Due in part to strong infrastructure, internet access is widespread in Japan. As of January 2024, the internet penetration rate stood at 84.9 percent.1 As of March 2024, the median mobile and fixed-line broadband download speeds stood at 47.89 megabits per second (Mbps) and 196.59 Mbps, respectively.2

Mobile usage is widespread, and there were 188.9 million mobile connections as of January 2024.3 Providers continue to develop telecommunications infrastructure, in part to alleviate mobile network congestion. NTT Docomo, KDDI, SoftBank, and Rakuten Mobile (in partnership with electronics firm NEC) all launched commercial 5G services in 2020.4

In 2022, Nikkei reported that the government was initiating a fund to foster 6G research in Fiscal Year 2023 via the Ministry of Internal Affairs and Communications (MIC).5 In February 2023, RCR Wireless News, partially relying on Nikkei, reported that several Japanese companies along with Finland’s Nokia were planning trials ahead of an envisioned 2030 launch for 6G services.6

Some private companies offer free internet access in restaurants, coffee shops, and train stations; registration requires an email address.7 Wi-Fi access has been tied to mobile subscriptions in the past, which presents a barrier for users without contracts.8

Connectivity is occasionally restricted accidentally or due to network congestion and server outages.9 In December 2023, KDDI’s calls and internet services were disrupted for three hours due to an equipment failure, during which emergency calls and additional services were impacted.10

Access to the internet remains relatively equal across different segments of the population. Increasing smartphone usage has made the mobile market more competitive and resulted in improved pricing options, although the cost of service can otherwise be quite high. Additionally, many providers bundle digital media subscriptions, including cable television, Voice over Internet Protocol (VoIP) services, and email, pushing costs higher.

According to UK-based Cable, the average cost of a monthly broadband package was $43.71 in 2023, while 1 gigabyte (GB) of mobile data cost $3.85.11 According to the National Tax Agency’s Survey of Private Salary Statistics, the average annual salary in 2021 was ¥4.58 million ($40,700).12 The minimum wage in Japan varies by prefecture, but the national average is approximately ¥1,004 ($6.80) per hour.13

Regional cost disparities exist; service was more expensive in Japan’s major cities in 2020, with customers paying an average of ¥3,835 ($25) per month. Customers in small cities, towns, and villages paid an average monthly price of nearly ¥3,024 ($20). Connectivity for households in the heavily populated Kanto region, which includes Tokyo, cost nearly ¥1,300 ($9) more per month than in the least expensive region, Tohokuin in the northeast.14

Japan’s telecommunications infrastructure is advanced, and there have been no reports of the government deliberately disconnecting service. There is full competition in the ownership of gateways to the international internet.15 Historically, Japan’s internet connections were forged through cooperation among government agencies (including then government-owned NTT), universities, and national research institutions.16

While users have a choice of providers for internet services, certain companies dominate the market.

Japan has three major mobile operators—NTT Docomo, which holds a 35.2 percent market share; KDDI’s au brand, with 26.9 percent; and SoftBank, with 20.6 percent, as of December 2023.17

As of March 2023, NTT remained dominant in the fixed-line broadband market, holding 52.9 percent of the market, while KDDI held 20.8 percent. Hundreds of smaller providers offer services including fiber-optic connections and fixed-line or wireless broadband access.18 No major foreign operators have successfully penetrated the telecommunications market independently.

NTT, formerly a state monopoly, was privatized in 1985 and reorganized in 1999 under a law promoting functional separation between the company’s mobile, fixed-line telephone, and internet services (see A5).19 Asymmetric regulation, which creates stricter rules for providers with a higher market share, has helped diversify the industry.20

In December 2023, MIC minister Matsumoto Takeaki said that the LDP government was interested in abolishing the NTT Law entirely by 2025, citing the need to foster NTT’s competitiveness.21 In April 2024, the Diet amended the NTT Law, removing several business restrictions previously imposed on that provider, including the mandate that the company release its research findings to the public and the prohibition on foreigners serving as NTT directors. KDDI, SoftBank, and Rakuten Mobile objected to the amendments’ passage and said they remained opposed to the NTT Law’s potential repeal.22

In May 2023, NTT Docomo, KDDI, SoftBank, and Rakuten Mobile announced the launch of a Mobile Number Portability (MNP) system that allows customers to switch providers while keeping their existing phone numbers. Several mobile virtual network operators (MVNOs) said they would also participate in the MNP system.23

The telecommunications, internet, and broadcast sectors are regulated by the MIC rather than an independent commission. Some self-regulatory bodies also manage content and other issues.

