Malaysia Online Safety Act 2025 (ONSA)

The Online Safety Act 2025 (Act 866) is Malaysian legislation that came into force on January 1, 2026, requiring social media and messaging platforms with over 8 million Malaysian users to remove harmful content and implement safety measures. The Act targets nine categories of harmful content including child sexual abuse material and financial fraud, with platforms facing fines up to RM10 million for non-compliance. Civil society groups have raised concerns about potential censorship and surveillance, while the government maintains the Act targets platform accountability rather than individual users.

Background

Between January and November 2025, Malaysian police recorded RM2.7 billion in reported losses from online scams. A UNICEF study identified more than 100,000 children in Malaysia at risk of online sexual exploitation, with police operations uncovering hundreds of thousands of files containing child sexual abuse material.

Between January 2024 and November 2025, major platforms removed 92% of 697,061 harmful posts flagged by Malaysian authorities, but 58,104 posts remained accessible online. These ongoing challenges prompted the Malaysian government to introduce the Online Safety Act 2025 to strengthen platform accountability for harmful content and protect Malaysian internet users, particularly children.

Key provision

Who it applies to

The Act applies to licensed service providers under the Communications and Multimedia Act 1998, specifically Applications Service Providers (ASPs), Content Applications Service Providers (CASPs), and Network Service Providers (NSPs). Social media or messaging platforms with over 8 million users in Malaysia are automatically deemed licensees and subject to the Act's requirements. The Act has extra-territorial reach, applying to companies outside Malaysia if they provide services within Malaysia and fall under the licensing framework.

Affected platforms

Based on the 8 million user threshold, major platforms subject to the Act include:

• Facebook: With 31.3 million users (88.2% of population)
• Instagram: With 16.3 million users (46% of population)
• Facebook Messenger: With 23.8 million users (67.1% of population)
• LinkedIn: With 9.9 million users

Other major platforms including WhatsApp, TikTok, X (formerly Twitter), YouTube, Telegram, and WeChat also operate in Malaysia and are understood to exceed the 8 million user threshold.

Categories of harmful content

The Act identifies nine categories of harmful content that platforms must address, including child sexual abuse material, financial fraud, harassment, incitement to violence or terrorism, and other harmful categories. Child sexual abuse and financial fraud are designated as "priority harmful content" subject to additional regulation and faster response requirements.

Platform obligations

Licensed providers must implement measures to reduce user exposure to harmful content, issue safety guidelines, provide online safety tools, provide user support mechanisms, and establish reporting channels for harmful content. Platforms must submit an Online Safety Plan to the Malaysian Communications and Multimedia Commission (MCMC) and make it publicly available.

They must also implement child-specific safeguards including limiting communication between children and adults, regulating recommendation systems to prevent harmful content exposure, addressing addictive design features, and protecting children's personal data.

Enforcement

The Act is overseen by the Malaysian Communications and Multimedia Commission (MCMC). Service providers can face fines up to RM10 million for non-compliance with the Act's requirements. The Act establishes an Online Safety Appeal Tribunal to handle grievances related to Commission decisions and enforcement actions.

Age verification and under-16 ban

In November 2025, the Malaysian government announced plans to ban children under 16 from having social media accounts starting in 2026, raising the minimum age from 13. Communications Minister Fahmi Fadzil stated that social media platforms would be required to implement electronic know-your-customer (eKYC) identity checks using government-issued identity documents such as the MyKad identity card, passports or the national digital ID.

The government also raised the use of biometric authentication as part of identity verification, with platforms expected to adopt a combination of document verification, biometrics, and risk signals to limit minors' access. Deputy Communications Minister Teo Nie Ching announced a regulatory sandbox process that would allow MCMC to collaborate with platform providers to test age verification mechanisms and AI for the detection of high-risk content.

Privacy concerns

Harris Zainul, director of research at the Institute of Strategic and International Studies Malaysia, warned that the eKYC requirement could compromise user privacy and anonymity, which can be crucial for whistle-blowers and human-rights defenders. Critics noted that alternatives such as zero-knowledge proofs could confirm users' eligibility without revealing additional personal information, suggesting the eKYC method might be overly intrusive.

Digital rights organizations raised concerns that mandatory identity verification would create comprehensive databases of social media users that could be vulnerable to data breaches or government surveillance. Privacy advocates warned that once biometric data is collected, there are limited guarantees about how long it will be retained or whether it could be used for purposes beyond age verification.

Technical accuracy issues

Experts raised concerns that facial recognition technology-based age verification might not always be accurate and can have racial or gender biases, potentially putting legitimate users at risk of having their accounts deleted. Studies have shown that AI age estimation systems perform less accurately on certain demographic groups, raising fairness concerns about who might be disproportionately restricted from accessing social media platforms.

Technical researchers noted that age estimation technology remains imprecise, with error margins that could incorrectly flag adults as minors or vice versa, leading to both over-blocking and under-blocking.

Impact on children's rights

Critics argued that the ban could cut children off from support groups, community support systems, and online opportunities for self-expression through art, music, and other forms. Amnesty International Malaysia and other civil society groups advocated for a more nuanced approach that protects children's privacy while prioritizing their rights to expression and access to information.

Youth advocacy organizations warned that blanket age restrictions fail to account for the legitimate educational and social benefits that young people derive from social media platforms, including access to educational content, creative communities, and mental health resources.

Enforcement challenges

International experience suggests enforcement difficulties, with the UK's age verification requirements leading to sharp drops in traffic but users quickly finding workarounds through VPN services, which saw an 1,800% spike in UK sign-ups within three days of implementation. Technology experts noted that determined users, particularly tech-savvy teenagers, can often circumvent age verification systems through various methods including VPNs, fake IDs, or using accounts registered by adults.

