Ľubomír Zlocha – Tomáš Gábriš – Ondrej Kobyda
Slovak Academy of Sciences, Institute of State and Law, Bratislava, Slovak Republic
Slovakia currently finds itself in a precarious position within the European digital landscape. It is a nation exceptionally vulnerable to hoaxes, propaganda, and foreign influence operations, with recent data from July 2025 showing that 37% of the population is susceptible to believing hoaxes and conspiracy theories. Although there is a strong public mandate for state intervention – with 84% of citizens agreeing that the state should do more to combat disinformation – there is a stark disconnect between political will and practical results.[1]
This gives rise to the concept of the “implementation gap”. On paper, Slovakia has developed a seemingly robust legal structure designed to police the internet and block harmful content. However, in practice, there is a significant divide between these legislative tools and their actual effectiveness. This “regulatory lag” was most visible during the 2023 parliamentary elections when an AI-generated deepfake circulated during a mandatory 48-hour election silence; despite the clear harm to the democratic process, authorities lacked the tools and agility to intervene in time.[2]
The core tension in Slovak digital regulation lies in this very struggle: a legal framework exists, but it is hollowed out by a lack of institutional capacity and a systemic deficiency in transparency. The primary authority tasked with website blocking, the National Security Authority (NBÚ), has faced significant hurdles regarding human resources and the technical expertise required for rapid content moderation. Furthermore, the criteria for what constitutes a “hybrid threat” or “harmful content” remain largely opaque and non-public, leading to criticisms of potential arbitrariness and “collateral censorship”. As this paper demonstrates, having the power to block a domain means very little if the state lacks the resources to identify the threat or the transparency to justify the action to its citizens.[3]
The Cyber Security Act (Act No. 69/2018 Coll.) serves as the primary legal cornerstone for Slovakia’s technical response to digital threats. Under this framework, the National Security Authority (NBÚ) is the central body empowered to intervene in the digital space by blocking access to entire domains.[4]
The law grants the NBÚ the authority to block websites that disseminate “harmful content” or engage in “harmful activity”. This mandate is significantly broader than traditional cybersecurity (such as stopping malware or hacking); it extends to activities classified as “hybrid threats” – actions that could harm the security, foreign policy, or economic interests of the Slovak Republic. Most notably, the legal definition of harmful content explicitly includes the dissemination of “serious disinformation”.
However, this broad mandate has been a lightning rod for criticism. Legal experts and civil society organizations have raised alarms that the definitions of “harmful content” and “hybrid threat” lack precise, objective criteria, leaving too much room for administrative discretion and potential “collateral censorship”.
The year 2022 marked a fundamental shift in how this power of the NBÚ is exercised. Following the invasion of Ukraine, emergency legislation allowed the NBÚ to trigger website blocking on its own initiative. This was a proactive period in which the authority could act independently as the primary monitor of the information space.[5]
However, this specific “own initiative” competence was time-limited and expired on September 30, 2022.[6] Since then, the legal landscape has changed:
The outcome is that despite the existing legal powers, a significant “implementation gap” has emerged. At present, the NBÚ’s blocking powers are not utilized in practice. This is partly due to the more structured, less “ad hoc” nature of the current motion-based system, but also because the authority faces chronic shortages of specialized human resources and technical expertise required to monitor and analyze the rapid flow of online disinformation. As a result, the state’s most powerful tool for “turning off” harmful websites currently remains largely dormant.[7]
While the National Security Authority (NBÚ) often takes center stage in discussions about internet regulation, it does not act in a vacuum. Slovakia has developed what can be described as a “poly-authority structure”. In this ecosystem, the responsibility for policing the digital space is distributed across several specialized bodies, each with its own legal mandate and specific tools for intervention.[8]
Notably, the most active player in website blocking is not a security agency, but the Gambling Regulatory Authority (GRA). Currently, the GRA is the only body in Slovakia that performs domain-level blocking on a regular and systematic basis:
A newer addition to this landscape is the expanded power of consumer protection authorities. Under the Consumer Protection Act (Act No. 108/2024 Coll.), the state has gained the power to intervene when digital content threatens the collective interests of consumers:
This poly-authority model is further rounded out by the Council for Media Services (RPMS), which now serves as the national Digital Services Coordinator under the EU’s Digital Services Act (DSA). This marks a significant shift in the regulatory philosophy: moving away from the NBÚ’s focus on blocking individual domains toward a broader oversight of how multinational platforms moderate content and manage systemic risks.[11]
In the modern digital era, the traditional regulatory approach of blocking entire domains (websites) is increasingly viewed as an outdated concept. The primary battleground for information warfare has shifted from the “open web” to the “closed ecosystems” of multinational platforms such as TikTok, Telegram, and Facebook.