Observers argue that the industry has generally improved since the MIC was established in 2001, which resulted from the merger of the Ministry of Home Affairs, the Ministry of Posts and Telecommunications, and the government’s Management and Coordination Agency.24

Nongovernmental organizations (NGOs) supported by the relevant companies in these three sectors perform a self-regulatory function. They include television’s Broadcasting Ethics and Program Improvement Organization and the Internet Content Safety Association, which manages the blocking of child sexual abuse images online.25

However, there are substantial concerns that MIC officials are increasingly influenced by business executives. After the MIC supported NTT’s December 2020 acquisition of NTT Docomo—which competitors criticized as contrary to the intent of the 1999 revision of the NTT Law, which mandated that the company’s different services function separately26 —news magazine Shukan Bunshun reported that NTT’s president and other executives had repeatedly treated MIC officials to lavish dinners.27

Authorities typically do not order service providers to block or filter content in Japan.

In Japan, the use of TikTok and other social networks is prohibited on government devices that handle confidential information.28 In March 2023, Reuters reported that a group of LDP lawmakers were considering proposing a ban on TikTok and other services over concerns of disinformation;29 as of the end of the coverage period, there have been no further updates on such disccusions.

In April 2018, the government asked internet service providers (ISPs) to block manga piracy sites prompting a public debate that highlighted tensions between the protection of intellectual property on one hand and users’ rights to private communications and the constitutional ban on censorship on the other (see B3).30 While a 2020 revision of an antipiracy law criminalized illegally downloading manga, magazines, and academic texts, it did not expand the government’s ability to block websites (see C2).31

Courts have continued to consider lawsuits from individuals requesting that search engines delink inaccurate or irrelevant material about them from public results, called “right to be forgotten” removals, but the Supreme Court has laid down guidance that set limits on such actions.32 Some private companies occasionally accept the government’s requests to remove content.

In May 2024, the Diet amended the 2001 Provider Liability Limitation Act—now the Information Distribution Platform Act (IDPA)—requiring platforms to create transparent procedures for removing content that constitutes online defamation and respond promptly to claims of online defamation. Experts have voiced concerns that the amendments fail to address systemic hateful and discriminatory speech against marginalized communities.33 The PLLA directs ISPs to establish a self-regulatory framework to govern takedown requests involving illegal or objectionable content, defamation, privacy violations, and copyright infringement (see C4).34

In recent years, content removals have largely focused on defamation, hate speech, and illegal content, including child sexual abuse images and intimate images shared without the subject’s consent. The Tokyo-based Safer Internet Association (SIA) said it was alerted to 2,719 cases of nonconsensual sharing of intimate images in 2023 and secured deletion in 1,999 of the cases.35 Inflammatory, nationalist speech targeting Japanese residents of Korean origin and other minority groups has also been subject to removal.36

Social media platforms occasionally restrict content at the government’s request or judicial instructions. Between July 2022 and June 2023, Facebook restricted access to 76 items in Japan; 17 in response to court orders and 3 in response to private reports of harassment and defamation.37 During the same period, Google received 265 removal requests from the government relating to 773 pieces of content; Google removed 535 items.38

While the government is relatively transparent in its censorship decisions, efforts to give authorities more censorship power have raised concerns (see B1).

In July 2022, the Diet approved amendments to the penal code that increase the maximum statutory penalty for online insults (see C2). For ISPs to block particular websites, they must monitor their customers’ online activity to determine whether they are accessing the sites in question, which could violate the constitutional right to secrecy of communications (see C6).39 ISPs voluntarily filter child sexual abuse images, and many offer parents the option to filter other content to protect young internet users.40 Depictions of genitalia are pixelated to obscure them for internet users based on a common—though poorly articulated—interpretation of Article 175 of the penal code, which governs obscenity.41 Otherwise, individuals or police ask ISPs to administratively delete contested or illegal content. A 2014 law addressed the issue of content removal and intimate images shared without consent (see B2 and C2). Under that law, providers must comply with takedown requests within two days.42

In July 2022, Twitter and Meta announced that they were removing video of former prime minister Abe Shinzō’s murder from their platforms, citing their respective policies on harmful content.43

In 2017, the Supreme Court ruled on an individual’s request for Google to remove search results documenting a crime he committed over five years earlier, setting a precedent that individuals could only demand the delisting of search results if privacy protection concerns clearly outweighed the public’s interest in the information.44

Japanese residents exercise some self-censorship online, often on historical and social issues. The society at large prefers “harmony,” and people avoid criticizing the role of Japan’s emperor, especially when connected with historical events like World War II.

