Editing Malaysia Online Safety Act 2025 (ONSA)

{{IncidentCargo
|Company=N/A
|StartDate=2026-01-01
|Status=Active
|ArticleType=Service
|Type=Privacy, cencorship, digital rights, content moderadion
|Description=Malaysian law requiring platforms with 8M+ users to remove harmful content. Critics cite censorship concerns; government says it targets platforms, no
}}
The '''Online Safety Act 2025''' ('''Act 866''') is Malaysian legislation that came into force on January 1, 2026, requiring social media and messaging platforms with over 8 million Malaysian users to remove harmful content and implement safety measures.<ref name=":15">{{Cite web |last= |first= |date=2026-01-02 |title=Online Safety Act comes into force to protect users |url=https://www.thestar.com.my/news/nation/2026/01/02/online-safety-act-comes-into-force-to-protect-users |url-status=live |archive-url=https://archive.is/baPUk |archive-date=2026-02-11 |access-date=2026-02-11 |website=The Star}}</ref> The Act targets nine categories of harmful content including child sexual abuse material and financial fraud, with platforms facing fines up to RM10 million for non-compliance. <ref name=":0">{{Cite web |title=ONSA-FAQ-English.pdf |url=https://www.mcmc.gov.my/skmmgovmy/media/General/pdf2/ONSA-FAQ-English.pdf |url-status=live |archive-url=https://web.archive.org/web/20260101142253/https://www.mcmc.gov.my/skmmgovmy/media/General/pdf2/ONSA-FAQ-English.pdf |archive-date=2026-01-01 |website=MCMC}}</ref> Civil society groups have raised concerns about potential censorship and surveillance, while the government maintains the Act targets platform accountability rather than individual users.<ref name=":2">{{Cite web |last= |title=Malaysia: Concerns with the Online Safety Bill 2024 |url=https://www.article19.org/resources/malaysia-online-safety-bill/ |url-status=live |archive-url=https://archive.is/lun8S |archive-date=2026-02-11 |access-date=2026-02-11 |website=Article 19}}</ref>

==Background==
Between January and November 2025, Malaysian police recorded RM2.7 billion in reported losses from online scams.<ref name=":3">{{Cite web |last=Bernama |date=2025-12-08 |title=Online scams cost Malaysians over RM2.7bil as of November |url=https://www.thestar.com.my/news/nation/2025/12/08/online-scams-cost-malaysians-over-rm27bil-as-of-november |url-status=live |archive-url=https://archive.is/9Lzle |archive-date=2026-02-11 |access-date=2026-02-11 |website=The Star}}</ref> A UNICEF study identified more than 100,000 children in Malaysia at risk of online sexual exploitation.<ref>{{Cite web |last=Harry Beaty |first=Gloria |last2=Salehuddin |first2=Sufea |date=2024-12-02 |title=The growing threat of online child exploitation |url=https://themalaysianreserve.com/2024/12/02/the-growing-threat-of-online-child-exploitation/ |url-status=live |website=The Malaysian Reserve}}</ref><!-- < TMR resists archiving tools --> <!-- Original 404! reference in case it gives context: [404!]. https://www.unicef.org/malaysia/press-releases/unicef-malaysia-online-child-safety-report

 --><!-- < Original Sentence: with police operations uncovering hundreds of thousands of files containing child sexual abuse material. [citation needed - Sentence mixes two different sources together?] -->