This was confirmed by the first extensive European study, SIMODS (Structural Indicators to Monitor Online Disinformation Scientifically), which included the Slovak fact-checking project Demagog.sk, and provided data in 2025 regarding the Slovak digital space. The study revealed a high prevalence of disinformation across specific platforms:
However, perhaps the most concerning finding of the study is the existence of an “algorithmic reward”. Current platform systems are designed in a way that spreading disinformation often achieves greater reach and more interactions than credible, fact-based sources. In essence, the architecture of these social networks effectively “rewards” disinformation content, making it more visible to users than verified news.
Modern disinformation has thus become “atomized” – it no longer exists as a single, cohesive website that can simply be “turned off”. Instead, it spreads as millions of small fragments within closed, algorithmically managed communities. A prime example was the 2023 Slovak elections deepfake incident, which was primarily disseminated via Telegram and Facebook during a mandatory election silence.
In this environment, national-level domain blocking is increasingly marginal. This is further compounded by the fact that when the state attempts to block a specific domain, operators quickly bypass these efforts using mirror sites, VPNs, or by migrating entirely to encrypted platforms like Telegram.[12]
The data thus suggests that effective regulation must shift from the blunt instrument of national domain blocking toward transnational algorithmic regulation. This means moving away from trying to block individual web addresses and focusing instead on the rigorous enforcement of the Digital Services Act (DSA), which demands transparency and risk management from the global platforms that now control the flow of information.
The implementation of internet content regulation in Slovakia faces several hurdles that limit its effectiveness and raise significant legal concerns. These challenges can be categorized into technical limitations, institutional constraints, and transparency issues.
Technical Limitations: One of the most significant technical constraints is that, under current Slovak law, the National Security Authority (NBÚ) can only block entire domains. This means authorities do not have the legal mandate to filter specific URLs or subpages. Consequently, any attempt to remove harmful content inevitably results in blocking access to the entire website. This blunt approach has been criticized as it can lead to “collateral censorship,” where legitimate speech is blocked alongside harmful content due to sharing the same domain.
Institutional Constraints: The effectiveness of the NBÚ is further hampered by a critical lack of institutional capacity. Reports and academic analyses indicate that the agency faces significant shortages in both specialized human resources and the technical expertise required for rapid content moderation. The sheer volume and speed of online disinformation require continuous monitoring and analysis capabilities that the NBÚ currently lacks due to potentially limited resources. This lack of capacity is cited as a primary reason why the legal authority to block content was rarely exercised in practice.[13]
Transparency Issues: Beyond technical and staffing issues, the legal framework itself has been criticized for its lack of transparency. The definitions of “harmful content” and “hybrid threats” in the Cyber Security Act are remarkably broad and lack precise, objective criteria. Furthermore, the specific detailed methodology or criteria used to assess these threats are not public.[14] This opacity has drawn criticism from legal experts and civil society organizations, who argue that it creates a risk of arbitrary application and undermines the accountability of the entire regulatory system.
The landscape of digital regulation in Slovakia has reached a definitive turning point. While the state has historically relied on the power of the National Security Authority (NBÚ) to block specific websites, this approach is becoming increasingly marginal in the actual fight against modern disinformation. The primary battleground for information warfare has shifted from the open web to the closed ecosystems of multinational platforms like TikTok, Telegram, and Facebook – spaces where traditional national domain blocking tools have little to no reach.
The inadequacy of national-level tools was starkly illustrated by the 2023 deepfake incident, where harmful content spread rapidly through global applications that remained untouched by domestic blocking powers. As the SIMODS study (2025) confirms, disinformation in Slovakia is now “atomized” and thrives within algorithmically managed environments that frequently reward sensationalism and falsehoods over credible information. In this new reality, attempting to “turn off” a single domain is an outdated response to a decentralized and technically sophisticated threat.
Consequently, the future of internet regulation lies in transnational algorithmic regulation, spearheaded by the rigorous enforcement of the Digital Services Act (DSA). The focus has officially shifted from managing national domain registries to overseeing how global tech giants moderate content and mitigate systemic risks. With the Council for Media Services (RPMS) now serving as the national Digital Services Coordinator, Slovakia is moving toward a model that prioritizes platform transparency and algorithmic accountability. Ultimately, the goal is no longer just to block individual websites, but to ensure that the global digital platforms controlling our information flow are held to clear, enforceable standards of safety and truth.
[1] Hajdu, Dominika – Klingová, Katarína – Kazaz, Jana – Kortiš, Michal (2022): GLOBSEC Trends 2022: Väčšina ľudí na Slovensku stále verí konšpiráciám a cíti sa ohrozene. Globsec. (online). (cited 2026-30-05). Available at : https://www.globsec.org/what-we-do/press-releases/globsec-trends-2022-vacsina-ludi-na-slovensku-stale-veri-konspiraciam; CEDMO Trends – CEDMO, (cited 2026-30-05). Available at: https -//cedmohub.eu/cedmo-trends-2/.