Additionally, pressure from the Japanese government, as well as the kisha kurabu (press club or reporters’ club) system—an arrangement where government institutions and corporate organizations restrict access of news to journalists and outlets that maintain membership—contributes to a culture of self-censorship within the media.45 Tactics like reducing the number of journalists invited to press conferences are frequently applied on the management of mainstream media, especially when institutions report on corruption, sexual harassment, public health issues, and pollution.46

In a 2017 report, the UN special rapporteur on freedom of expression noted that there were “significant worrying signals” regarding self-censorship among journalists on issues such as the 2011 Fukushima nuclear disaster.47 There is also a degree of self-censorship concerning human rights problems, in some cases linked to instances of apparent political pressure.48

Score Change: The score increased from 2 to 3 because of the decreased prevalence of progovernment commentators and political bots compared with previous coverage periods.

In the past, progovernment commentators have attacked the opposition online, while political bots have spread misinformation ahead of local elections.49 This behavior was less prevalent during the current coverage period.

The LDP Net Supporters Club (J-NSC) has served as an online public relations effort for the LDP, though it appears to be less active in recent years. Members of the club have attacked critics of the LDP government online and have occasionally initiated negative online campaigns against opposition lawmakers.50 There have been suspicions that the LDP has been behind efforts to manipulate online opinion.

Two opposition lawmakers filed a lawsuit in 2021 against X and ISPs, requesting that they disclose the identity of the operator of “Dappi,” an anonymous X account which had been posting criticism of the opposition and praise for the ruling LDP since 2019. After the lawmakers won their case in September 2021, it was revealed that the account belonged to Ones Quest, a web production company with close ties to the LDP, though it remains unclear whether the LDP was actually involved.51 In October 2023, the Tokyo District Court ordered Ones Quest and its executives to pay a total of ¥2.2 million ($14,900) in damages for defamation to the two lawmakers, and to delete the defamatory posts from X.52

In December 2022, the Ministry of Defense (MOD) was accused of participating in public opinion manipulation through the use of artificial intelligence (AI), though government officials have denied the allegations.53 According to reports, the MOD identified relevant influencers and discretely targeted them with MOD-related information through social networks and websites they frequently visited, with the intention of encouraging them to share pro-MOD information with their own networks.

Independent online media and citizen media outlets have faced obstacles in their work, particularly due to the prevalence of the kisha kurabu system and an advertising market that favors established players, potentially preventing digital media from gaining a stronger foothold in the market.54 Some online news outlets also struggle to sustain themselves financially.

Participation in the kisha kurabu system provides essential access to officials in Japan, but officials have been accused of denying such access to young journalists, new media outlets, and journalists engaging in especially critical reporting (see B4).55 The system may also limit some reporters’ access to certain locations, such as areas affected by the 2011 Fukushima disaster.56

Additionally, Apple and Google have significant control over the app store ecosystem in Japan. On iOS devices, in-app payments are routed through Apple’s system, where they are subject to a fee of up to 30 percent; similarly, on Google devices, in-app purchases must be made through Google’s billing system. In February 2024, The Fair Trade Commission announced the outline of a new bill, which would prohibit major app store operators—like Apple and Google—from mandating developers to utilize their payment systems and app stores.57

Japan has a diverse online landscape. YouTube, Twitter, Facebook, Instagram, and international blog-hosting services are freely available, as are popular local platforms like Niconico, the video-sharing site, and LINE, a chat application that was launched in Japan in 2011. TikTok is available except on government devices that handle confidential information (see B1).

Blogs have a significant impact on public opinion, and several independent journalists are becoming influential through personal or commercial websites and social media accounts. However, most online media remain small and community-based.58 YouTubers and Instagram personalities have also become increasingly influential in recent years.

