million) in 2023, the platforms are too commercially significant for regulators to leave unattended.
This article covers the legal obligations Singapore businesses carry when marketing on social media: data protection, advertising standards, influencer disclosure, copyright, and content liability.
If you want a more strategic conversation about building compliant campaigns, MediaOne, a social media marketing agency in Singapore, can help frame that thinking.
Key Takeaways
- Singapore’s social media marketing rules span multiple laws simultaneously, including the PDPA, the Spam Control Act, the SCAP, the Copyright Act 2021, and POFMA. No single piece of legislation covers everything.
- Influencer marketing is regulated regardless of whether payment is involved. Gifted products, complimentary experiences, and affiliate arrangements all require clear and prominent disclosure.
- Data collected through social media campaigns carries real legal obligations around consent, purpose limitation, and retention. Competitions, lead forms, and retargeting pixels are all in scope.
- Compliance failures in Singapore are rarely deliberate. They are almost always the result of undocumented processes, unbriefed teams, and assumptions about who was responsible.
- Businesses in regulated sectors such as finance, healthcare, and property face additional advertising obligations that build on the general framework.
Before we get into the specifics, it is worth being precise about what we are talking about.
The Advertising Standards Authority of Singapore (ASAS) defines social media marketing in its broadest sense as any form of marketing communication that incorporates user interactions the consumer agrees to display and share, promotes the interests of any person, product, or service for a commercial purpose, and is paid media.
This is broader than most business owners assume. It covers:
- Paid advertisements on Facebook, Instagram, TikTok, and LinkedIn
- Sponsored content by influencers or brand ambassadors
- Affiliate marketing arrangements
- Competitions, giveaways, and prize draws
- Email newsletters and direct messaging campaigns
If there is money, free product, a discount, or any material benefit involved in the creation of content about your brand, that content is captured by these guidelines. Understanding where those lines sit is the first step in getting your compliance right.
Understanding the Legal Framework
Singapore’s regulatory environment for social media is well-developed and enforced by multiple bodies. The challenge for most businesses is that no single law covers everything. You have to be across several simultaneously.
The Personal Data Protection Act (PDPA)
The Personal Data Protection Act is the most consequential piece of legislation for businesses running social media campaigns. It governs how personal data is collected, used, disclosed, and protected.
For marketers, the key obligations are:
- Consent: You must obtain clear and informed consent before collecting personal data. This applies to lead generation forms, competition sign-ups, newsletter subscriptions, and retargeting pixels on landing pages. Pre-ticked boxes do not constitute valid consent.
- Purpose limitation: Data collected for one purpose cannot simply be repurposed. If someone enters a Facebook competition, their data cannot be quietly funnelled into a separate EDM list without their explicit permission.
- Retention limitation: You cannot keep personal data indefinitely. If you no longer need it for the purpose it was collected, it should be deleted.
- Breach notification: Under amendments that took effect from 2021, organisations are required to notify the Personal Data Protection Commission (PDPC) and affected individuals if a data breach poses significant harm. This includes security incidents affecting data held in your CRM, email marketing platforms, or social media advertising accounts.
Penalties are significant. The maximum fine is SGD 1 million or 10% of annual turnover, whichever is higher.
In October 2025, Marina Bay Sands was fined SGD 315,000 for a data breach. ShopBack was fined SGD 74,400 following a data breach that affected more than 1.4 million users. The PDPC does not draw a distinction between an enterprise and an SME when determining culpability.
The Spam Control Act
The Spam Control Act regulates unsolicited commercial electronic messages. For businesses using DMs, WhatsApp broadcasts, or bulk SMS as part of their social media strategy, this matters.
Any unsolicited commercial message sent in bulk must carry an <ADV> label in the subject line, include clear sender identification, and provide a functional unsubscribe mechanism. Recipients who request removal must be removed within ten business days.
The Act also covers the Do Not Call (DNC) Registry. Before sending telemarketing messages to Singapore phone numbers, you must check whether the number is registered. Failure to comply can result in civil penalties.
I see this overlooked frequently by businesses running WhatsApp marketing campaigns. The channel feels informal. The legal obligations are not.