Critics questioned whether the significant investment in age verification infrastructure would deliver the intended child protection outcomes, given the ease with which such systems can be bypassed and the potential for pushing young users toward less regulated platforms.

Criticism and concerns

Freedom of expression

Civil society groups including the Centre for Independent Journalism, ARTICLE 19, and Sinar Project raised concerns that the Act grants excessive and largely unchecked powers to authorities to decide what content is considered "harmful", risking increased removal of lawful content. The groups argued that the broad definition of harmful content could be interpreted subjectively, potentially leading to censorship of legitimate political speech and criticism.

Malaysia's position on the World Press Freedom Index dropped from 73rd in 2023 to 107th in 2024, reflecting growing concerns about shrinking civic spaces. Digital rights advocates warned that the Act's implementation occurs against a backdrop of declining press freedom and increasing restrictions on online expression.

Critics argued that the definition of harmful content is broadly worded and open to interpretation, potentially leading platforms to over-censor content to avoid penalties of up to RM10 million. Legal experts noted that terms like "harmful to society" lack precise legal definitions, creating uncertainty for both platforms and users about what content is permissible.

Privacy and surveillance

The government announced plans to require mandatory electronic Know-Your-Customer (eKYC) verification using government-issued documents for all social media users. Critics argue this would expose users to identification and tracking, making them vulnerable to state surveillance, selective enforcement, and self-censorship.

Digital rights organizations warned that mandatory identity verification would eliminate online anonymity, which is essential for whistleblowers, journalists, activists, and marginalized communities to speak freely without fear of retaliation. Privacy advocates noted that once identity databases are created, they could be used for purposes beyond their original intent, including political monitoring or targeted enforcement against critics.

Civil society organizations criticized the lack of transparency and independent oversight in enforcement, noting the risk of abuse and selective enforcement against government critics or opposition voices. The absence of robust judicial oversight or independent appeals mechanisms raised concerns that enforcement decisions could be politically motivated.

Platform over-compliance and economic impact

Technology policy analysts warned that platforms might over-remove content to avoid hefty fines, leading to excessive censorship beyond what the law technically requires. This "chilling effect" could result in removal of legitimate speech, satire, artistic expression, and political commentary that does not actually violate the Act's provisions.

Smaller platforms and Malaysian tech startups expressed concerns about compliance costs, noting that the requirement to submit Online Safety Plans, implement content moderation systems, and provide user safety tools could create barriers to entry that favor large international platforms. Industry representatives warned this could stifle Malaysia's digital economy and innovation in the tech sector.

Lack of consultation and transparency

Critics noted that the Act was passed with limited public consultation and without adequate engagement with civil society, digital rights groups, and affected communities. Media freedom organizations argued that rushed implementation without proper stakeholder input increased the risk of unintended consequences and ineffective enforcement.

Transparency advocates called for MCMC to publish clear enforcement guidelines, data on content removal requests, and regular reports on how the Act is being implemented to ensure accountability. The lack of public information about how "harmful content" determinations are made raised concerns about arbitrary or inconsistent enforcement.

Public Petitions and Advocacy

Stop eKYC Petition

In November 2025, a Change.org petition titled "Stop eKYC for social media in Malaysia and promote digital literacy" was launched opposing mandatory identity verification requirements for social media users. The petition raises several concerns about the eKYC requirement:

Data Breach Risks: The petition cites international examples of age verification data breaches, including Discord's leak of approximately 70,000 users' identification documents in the UK, which exposed children to doxxing risks and enabled predators to attempt purchasing children's IDs for stalking and potential kidnapping.

Identity Theft: Petitioners warn that bad actors could use leaked identification documents to commit identity theft and open false bank accounts in victims' names.

Freedom of Expression: The petition argues that mandatory ID verification could enable government persecution of critics, citing claims that 30 people per day in the UK are imprisoned for social media posts under similar identity verification systems. Petitioners express concern that "power in excess only leads to an eventual abuse of a system and corruption."

The petition advocates for promoting digital literacy and parental education as alternatives to mandatory identity verification, arguing that child safety should not come "at the cost of privacy, freedom of speech and anonymity."

Government response

MCMC officials stated the Act was designed to protect the safety of social media users rather than control their freedom of expression. Officials emphasized the Act targets platform providers who fail to filter harmful content, not individual users or their right to express opinions online.

The government defended the Act as necessary to combat significant financial losses from online scams and protect vulnerable users, particularly children. Communications Minister Fahmi Fadzil cited police statistics showing RM2.7 billion in reported losses from online scams between January and November 2025 as evidence of the urgent need for platform accountability.

Officials maintained that the Act does not create new criminal offenses relating to lawful speech or political expression, and that existing constitutional protections for freedom of speech remain in place. The government argued that the Act's provisions are consistent with international approaches to online safety and platform regulation in countries such as Australia, the United Kingdom, and the European Union.

Regarding age verification concerns, Deputy Communications Minister Teo Nie Ching emphasized that the regulatory sandbox approach would allow testing of different age verification methods to balance child protection with privacy considerations. She stated that the government remains open to feedback from stakeholders and would consider privacy-preserving alternatives if they prove effective.

The government rejected characterizations of the Act as authoritarian or censorious, arguing that democratic societies worldwide are grappling with how to balance online safety with free expression, and that Malaysia's approach is proportionate to the harms being addressed. Minister Fahmi Fadzil stated that the government welcomes constructive dialogue about implementation but remains committed to protecting Malaysians from online harms.