Digital activism in Japan has been highly effective at both the local and the national level, and online mobilization tools are freely available.

During the coverage period, Japanese youth organized around the pro-Palestine cause, protesting against the Israeli military’s campaign in the Gaza Strip, as well as Tokyo’s military support for the United States, perceived by activists as proxy support for Israel. Japanese activists used the internet to circulate online petitions, organize offline events, including pro-Palestine music events and gallery shows, and develop Olive Journal, a citizen-run Palestine information site.59

Japanese individuals, particularly women, have also used the internet to protest gender-based discrimination and bring about tangible change. In 2022, several female actors came forward to accuse well-known film directors of sexual assault, spreading the #MeToo movement and sparking discussions on improving the film industry's environment for women.60

Article 21 of Japan’s constitution prohibits censorship and protects freedom of “speech, press, and all other forms of expression,” as well as the “secrecy of any means of communication.”61

The Act on the Protection of Specially Designated Secrets came into force in 2014, despite objections from the political opposition, civil society, and protesters. The law gives a range of officials the discretion to indefinitely restrict public information pertaining to national security.62 Overseen by government officials rather than an independent body, it offers no protection for whistleblowers who reveal wrongdoing.63

A 2016 law outlined measures that authorities could take to educate the public about hate speech, while also combating such speech when directed against people of overseas origin and their descendants.64 The law’s authors struggled to balance restrictions on racial and ethnic slurs with freedom-of-expression guarantees in the constitution.65 The law did not actually ban or penalize hate speech, leading some critics to argue that it would be ineffective.66 In 2017, several municipalities asked for a clearer definition of hate speech under the law.67 Since the law’s introduction, many cities have subsequently moved to legislate against hate speech (see C2).

In November 2023, a crossparty group of Diet members formed a group meant to propose policies protecting the privacy of Japanese internet users.68

Several laws regulate online activity, including by imposing civil and criminal liability.

Under the Act on the Protection of Specially Designated Secrets, intentional leaks of state secrets can draw penalties of up to 10 years’ imprisonment, while unintentional leaks can be punished with up to 2 years. In addition, individuals who knowingly receive secrets from an administrative organ risk up to five years’ imprisonment if the disclosures are found to be intentional, and one year for disclosures made through negligence.69

In June 2022, the Diet passed amendments to the penal code making “online insults” punishable with up to one year of imprisonment or a fine of ¥300,000 ($2,000).70 Due to concerns about the law’s potential impact on free expression—it defines “insults” vaguely, as speech that publicly demeans an individual’s social standing without reference to a specific action or fact—it was set to be reexamined in three years.71

Article 175 of the penal code bans the sale or distribution of “obscene” material, and while the relevant provisions date back more than a century, they are considered to apply online.72 The article does not define what constitutes obscenity, leading to concerns that it could be invoked against artistic expression or used to curtail the rights of LGBT+ people.73

Other laws prescribe potentially disproportionate penalties for online activity. In January 2021, a revision of the Copyright Act went into effect that made it illegal to download manga, magazines, and academic publications, as well as music and videos depicting content from such publications, without the copyright holder’s permission. Those who violate the revised law face up to two years’ imprisonment, a ¥2 million ($13,500) fine, or both. The act allows users to download image-based material or certain forms of academic content that is meant for private use.74

A 2013 revision of the Public Offices Election Act lifted long-standing restrictions on the use of the internet for election campaigns, though there are still limits on paid online advertising and campaign emails, which can only be sent directly by a party or candidate to prevent fraud.75 Politicians who violate the restrictions face a potential fine of ¥300,000 ($2,000) or one year in prison; meanwhile, voters found to have improperly solicited support for a candidate via email could be fined ¥500,000 ($3,400) or imprisoned for two years.76

A 2011 law criminalized the creation or distribution of computer viruses without a legitimate reason.77 Individuals can be sentenced to up to three years in prison or fines of up to ¥500,000 ($3,400). Many experts have indicated their concern about ambiguous components of the law that could be abused.