[2] Upozornenie: Čoraz častejšie „deepfake“ videá testujú našu obozretnosť. Národná banka Slovenska. (online). (cited 2026-30-05). Available at: https://nbs.sk/aktuality/upozornenie-coraz-castejsie-deepfake-videa-testuju-nasu-obozretnost/.
[3] Správa o kybernetickej bezpečnosti v Slovenskej republike v roku 2024. Národný bezpečnostný úrad. (online). (cited 2026-30-05). Available at: https://www.nbu.gov.sk/data/att/3305.pdf.
[4] Act. No. 69/2018 Coll. on Cybersecurity and on Amendments to Certain Acts. (online). (cited 2026-30-05). Available at: https://www.slov-lex.sk/ezbierky/pravne-predpisy/SK/ZZ/2018/69/.
[5] Being published only on the website of the NBÚ. (cited 2026-30-05). Available at: https://www.nbu.gov.sk/data/att/1135.pdf; (2022): Statement of SK-NIC, a.s. on deactivation of the so-called disinformation domains / websites. SK-NIC. (online). (cited 2026-30-05). Available at: https://sk-nic.sk/en/statement-of-sk-nic-a-s-on-deactivation-of-the-so-called-disinformation-domains-websites/.
[6] Top privacy s.r.o. (2021): Amendment to the Cyber Security Act. Top privacy. (online). (cited 2026-30-05). Available at: https://www.legalfirm.sk/en/top-privacy/clanok/amendment-cyber-security-act.
[7] (2022): Slovakia loses power to block disinformation websites. The Slovak spectator. (online). (cited 2026-30-05). Available at: https://spectator.sme.sk/politics-and-society/c/slovakia-loses-power-to-block-disinformation-websites; Správa o kybernetickej bezpečnosti v Slovenskej republike v roku 2024. Národný bezpečnostný úrad. (online). (cited 2026-30-05). Available at: https://www.nbu.gov.sk/data/att/3305.pdf.
[8] Sokol, Pavol – Bachňáková Rózenfeldová, Laura (2025): Content blocking mechanism in cybersecurity: Slovakia case study. SpringerOpen. (online). (cited 2026-30-05). Available at: https://jis-eurasipjournals.springeropen.com/articles/10.1186/s13635-025-00190-x.
[9] List of blocked websites. (online). (cited 2026-30-05). Available at: https://www.urhh.sk/urad/dozor-a-kontrola/zakazane-ponuky/zoznam-blokovanych-webov/.
[10] Zoznam blokovaných subjektov. Národný bezpečnostný úrad. (online). (cited 2026-30-05). Available at: https://www.nbu.gov.sk/zoznam-blokovanych-subjektov/.
[11] Slovakia: Amendments to Media Services Act designating Slovak competent authority and Digital Services Coordinator under the DSA were adopted by National Council. Digital Policy Alert. (online). (cited 2026-30-05). Available at:https://digitalpolicyalert.org/event/27021-act-2642022-z-z-on-media-services-and-on-amendments-to-certain-acts-media-services-act-designating-slovak-competent-authorities-and-coordinator-under-the-digital-service-act-dsa-could-was-implemented.
[12] Hlatky, Roman: Nations in Transit 2023, Slovakia. Freedom House. (online). (cited 2026-30-05). Available at:https://freedomhouse.org/country/slovakia/nations-transit/2023; Cory, Nigel (2021): Website Blocking in Europe: Debated, Tested, Approved, and Defended. ITIF. (online). (cited 2026-30-05). Available at:https://itif.org/publications/2021/05/07/website-blocking-europe-debated-tested-approved-and-defended/.
[13] Správa o kybernetickej bezpečnosti v Slovenskej republike v roku 2024. Národný bezpečnostný úrad. (online). (cited 2026-30-05). Available at: https://www.nbu.gov.sk/data/att/3305.pdf; Sokol, Pavol – Bachňáková Rózenfeldová, Laura (2025): Content blocking mechanism in cybersecurity: Slovakia case study. SpringerOpen. (online). (cited 2026-30-05). Available at: https://jis-eurasipjournals.springeropen.com/articles/10.1186/s13635-025-00190-x.
[14] General rules are available at: https://www.nbu.gov.sk/data/att/1135.pdf (online). (cited 2026-30-05); LIBERTIES RULE OF LAW REPORT 2023 SLOVAKIA. VIA IURIS. (online). (cited 2026-30-05). Available at: https://dq4n3btxmr8c9.cloudfront.net/files/h4j5hd/RuleOfLaw_Report_2023_Slovakia_EU.pdf.