With near-ubiquitous access, Icelanders are frequent internet users. According to 2021 data from Eurostat, 98 percent of households have internet connections.1 As of January 2024, Iceland’s internet penetration rate stood at 99 percent and there were 530,100 mobile connections, which is equivalent to a mobile internet penetration rate of 140.8 percent.2 Public Wi-Fi hotspots are widely available throughout the country.3

Iceland continues to enhance its information and communications technology (ICT) infrastructure. The government’s Iceland Optical Connected initiative, which aimed to provide citizens with fixed-lined connections of at least 100 megabits per second (Mbps) by 2020,4 has driven the development of fiber-optic cables. In May 2020, the government announced that it had allocated 400 million krónur ($2.9 million) toward realizing this goal.5 In March 2021, the government announced the final phase of the Iceland Optical Connected initiative, which will make a further 180 million krónur ($1.3 million) available as grants to local municipalities.6

Third-generation (3G), fourth-generation (4G), and fifth-generation (5G) mobile coverage is extensive.7 At least three mobile service providers have received permission from the Post-og Fjarskiptastofa (Post and Telecom Administration, or PTA), to develop 5G networks.8 In July 2021, the PTA was renamed the Electronic Communications Office of Iceland (ECOI).9 In May 2020, Nova became the first mobile operator in Iceland to offer 5G service to its customers.10 According to a 2021 government report on telecommunications, approximately 50 percent of the population has access to 5G service.11

Speeds are fast and reliable. In 2023, the average broadband download speed was 229.35 Mbps, according to the analytics company Cable.12 The ECOI’s 2021 data show that 97.9 percent of fixed broadband internet subscribers enjoy advertised download speeds of 30 Mbps or more.13

Winter storms sometimes lead to power outages in more remote parts of the country that may temporarily disrupt connectivity for people living in these areas. An unusually powerful storm in December 2019 temporarily disrupted telecommunications in parts of the Eastern, Northeastern, Northwestern, and Westfjords regions.14

Internet connections are relatively affordable and there are no major digital divides in Iceland. According to Cable, the average monthly cost of a fixed broadband subscription was $76.24 in 2024, while 1 gigabyte (GB) of mobile data cost $1.08 on average.15 Meanwhile, in December 2022, the real mean monthly income in Iceland stood at 871,000 krónur ($6,331). According to 2020 International Telecommunication Union (ITU) data, a monthly high-speed fixed broadband subscription cost 1.2 percent of gross national income (GNI) per capita, while a monthly mobile subscription offering 1.5 GB of data cost 0.4 percent of GNI per capita.

Historically, there have been no significant differences in penetration rates and access in terms of geography, gender, or education levels.16

In May 2022, the country’s three major mobile providers (Nova, Vodafone, and Síminn) signed a cooperation agreement with Iceland’s crisis line (112) and the government to increase mobile service in areas with low levels of connectivity, including Ölkelda, Hörgárdalur, and Dalatangi. The government also announced that it would fund the installation of at least 12 cell phone towers, which will provide either 4G or 5G coverage, with 30 additional towers being considered at the time of the announcement.17 In April 2024, Mila, one of the largest telecom infrastructure companies in Iceland, announced that it would be transitioning its services to be entirely fiber-optic cable–based, effectively shutting down its remaining copper connections.18 In May 2024, the ECOI announced its intention to appoint Neyðarlínan, which operates Iceland's 112 emergency service number, as a universal service provider in over 100 locations across Iceland that will be affected by the copper shutdowns.19

There are no government-imposed restrictions on connectivity in Iceland, and the government does not exercise technical or legal control over the ICT infrastructure. According to Article 72 of the Electronic Communications Act, the government can “close” or “restrict” the internet “in times of hostilities” or during emergencies.20

Iceland has multiple channels connecting the country to the international internet, including connections to the international backbone through four submarine cables. Two cables connect Iceland with Greenland and Canada: Greenland Connect (2009) and the 25-year-old CANTAT–3 from Canada. Three other cables connect Iceland to Europe: FARICE–1 (2003), DANICE (2009), and IRIS (2023). Construction of IRIS, a high-speed submarine cable connecting Iceland and Ireland, began in 2022 and became fully operational in March 2023.21

The Reykjavík Internet Exchange Point (IXP), which exchanges internet traffic among internet service providers (ISPs) located in Iceland, is operated independently of the government by the country’s top-level domain registry ISNIC.