The Singapore Code of Advertising Practice (SCAP)
The ASAS administers the Singapore Code of Advertising Practice, which applies to all advertising, including social media content. Its core principles are straightforward:
- All advertising must be legal, decent, honest, and truthful
- Sponsored content must be clearly identified as such
- False or exaggerated claims are prohibited
- Endorsements and testimonials must be genuine
The SCAP is where influencer marketing gets particularly complex, and I will address that in detail shortly.
Regulatory Authorities
Two bodies matter most here:
The Infocomm Media Development Authority (IMDA) oversees digital content standards and online platforms, including the enforcement of the Online Safety Act and the Code of Practice for Online Safety introduced in 2023. This is the body with authority over the platforms themselves, but businesses that produce harmful or non-compliant content can still attract scrutiny.
The Personal Data Protection Commission (PDPC) enforces the PDPA. It actively investigates complaints and issues financial penalties. Its decisions are published, which means a compliance failure can become a public record.
For businesses in regulated sectors, there are additional layers:
The Monetary Authority of Singapore (MAS) introduced new guidelines on the Standards of Conduct for Digital Advertising Activities, which took effect in March 2026, with specific implications for financial services firms running social media campaigns.
The Health Sciences Authority (HSA) governs healthcare and pharmaceutical advertising. The Council for Estate Agencies (CEA) governs property marketing. These sector-specific rules layer on top of the general ones.
Most businesses in Singapore are running some form of social media activity. Fewer have mapped that activity against the actual legal obligations it triggers. The rules are not buried in obscure legislation. They are enforced, publicly documented, and applied to businesses of every size.
What follows covers the four areas where I see the most gaps: data protection, advertising standards, content rights, and communications compliance.
Data Protection and Privacy in Practice
Most data protection failures I see in social media campaigns come down to two things: forms without proper consent language, and data that goes somewhere the user did not expect.
Practically speaking, if you are running a Facebook lead generation ad, the form should clearly state what data you are collecting, why you are collecting it, and how it will be used. Your privacy policy needs to be accessible, not buried in a footer. If you are using a retargeting pixel, your website should inform visitors of this.
If you are collecting data from competitions or giveaways run on Instagram or TikTok, note that Singapore’s PDPA applies regardless of the platform’s headquarters. The relevant question is whether the data subject is in Singapore.
The phrase I use with clients is: obtain it properly, use it only for what you said, protect it, and delete it when you no longer need it. If you can answer yes to all four, you are in the right direction.
Advertising Standards and Transparency
The most common breach I see under SCAP is the failure to distinguish between commercial content and personal opinion. This problem is most acute in influencer marketing, but it also affects businesses that post testimonials, share UGC without context, or run native advertising that blends with editorial content.
The principle is clear. If someone is paid, gifted a product, invited on a complimentary trip, or given any material benefit in exchange for posting about your brand, that commercial relationship must be disclosed. Clearly. Prominently. Without requiring the audience to scroll past a string of hashtags to find it.
The Consumer Protection (Fair Trading) Act adds another layer. Any false or misleading claim about a product or service, whether made through organic content, paid advertising, or influencer posts, can attract action from the Competition and Consumer Commission of Singapore (CCCS) or CASE.
Most businesses focus their compliance attention on consent forms and disclosure hashtags. What gets less scrutiny is the content itself — what you publish, what you share, and whether you actually have the right to use it. Singapore’s legal framework covers all three, and the exposure is more practical than most marketers assume.
Intellectual Property Rights
This is where businesses quietly get into trouble.
Using an image found on Google, a track from Spotify as background music in a Reel, or a clip from a film in a TikTok video all carry potential copyright liability under Singapore’s Copyright Act 2021.
Original content, whether written, visual, or audio, is automatically protected. You do not need to register it. If you did not create it and you do not hold a licence for it, you should not use it commercially.
For user-generated content, the rules are more nuanced. If a customer posts a photo featuring your product and you want to repost it, you should obtain explicit permission from the creator before doing so. A comment saying “tag us, and we might feature you” does not constitute a blanket licence.