Other laws regulate online activity but are not known to have resulted in abuse or disproportionate penalties. For instance, under a 2014 law criminalizing nonconsensual sharing of intimate images and online harassment, offenders can face prison sentences of up to three years or fines as large as ¥500,000 ($3,400), and third-party distribution can draw up to a year’s imprisonment and a fine of ¥300,000 ($2,000).78 Japan’s antistalking law, originally enacted in 2000, has since been revised to address email harassment, repeated blog posts, and social media messages.79

Some municipal governments have also introduced local ordinances on hate speech. For example, Kawasaki City created a nondiscrimination ordinance in 2019 that includes criminal penalties for hate speech in public spaces and stipulations that the city would take measures to prevent the spread of hate speech on the internet.80

In December 2022, the Mie prefectural assembly unanimously approved a revision to the political ethics ordinance, which bans assembly members from “liking” social media posts that encourage human rights violations.81

It is uncommon for citizens to face arrest or prosecution for their online activity; however, during the coverage period, several users were fined and arrested for their online activities.

In November 2023, 40-year-old Sugita Kazuaki was arrested for defamation after filming and accusing a woman, without evidence, of being an illegal ticket reseller and posting the video on YouTube.82

In February 2024, the Supreme Court upheld an October 2022 Tokyo High Court ruling83 and ordered LDP lawmaker Sugita Mio to pay 550,000 yen ($3,700) in damages to journalist Itō Shiori for “liking” X posts deemed to defame and insult Itō, who accused a journalist at Tokyo Broadcasting System (TBS) of rape.84 The case set a precedent regarding the legality of “liking” social media posts in the context of defamation.

In June 2023, the Tokyo District Court ordered a man to pay 330,000 yen ($2,200) in damages to photojournalist Yasuda Natsuki, after he posted hate speech directed at Japanese residents of Korean descent on X in 2020, in response to an article Yasuda posted about her own ethnic Korean lineage.85

In February 2023, after a video of a young man licking a soy sauce bottle at a restaurant went viral, the three individuals associated with the post were arrested and charged with “forcible obstruction of business,”86 which sparked discussions about Japanese societal norms and raised concerns about the proportionality of the arrests. In October 2023, the Nagoya District Court sentenced Ryoga Yoshino, the 21-year old licking the bottle, to a three-year prison sentence with a five-year suspended sentence.87

There are periodic reports of arrests under the copyright law, which carries possible prison terms for both uploading and downloading content without the permission of the copyright owner (see C2). In February 2024, two men, both foreign nationals, were arrested for alleged copyright infringement after publishing photos of pages from the Weekly Shonen Jump, a weekly shōnen manga anthology, before the publication’s release.88

Journalists who report on sensitive topics have faced defamation lawsuits in the past. Following the murder of former prime minister Abe Shinzō in July 2022, the United Family Association for World Peace filed a series of defamation lawsuits against journalists, lawyers, and others who spoke out about links between the association and the LDP, seeking ¥22 million ($147,000) in damages and a written apology from each of the defendants.89

Individuals can generally use the internet anonymously in Japan. However, some digital activities require separate registration. Major mobile service providers require customers to present identification documents to subscribe. Police can request these details, along with usage logs, if they detect illegal online activity.

Under the 2005 Act on Prevention of Improper Use of Mobile Phones, mobile service providers must verify the identity of subscribers when a contract was terminated or transferred to prevent a situation in which cell phone subscribers cannot be identified. In 2008, the law was amended to prohibit the transfer of SIM cards without permission.90

There are no explicit restrictions on encryption. Under the criminal procedure code, however, investigators can order a person to decrypt an encrypted electronic record.91

Increased concerns over harassment, intimidation, and slander during previous coverage periods led lawmakers to revise the PLLA in October 2022, which facilitates the identification of users who allegedly slander people online. The act was amended during the coverage period to require platforms to remove defamatory content more quickly and transparently (see B2). Under the PLLA, individuals may request courts to disclose information about a sender who posted defamatory content within six months. The court can then, at its discretion, order a content provider to disclose the sender’s information and retain the sender’s information during the proceedings,92 though the provider must receive the poster’s permission before sharing their information. However, if the poster refuses permission, the service provider is authorized to potentially provide identifying information about the poster—such as their name or IP address—without their consent.93