There are no obstacles for service providers to operate in Iceland, and the ICT market is competitive and relatively diverse. Service providers need to register with the ECOI prior to commencing their operations, but registration is a formality.22

According to 2022 ECOI data on the broadband market, Síminn held the largest market share (45.5 percent), followed by Vodafone (24.4 percent), Nova (17.7 percent), and Hringdu (9.3 percent).23 Among mobile operators, Síminn led the market in terms of total subscriptions (36 percent), followed by Nova (33.3 percent), and Vodafone (25.9 percent).24

The PTA, an independent entity under the Ministry of Transport and Local Government, is the main regulatory body governing telecommunications. It supervises development, logistics, and fair competition in the telecommunications field. PTA decisions may be appealed to the Rulings Committee for Electronic Communications and Postal Affairs, which consists of three people appointed by the Minister of Transport and Local Government. They, along with the third member of the Rulings Committee, are appointed to four-year terms.25 The Rulings Committee’s decisions may be appealed in court.

The Icelandic Competition Authority (ICA) is an independent administrative body that oversees mergers, acquisitions, and other moves in the ICT market.26 It is composed of three board members appointed by the minister for industries and innovation; the board members then select a director.

Political, social, and religious websites are not blocked in Iceland. Social media platforms such as YouTube, X, Facebook, and international blog hosting services are freely available and used by a large part of the population. However, some websites are blocked for hosting copyrighted content.

In October 2018, the Supreme Court of Iceland upheld a 2014 Reykjavík District Court decision that ordered ISPs Hringdu and Vodafone to block the file-sharing website Pirate Bay and the largest Icelandic torrent website Deildu.27 The court order came after the music rights group Composers Rights Society of Iceland (STEF) and Iceland’s motion picture association SMÁÍS reported the websites to police in 2013 for copyright infringement and pirated material.28 An agreement was later reached between rights holders and ISPs that gave ISPs the authority to block any new links related to Pirate Bay and Deildu without additional court orders.29 It is not known how many links were blocked under this agreement.

Pornography in general is illegal in Iceland,30 although the ban is not strongly enforced, and online pornography is neither blocked nor specifically banned.31 Legislation was proposed in 2022 to end the current ban on pornography.32

ISPs in Iceland filter websites containing child sexual abuse imagery. Icelandic ISPs collaborate with Barnaheill—Save the Children Iceland, a local nongovernmental organization (NGO) focused on curbing child abuse, and participate in the International Association of Internet Hotlines (INHOPE) project, which solicits reports of illegal content.33

In general, online content is not subject to deletion, and government requests to remove online content are rare.

Between January and June 2023, however, Facebook reported receiving requests to restrict access to 134 pages or groups and 65 profiles. Between July and December 2021, the company restricted access to 91 items in Iceland for violating local law. Google reported receiving one government request to remove seven pieces of content from Google Web Search between July and December 2022 for privacy and security reasons.34

Content is sometimes removed under the “right to be forgotten,” which is enshrined under Article 17 of Iceland’s Act on Data Protection and the Processing of Personal Data (see C6).35 In January 2023, Iceland’s Data Protection Authority ordered Google to remove several URLs linking to articles regarding an Icelandic man’s previous employment history, citing the “right to be forgotten.” Google had initially denied the request when the man first approached the company.36 During the coverage period, Google received requests to remove 940 URLs in Iceland, of which it de-indexed 377.37 Microsoft has reportedly not de-indexed any URLs in recent years.38

ISNIC, Iceland’s main domain registrar, rarely closes domains based on a site’s content. However, ISNIC acted after the neo-Nazi website The Daily Stormer appeared with an .is domain name in 2017.39 The website reportedly lost its Icelandic web address based on a technicality, as its publisher failed to provide accurate registration information such as proof of identity and address.40 In 2022, ISNIC restricted the domain of kiwifarms.is, a website where users have reportedly made transphobic remarks.41

In general, legal restrictions on the internet and digital content are transparent, proportionate, and subject to judicial oversight. There are no specific laws mandating the blocking of websites or the removal of content.42 When websites have been blocked or content has been removed, it has usually been done by court order pursuant to civil or criminal law.