If you are working with freelancers, photographers, or content creators, your contracts should define who owns the content and how it may be used. This is something many SMEs skip when briefing creators informally.
For trademark considerations, be careful when referencing competitor brand names or using logos in your social media content. Even parody or comparative advertising can cross lines if not handled correctly.
Defamation and Liability
Singapore has a robust defamation framework, and the courts have demonstrated willingness to apply it in social media contexts.
A blogger was ordered to pay SGD 133,000 in a defamation case involving a shared Facebook post. The lesson for businesses is not just about what you publish, but what you share.
Practically, this means:
- Negative comparisons with competitors need to be factually verifiable
- Sharing or amplifying content that makes false claims about individuals or organisations carries liability
- Customer reviews or testimonials that contain false statements, published without verification, can expose your business to claims
- Comments made by employees on personal accounts about competitors or the business can also attract liability if they can be linked to the company
It is worth noting that defamation in Singapore is assessed through the lens of what a reasonable reader would understand. Courts do not require the defendant to have intended harm.
POFMA and False Statements of Fact
The Protection from Online Falsehoods and Manipulation Act (POFMA) applies to false statements of fact communicated electronically in Singapore. For businesses, this is most relevant when product claims, statistics, or market comparisons in your social media content turn out to be inaccurate.
The distinction POFMA draws is between opinion and fact. Saying your product is the best in Singapore is generally an opinion. Saying it has won an award it has not won is a statement of fact, and if false, it can attract a correction direction or takedown notice.
Given that 71.4% of Singaporeans say they are concerned about what is real versus fake online, the social expectation for accuracy is high. The legal obligation is even higher.
Influencer Marketing Regulations
Influencer marketing is where I see the most live compliance gaps in Singapore right now. Brands assume the influencer knows the rules. Influencers assume the brand will handle the brief. Neither party puts anything in writing.
By the time the content is published, the disclosure is missing, the arrangement is undocumented, and both sides are exposed. The legal framework here is not complicated, but it does require someone to take ownership of it before the campaign goes live.
Definition and Commercial Scope
The role of influencers in Singapore’s social media ecosystem is substantial. Influencer advertising spend in Singapore grew 13.6% in 2024 to reach US$106 million. This is not a niche marketing channel. It is a significant commercial category, and it is regulated accordingly.
The framework is primarily self-regulatory, administered by ASAS and the Advertising Initiative for Mainstream and Social Media in Singapore (AIMSG). But self-regulatory does not mean optional.
ASAS can and does require brands to amend or remove non-compliant content, and persistent non-compliance can attract further regulatory attention.
Disclosure Requirements
This is where I spend the most time with clients, because the standard being applied is considerably stricter than what most businesses assume.
Disclosure is required whenever there is a material connection between the content creator and the brand. This includes:
- Paid sponsorships
- Gifted products or experiences, even without any payment
- Affiliate link arrangements
- Complimentary invitations or junkets
- Discounted products or services
The disclosure must be:
- Prominent: Visible without scrolling, expanding, or clicking. Buried in a caption after a paragraph of text does not meet the standard.
- Unambiguous: Terms like “collab,” “thanks to,” “working with,” or “in partnership with” are not sufficient. Accepted labels include “Sponsored,” “Ad,” “Advertisement,” “Paid partnership with [Brand],” “Gifted,” or “Affiliate link.” ASAS
- Platform-appropriate: Instagram has a native Paid Partnership tag that should be used. TikTok requires a verbal or on-screen disclosure at the start of the video. LinkedIn posts should carry disclosure in the opening lines, not at the end.
Brands are also responsible for ensuring their influencers comply. The AIMSG code is explicit: brands must not instruct or incentivise influencers to hide commercial relationships. If an influencer fails to disclose, and you commissioned the content, the liability does not disappear with the briefing email.
In practical terms, every influencer brief should include a clear instruction on disclosure language and placement. This should be part of your agreement, not an afterthought.
One more point worth being direct about: buying fake followers, bulk likes, or using bots to inflate engagement metrics is prohibited under the ASAS guidelines and constitutes consumer deception. I mention this because it comes up more than it should in conversations about social media marketing strategy.