In March 2023, the Supreme Court ruled that My Number, a system which assigns all residents of Japan, including citizens, a unique 12-digit number which is linked to their personal data, is constitutional. Since My Number’s 2013 introduction and effective activation in 2016, there have been concerns about privacy issues and the potential misuse of personal information (see C6). The ruling set a precedent for how personal identification systems are constitutionally interpreted and could have implications for future legislation and legal challenges related to data privacy and security.94

The Supreme Court protects privacy in part through its interpretation of Article 13 of the constitution, which provides for the right to life and liberty.95 The constitutional right to secrecy of communications is also protected under telecommunications laws.96 However, recent developments in Japan have raised serious concerns about increased surveillance, including reports of opaque surveillance operations and the approval of a conspiracy law that may allow police to seek wiretap warrants in a wider range of circumstances.

In March 2022, the House of Representatives passed a bill to amend the Police Act,97 establishing a Cyber Police Bureau and a Cyber Special Investigation Unit within the National Police Agency (NPA), empowered to conduct criminal investigations.98 Civil society actors have voiced concern over the broad authority that the reorganization grants the NPA to monitor online users and the threat it poses to online free expression.99 In April 2024, the NPA’s Cyber Special Investigation Unit was expanded into a department.100

Following incidents including the 2022 murder of former premier Abe and an April 2023 incident in which a bomb was thrown at Prime Minister Kishida Fumio,101 which were attributed to lone offenders, Japanese police have worked to centralize information on suspicious individuals and monitor and collect people's online activities, including their social media posts.102

In June 2024, after the coverage period, the Diplomat news outlet reported that the Kishida government was aiming to mount an “active” cyberdefense strategy under the auspices of the Ministry for Digital Transformation (MDT). The new strategy would rely on active involvement from telecommunications service providers and would require the amendment of several laws.103 Critics have warned that such detailed monitoring of internet activities stemming from that strategy could infringe on privacy rights and force communication providers to comply with government surveillance.104

In November 2018, the amended Telecommunications Business Act and the Act on the National Institute of Information and Communications Technology (NICT) came into effect.105 The changes allowed the NICT and the MIC to carry out the NOTICE program, authorizing them to access domestic internet-enabled devices for up to five years in an effort to strengthen Japanese residents’ cybersecurity (see C8).106 With seemingly no judicial oversight and potential access to millions of users’ personal devices, NOTICE has raised serious privacy concerns.107

The conspiracy law passed in 2017 criminalizes “planning” to commit a series of newly designated “serious crimes” that could supposedly fund terrorism, including copyright violations, potentially making more suspects subject to wiretaps. The UN special rapporteur for privacy noted ahead of the law’s passage that “it is logical to assume that those charged would have had to be subjected to a considerable level of surveillance beforehand.”108

Under a wiretap law enacted in 2000, law enforcement agents may seek a court order to conduct electronic surveillance in criminal investigations involving drugs, firearms, human trafficking, or organized murders, in contrast with articles of other laws that explicitly forbid wiretapping.109 In 2016, the law was expanded to include fraud, theft, and child sexual abuse images.110 The law obliges agents to notify targets of wiretaps after investigations are concluded and inform the Diet of the number of wiretaps they implement annually. Critics say the law does not prevent the systematic storage of intercepted communications or protect innocent parties.111 In February 2024, the Ministry of Justice shared that 12,899 mobile phone calls were tapped in 2023, of which 1,453 were crime related, leading to 70 arrests.112

Some Japanese security agencies may have equipment enabling the blanket collection and monitoring of communications data, though it is unclear how such technology has been used, what laws govern its employment, and what, if any, safeguards exist. The 2014 state secrets law, which covers national security issues, may make surveillance abuses harder to document.

In May 2018, public broadcaster NHK and the Intercept reported on the activities of the Directorate for Signals Intelligence (DFS), a spy agency that monitors and analyzes electronic communications.113 The reporting claimed that the government deployed a clandestine online surveillance program, dubbed MALLARD, to observe communications passing between satellites.114 The information collected was reportedly stored for around two months, during which it was analyzed to determine if it was of interest to the DFS. It is unclear whether and to what extent domestic traffic was intercepted in the program.

Service providers and other technology companies can be required to aid the government in monitoring the communications of their users. Some companies cooperate with investigative authorities by turning over their users' data without receiving a court order.