Chapter V of Icelandic Law No. 30/2002 establishes a system of takedown notices for online content that violates the law, in accordance with Directive 2000/31/EC (the E-Commerce Directive) of the European Parliament.43 The Ministry of Transport and Local Government is responsible for handling matters related to online content, and there is judicial oversight over the appeals process for disputing content removal.44

Under Iceland’s Data Protection Act, the country’s Data Protection Authority may administratively order the deletion of content that, for example, violates the right to privacy.45

ISPs and content hosts are not held legally liable for the content that they host or transmit. However, according to Icelandic law, domain registrants are responsible for ensuring that the use of their domains is within the limits of the law.46 Claims regarding intellectual property rights are handled by the Icelandic Patent Office, which is dependent on international cooperation; Iceland is party to several international agreements in this field.

In May 2021, the parliament adopted Cabinet Bill 1031, which empowers the courts to order the closure of .is domains involved in criminal activities or in disseminating illegal material.47

Self-censorship is not a widespread problem online, though some degree of self-censorship in the news media has been reported in the past.48

Government or partisan manipulation of online content is not a major issue.

In April 2020, the government set up a working group “to map the manifestations and extent of information chaos in connection with COVID-19 in Iceland and to make proposals for measures to combat it.”49 The move drew criticism from politicians and pundits, who questioned its necessity and argued that it could lead to censorship; 50 however, since it was established the working group has not appeared to seek to manipulate online information.

In March 2019, the Supreme Court upheld an October 2018 appellate decision to lift an injunction that prevented specific reporting by the newspaper and online site Stundin.51 In October 2017, two weeks before parliamentary elections, Glitnir Bank, which failed during the 2008 financial crisis, secured a legal injunction preventing Stundin from reporting on the bank’s links with then prime minister Bjarni Benediktsson. Stundin then fought the injunction in court, but it remained in effect through the elections.

There are no undue economic or regulatory limitations on publishing content online. European Union (EU) regulations on net neutrality and equal access to the internet were implemented as an amendment to Article 41 of the Electronic Communications Act in 2018.52

Iceland has a vibrant digital sphere, and almost all traditional media, including print, radio, and television, offer versions of their content online. Access to online international news sources is readily available to Icelanders. In 2019, the use of social media platforms was higher in Iceland than in any other country in the European Economic Area (EEA).53

The working group on COVID-19 misinformation (see B5) found that Icelanders overwhelmingly trusted national media, health professionals, and the government’s covid.is website over social media for information about the pandemic. More than three-quarters of the over 800 people surveyed as a part of the report indicated that they had encountered misinformation about COVID-19 on social media.54

Iceland has a limited number of local news sources. In March 2023, one of Iceland’s major news outlets, Fréttablaðið, along with its television broadcast division Hringbraut, ceased publication. The outlet cited financial difficulties during the COVID-19 pandemic, the Icelandic National Broadcasting Service’s (RÚV) dominance of the country’s limited advertising market, and increasing problems for small media companies to compete with foreign social media conglomerates in the advertising space as reasons for the closure.55

In response to the decreasing financial viability of Icelandic media outlets, the government of Iceland has stepped in to subsidize private media companies. In November 2023, the Ministry of Culture and Trade shared that it had allocated 476.7 million krónur ($3.45 million) to 25 media providers, including online outlets, in 2023 in an effort to support private media.56