Compliance and Best Practices
Understanding the rules is one thing. Building them into how your business actually operates is another.
Most compliance failures I see are not the result of businesses deliberately cutting corners. They happen because no one sat down to translate the legal requirements into a day-to-day process. That gap, between knowing and doing, is where the risk lives.
The two areas that matter most here are having a written social media policy and maintaining active oversight of your campaigns.
Developing a Social Media Policy
If more than one person is touching your social channels, you need a written social media policy.
This is not about creating bureaucracy. It is about ensuring that when someone on your team posts something in the heat of the moment, there is a shared understanding of what is acceptable.
A robust social media policy should cover:
- Who is authorised to post on behalf of the business
- What approval process, if any, is required for content
- How influencer arrangements should be documented and briefed
- What data collection tools are used on landing pages and competition mechanics
- How customer complaints or negative comments should be handled
- What personal conduct on private accounts is expected when employees can be identified as company representatives
The policy should be reviewed at least annually, given the pace at which both platform features and Singapore regulations evolve.
Monitoring and Reporting
Compliance is not a one-time exercise. It requires regular review of both your content and your processes.
Useful practices include:
- Auditing active influencer campaigns monthly to confirm disclosures are in place
- Reviewing opt-in mechanisms on lead forms quarterly to confirm they remain PDPC-compliant
- Cross-checking the DNC Registry before any bulk SMS or telemarketing activity
- Keeping documentation of consent records if you are building email lists from social campaigns
- Monitoring ASAS, PDPC, and IMDA publications for regulatory updates
For businesses running campaigns at scale, appointing a compliance lead or working with a professional social media marketing agency in Singapore that embeds compliance into its processes is worth considering.
Case Studies of Legal Issues in Singapore
Most legal issues in Singapore’s social media space do not start with bad intent. They start with a gap between what a business assumed was acceptable and what the rules actually require. The three situations below illustrate how that gap shows up in practice, and what it tends to cost.
The Bicycle Parts Defamation Ruling
A case that generated attention in 2025 involved a cycling parts firm, Makericks3D, that brought a defamation action against cycling influencer Terence Lee (‘Bike Guru’) over social media posts about a scrapped product review.
The suit was ultimately dismissed, but the case illustrates how quickly a social media exchange between a business and an influencer can become a formal legal matter. The reputational and financial cost of litigation does not discriminate by business size.
PDPC Enforcement Against SMEs
The PDPC’s published enforcement decisions include penalties against businesses significantly smaller than Marina Bay Sands. Century Evergreen Private Ltd. was fined SGD 9,000, and Autobahn Rent A Car Pte. Ltd. was fined SGD 3,000, for failures in data protection that would be entirely avoidable with basic security controls.
The pattern is consistent: the breach is not always dramatic. Non-compliance often stems from outdated access controls, poor data hygiene, or insufficient staff awareness. These are solvable problems.
The Influencer Disclosure Gap
In my experience, the influencer disclosure gap is the most common live compliance issue for Singapore businesses right now. I have reviewed campaigns from education centres, F&B groups, and lifestyle brands where the influencer content was professionally produced, genuinely good, and entirely non-compliant.
The business assumed the influencer knew the rules. The influencer assumed the client would handle the brief. No one did.
The lesson is not complex. Brief properly. Document the arrangement. Require disclosure as a contractual condition. Check the published content before the campaign ends.
Practical Guide: Steps to Ensure Compliance
Most compliance failures I see are not the result of bad intentions. They come down to process gaps. Nobody documented the consent language. Nobody briefed the influencer on disclosure requirements. Nobody checked whether the competition mechanic complied with the PDPA before it went live.
The checklist below is a working starting point. Go through it with whoever manages your social channels and treat anything you cannot confidently tick as a priority to fix.
Compliance Checklist for Singapore Businesses
Use this as a starting framework, not a substitute for legal advice on your specific situation.