The Telecommunications Business Law as amended in June 2022 included new regulations to protect users’ information and improve transparency around its handling.115 The law also requires telecommunications companies, search engines, and social media platforms to make their user information handling policies public and obliges businesses to notify users when they share their information with third parties.116

Amendments to the Act on the Protection of Personal Information went into effect in April 2022, expanding the scope of personal data and eliminating restrictions on the law’s extraterritorial applications.117 Under the amended law, overseas companies are obligated to notify the government of data breaches that involve sensitive information, cause financial injury, or affect more than 1,000 users.118

In March 2023, the Tokyo District Court upheld a government order to stop the operation of a website that allegedly compiled the personal information of over one million bankruptcy filers, citing the Act on the Protection of Personal Information.119

In 2015, the Diet passed amendments to a 2003 law which protects personal information that is collected electronically and consists of more than 5,000 records120 and requires that law enforcement requests for the data be supported by a warrant.121 The amendments specified “personal information” as “biometric information” and “numeric data that is capable of identifying a specific individual”;122 included anonymization provisions which allow for personal data to be transferred to a third party without the consent of the subject if specific requirements are met;123 strengthened criminal sanctions for misusing personal data as well as restrictions on the transfer of personal data to overseas jurisdictions;124 and established the Personal Information Protection Commission as an “independent authority under the Cabinet Office,” replacing the Consumer Affairs Agency.125

Changes to the legal frameworks surrounding privacy and surveillance are often considered in the ongoing digitization of citizens’ personal records. In May 2021, the Diet enacted the Digital Reform Bill, which streamlines how officials in Japan handle and share data and revises how personal data is protected under the law.126

The 2013 My Number law introduced a unique 12-digit number for all long-term residents used to access unified social welfare services for taxation purposes (see C4), and a Digital Agency established in 2021 has been tasked with consolidating and linking individuals’ personal data to their unique numbers.127 The Digital Agency has faced criticism for recent issues faced by My Number users; in May 2023, a number of participants said they received family registers belonging to other people. In June 2023, the Asahi Shimbun newspaper reported that a large number of identification cards were linked to bank accounts belonging to other people; MDT minister Kono Taro said that the issue stemmed from a large number of individuals using their childrens’ My Number credentials.128

Under voluntary guidelines drafted by four ISPs in 2005, service providers automatically inform police of internet users identified on websites that endorse suicide, and comply with law enforcement requests for information related to acts of self-harm.129 A law enacted in 2003 and revised in 2008 prohibits electronic communications encouraging sexual activity with minors.130 Under the law, all online dating services must register with the police, verify their customers’ ages with a driver’s license or credit card, and delete or block content that appears to involve someone under 18; most services voluntarily monitor messages in real time to ensure compliance.

Users rarely face physical and offline harassment in relation to their online activities. However, online harassment continued to persist during the coverage period.131

Discriminatory content against the Burakumin, the largest minority community in Japan largely seen as descendants of feudal-era outcasts, is prominent online. Additionally, individuals of African descent continue to face racism online.132

Women also face targeted online harassment (see B8).133 In a 2021 Cabinet Office survey, 23 percent of women assembly members reported experiencing gender-based harassment over social media or email.134 Such harassment has caused significant offline harm.135

While cyberattacks against journalists and activists are rare, private companies were targeted during the coverage period and in previous periods.

Japan is vulnerable to malware outbreaks, attacks on operating systems, and supply chain attacks. According to BlackBerry Japan’s Global Threat Intelligence Report, Japan was the third country most targeted by cyberattacks in the third quarter of 2023, after the United States and Canada.136

In November 2023, the LY Corporation disclosed that LINE, which it operates, suffered a data breach. Some 300,000 LINE users were affected and 440,000 pieces of information were exposed by the October breach, including users’ ages, gender identities, and some information on companies doing business with the LY Corporation.137

In August 2023, the National Center of Incident Readiness and Strategy for Cybersecurity (NISC) said that its email system suffered unauthorized use, though US-based Mandiant had already disclosed the apparent cyberattack in May.138

Also in August 2023, the Tokyo Shimbun cited the Washington Post when it reported that hackers from the Chinese military hacked Japanese government systems in 2020 and accessed defense information. The Tokyo Shimbun also reported that the US government detected another Chinese military hack of Japanese systems in 2021.139