Digital tools, including social media platforms, are widely used for social, political, and civic activism. Demonstrations and events are frequently organized on Facebook in particular. For example, in October 2023, people used the platform to organize a “Kvennafrí” (Women’s Day Off) strike against gender inequality, including the pay gap.57 The 2023 event marked the 48th anniversary of the first such strike on October 24, 1975, during which women across Iceland refrained from participating in professional and domestic labor as part of a protest against inequality; it was the largest such equality strike since.58

An online platform created in February 2018 has allowed individuals to easily provide their input on draft laws.59 Since the platform’s launch, hundreds of draft laws, regulations, and policy papers have been published for consultation, generating thousands of open responses from stakeholders and members of the general public.60

In the wake of the Icelandic financial crisis in 2008, social media served as a vital platform for citizens to demand an extensive review of the country’s constitution.61 A 25-member council consisting of ordinary residents helped draft a new constitution and worked through 16 versions in 4 months based on 16,000 comments from users across platforms such as Facebook, Twitter, and YouTube.62 The draft constitution has been stalled in the parliament since 2012,63 though support remains high; as of July 2021, 53 percent of people polled by Gallup supported the draft produced by the council.64

Freedom of expression is protected under Article 73 of the constitution and by the country’s independent judiciary.65 The Icelandic Media Law, which came into effect in 2011, established several legal protections for journalists that extend to the online sphere, including protection of anonymous sources and editorial independence from owners of media service providers.66

In recent years, the government has pursued several initiatives to enhance internet freedom. In 2010, the parliament approved a resolution—the Icelandic Modern Media Initiative—that articulated the country’s intention to become a global “safe haven” offering legal protection, including from “libel tourism,”67 to journalists, publishers, and whistleblowers.68 To implement this resolution, the nonprofit International Modern Media Institute (IMMI) was founded.69 The IMMI’s work, however, has been stalled in recent years. In May 2020, the parliament finally approved a law protecting whistleblowers from retaliation.70 However, other elements of the Icelandic Modern Media Initiative remain unimplemented.

Despite having strong protections for free speech, Iceland criminalizes certain online activities under its penal code. Both defamation and insult are criminal offenses subject to fines or prison sentences of up to one year.71 Article 233(A) of the penal code also prescribes two years of imprisonment for publicly denigrating a person or group on the basis of “nationality, color, race, religion, sexual orientation, or gender identity.”72

In a positive change, blasphemy was repealed as a criminal offense under Article 125 of the penal code in 2015. It had carried penalties of fines or imprisonment for up to three months.73

According to Article 51 of the Media Law, journalists cannot be held responsible for potentially libelous quotes from sources, but they can be held responsible for libel in their own content.74

In March 2018, in an effort to restart the Icelandic Modern Media Initiative (see C1), the prime minister appointed an expert committee tasked with improving legislation concerning freedom of expression, media, and information.75 The committee reviewed earlier bills and drafted new ones in line with its mandate. The committee delivered five bills to the government in 2018 (aimed at reducing compensation for defamation claims, narrowing the definition of criminal hate speech, narrowing the intermediary liability of ISPs, protecting civil servants’ freedom of expression, and removing data retention requirements) and four additional bills in 2019 (concerning freedom of information, whistleblower protections, injunctions on publication, and amending the Media Law regarding the responsibility of journalists). All were presented for consultation online.76 Aside from the whistleblower protection bill enacted in 2020 (see C1), none of these measures have been enacted.

Internet users are periodically prosecuted but rarely penalized for their online activities. The coverage period saw no notable civil or criminal cases for online expression.

The government does not place restrictions on anonymous communication. No registration is required when purchasing a SIM card.77 Users can freely use encrypted tools, and there are no laws requiring decryption or the disclosure of encryption keys.

Users are generally free from state surveillance, which is regulated under the Telecommunications Law78 and a set of rules issued in 2006.79 According to the most recent data disclosed by the public prosecutor’s office, police requested phone usage data or other related surveillance techniques a total of 388 times in 2020, with phone usage data specifically requested 92 times.80

According to the 2013 revelations that the United States and allied intelligence agencies had been collecting and storing massive amounts of user data from global online communications, Iceland has cooperated with the activities of the Five Eyes—the intelligence alliance between the United States, the United Kingdom, Australia, Canada, and New Zealand.81 It is not clear whether that cooperation extended into the coverage period.