Data and Privacy
- All lead generation forms carry clear consent language referencing the PDPA
- Your privacy policy accurately describes how data collected via social channels is used
- If you use retargeting pixels, your website informs visitors accordingly
- Your email/SMS marketing lists were built with documented opt-in consent
- You have a process for handling data subject access requests
- You have checked numbers against the DNC Registry before any telemarketing activity
Advertising and Content
- All sponsored content, whether by your team or influencers, carries clear disclosure language
- Product claims in your social content are factually accurate and verifiable
- Images and music used in content are licensed for commercial use or created in-house
- Testimonials and reviews are genuine and not fabricated
- If you operate in a regulated sector (finance, healthcare, property), your content meets sector-specific advertising standards
Influencer Management
- Every influencer arrangement, including gifted products, is documented in writing
- Your brief includes explicit instructions on disclosure language and placement
- You review published content before the campaign period closes
- Your influencer contracts include a clause requiring ASAS compliance
Operational
- You have a written social media policy that staff have acknowledged
- Your team has received at least basic training on Singapore’s social media marketing rules
- You have a process for responding to complaints or regulatory enquiries about your social media content
- You review your policy and practices at least annually
For businesses that want a more tailored review of their current practices, working with a social media marketing agency in Singapore that understands both the commercial and regulatory dimensions of the work is a practical starting point.
Most businesses that run into problems with Singapore’s social media marketing rules do so not because they are careless or dishonest. They do so because no one sat them down and explained the full picture.
The legal framework here is coherent and consistently enforced. The PDPA governs how you collect and use data. The SCAP governs how you communicate commercially. Copyright law governs what content you can use. Defamation law applies to what you publish or share. POFMA applies to statements of fact in your content. Sector-specific rules apply on top of all of that.
What good looks like is not complicated. It is a business that has documented its consent processes, briefs its influencers properly, uses only licensed creative assets, trains its team on expectations, and reviews its practices regularly as the rules evolve.
The businesses I see get this right are not necessarily the ones with the biggest budgets. They are the ones with someone who has taken the time to understand the obligations and built them into how the work gets done.
If you want to understand how your current social media marketing activity measures up against what the rules actually require, it may be worth speaking with our team at MediaOne before you find out the hard way.
Frequently Asked Questions
What are the main legal risks associated with social media marketing rules in Singapore?
The primary risks are: breaching the PDPA through improper data collection or inadequate consent; violating ASAS guidelines by failing to disclose influencer content; breaching copyright by using creative assets without a license; and publishing false or misleading product claims that may attract action under POFMA or the Consumer Protection (Fair Trading) Act.
Defamation risk applies to competitive comparisons and any content that makes false statements about individuals or organisations.
How can businesses ensure they comply with the PDPA in their social media marketing?
Start with your consent mechanisms. Every form, competition, or data collection touchpoint must clearly state what data you are collecting, why, and how it will be used. Retain records of consent. Do not repurpose data for purposes beyond what was stated. Ensure your privacy policy is up to date and accessible. For businesses using third-party platforms or CRMs, check that those tools also comply with Singapore’s data protection requirements.
Are there specific guidelines for advertising on social media in Singapore?
Yes. The Advertising Standards Authority of Singapore (ASAS) publishes Guidelines for Interactive Marketing Communication and Social Media that apply to all parties involved in social media marketing, including brands, agencies, and influencers.
These guidelines sit within the broader Singapore Code of Advertising Practice (SCAP). Key requirements include transparency about commercial relationships, accurate product claims, and proper disclosure of sponsored content.
What should a business do if it receives a legal complaint regarding its social media content?
Do not ignore it. If the complaint is from ASAS, engage promptly and request clarification on what specifically has been flagged. ASAS typically asks for content to be amended or removed before escalating. If the complaint involves the PDPC, take it seriously and seek legal advice.
For complaints under POFMA, a correction direction requires a response within a defined timeframe. In all cases, preserving a record of the original content and your response process is important.
Does a social media marketing agency in Singapore need to comply with these rules on behalf of clients?
Agencies are considered part of the marketing chain and share responsibility for ensuring the content they create or manage on behalf of clients is compliant. This means agencies should be briefing clients on disclosure requirements, building consent language into campaign mechanics, and ensuring that content they publish meets ASAS standards.
If you are evaluating a social media marketing agency in Singapore, their understanding of compliance is a legitimate criterion in the decision.