Internet users are protected by a strong data protection law, although the government has set data retention requirements. In July 2018, Iceland’s Act on Data Protection and the Processing of Personal Data entered into force; among other things, it implements the EU’s General Data Protection Regulation (GDPR).82

A 2005 amendment83 to the Electronic Communications Act of 2003 implements data retention requirements.84 The law applies to telecommunications providers and mandates the retention of user data, including browsing history, for six months.85 It also states that companies may deliver user data only in criminal cases or on matters of public safety and that such information may be given only to the police or the public prosecutor.86

Users were not subjected to extralegal intimidation or physical violence by state authorities or other actors in relation to their online activities during the coverage period.

Private companies and ordinary users are occasionally subjected to cyberattacks or hacking attempts.

In February 2024, the University of Reykjavík was subject to a cyberattack potentially leaking six to eight thousand university affiliates’ personal data, including the names, social security numbers, email addresses, and passwords of current and previous students and staff.87 According to the university, the attack was likely carried out by Akira, a recently established, prominent Russian ransomware gang.88

Media outlets were also targeted during the coverage period. In February 2024, daily newspaper Morgunblaðið‘s website was the subject of a minor distributed denial-of service (DDoS) attack. The site was offline for minutes before returning online.89 In June 2024, after the coverage period, Morgunblaðið's website and radio station were taken offline for three hours after its publisher, Árvakur, was subject to a cyberattack by Russian hacking group Akira.90

During the previous coverage period, in May 2023, Iceland’s Department of Civil Protection and Emergency Management declared a “state of uncertainty” due to a series of cyberattacks that appeared to be connected to the Council of Europe Summit held in Reykjavík. The targets included websites belonging to Iceland’s Council of Ministers, the parliament (Alþingi), and the National Airport and Air Navigation Service Provider of Iceland (ISAVIA). Additional attempts to access personal information through Island.is and Iceland’s electronic ID system were also made.91 The pro-Russian hacking group NoName057(16) claimed responsibility for the attack, stating the attack was in response to Ukrainian President Volodymyr Zelenskyy’s address at the Council of Europe Summit.92 The state of uncertainty was lifted three days after the first attack.93

in August 2022, one of Iceland’s then main newspapers Fréttablaðið, which has since closed (see B7), was hit by a DDoS attack after publishing an interview with Valur Gunnarsson, a journalist reporting from Ukraine. The article included a photo depicting a Ukrainian individual stepping on the Russian flag. Prior to the attack, Fréttablaðið’s editorial inbox received an email from Russian hackers demanding that the article be taken down and that Fréttablaðið issue a public apology for publishing the article.94 The Russian embassy in Iceland also contacted the outlet, condemning the article in question and urging the outlet to comply with the hackers’ request. Sigmundur Ernir, the outlet’s editor in chief, stated that Fréttablaðið would not be issuing an apology.95

In November 2022, an executive at RÚV, Iceland’s state broadcaster, claimed that RÚV faced cyberattacks daily, but noted that the broadcaster was well-equipped to manage the attacks. Relatedly, a spokesperson for the Ministry of Foreign Affairs stated that the ministry was monitoring cases like this closely.96 In April 2022, the websites of RÚV and Icelandic newspaper DV experienced temporary disruptions after being targeted with DDoS attacks. The attacks rendered the DV website fully inaccessible multiple times, while the disruptions to the RÚV were minimal.97

The National Computer Security Incident Response Team (CERT–ÍS), operating within the ECOI, is the national point of contact for critical cybersecurity incidents.98 In 2015, the Ministry of the Interior published an ICT security policy that aimed to increase resilience for, raise awareness about, and expand collaboration with international organizations on cybersecurity issues.99 The ECOI also operates a website with cybersecurity advisories for the public.100