Between January 2024 and November 2025, major platforms removed 92% of 697,061 harmful posts flagged by Malaysian authorities, but 58,104 posts remained accessible online.<ref>{{Cite web |last=Raja Reza |first=Danish |date=2026-02-04 |title=What the Online Safety Act changes, and how it works |url=https://www.freemalaysiatoday.com/category/nation/2026/02/04/what-the-online-safety-act-changes-and-how-it-works |url-status=live |archive-url=https://archive.is/OErTu |archive-date=2026-02-11 |access-date=2026-02-11 |website=Free Malaysia Today}}</ref> These ongoing challenges prompted the Malaysian government to introduce the Online Safety Act 2025 to strengthen platform accountability for harmful content and protect Malaysian internet users, particularly children.<ref>{{Cite web |last= |date=2026-01-01 |title=Enforcement of Online Safety Act takes effect, strengthening online protections for children and families, says MCMC |url=https://www.malaymail.com/news/malaysia/2026/01/01/enforcement-of-online-safety-act-takes-effect-strengthening-online-protections-for-children-and-families-says-mcmc/203923 |url-status=live |archive-url=https://archive.is/ksNvz |archive-date=2026-02-11 |access-date=2026-02-11 |website=Malay Mail}}</ref>

==Key provision==

===Who it applies to===
The Act applies to licensed service providers under the Communications and Multimedia Act 1998, specifically Applications Service Providers (ASPs), Content Applications Service Providers (CASPs), and Network Service Providers (NSPs).<ref name=":15" /><ref name=":0" /> Social media or messaging platforms with over 8 million users in Malaysia are automatically deemed licensees and subject to the Act's requirements.{{CitationNeeded}} The Act has extra-territorial reach, applying to companies outside Malaysia if they provide services within Malaysia and fall under the licensing framework. <ref>{{Cite book |url=https://lom.agc.gov.my/ilims/upload/portal/akta/outputaktap/2867049_BI/Act%20866-Online%20Safety%20Act%202025.pdf |title=ONLINE SAFETY ACT 2025 - Act 866 |year=2025 |pages=10 |archive-url=https://web.archive.org/web/20250911161002/https://lom.agc.gov.my/ilims/upload/portal/akta/outputaktap/2867049_BI/Act%20866-Online%20Safety%20Act%202025.pdf |archive-date=2025-09-11 |url-status=live}}</ref>

===Affected platforms===
Based on the 8 million user threshold, major platforms subject to the Act include: 

*'''Facebook''': With 31.3 million users (88.2% of population)<ref name=":6">{{Cite web |title=Social Media Users in Malaysia - 2025 {{!}} NapoleonCat |url=https://stats.napoleoncat.com/social-media-users-in-malaysia/2025/ |url-status=live |archive-url=https://archive.is/pZcU4 |archive-date=2026-02-11 |access-date=2026-02-11 |website=NapoleonCat}}</ref>
*'''Instagram''': With 16.3 million users (46% of population)<ref name=":6" />
*'''Facebook Messenger''': With 23.8 million users (67.1% of population)<ref name=":6" />
*'''LinkedIn''': With 9.9 million users<ref name=":6" />

Other major platforms including WhatsApp, TikTok, X (formerly Twitter), YouTube, Telegram, and WeChat also operate in Malaysia and are understood to exceed the 8 million user threshold.{{CitationNeeded|reason=generated citation is irrelevant >}} <ref>{{Cite web |date=2026-01-01 |title=Enforcement of Online Safety Act takes effect, strengthening online protections for children and families, says MCMC |url=https://www.malaymail.com/news/malaysia/2026/01/01/enforcement-of-online-safety-act-takes-effect-strengthening-online-protections-for-children-and-families-says-mcmc/203923 |url-status=live |archive-url=https://web.archive.org/web/20260112004727/https://www.malaymail.com/news/malaysia/2026/01/01/enforcement-of-online-safety-act-takes-effect-strengthening-online-protections-for-children-and-families-says-mcmc/203923 |archive-date=2026-01-12 |website=malaymail}}</ref>

===Categories of harmful content===
The Act identifies nine categories of harmful content that platforms must address, including child sexual abuse material, financial fraud, harassment, incitement to violence or terrorism, and other harmful categories. Child sexual abuse and financial fraud are designated as "priority harmful content" subject to additional regulation and faster response requirements.<ref name=":0" /> <!-- < Page 3 of the FAQ. Not sure if this should be cited as Book -->

===Platform obligations===
Licensed providers must implement measures to reduce user exposure to harmful content, issue safety guidelines, provide online safety tools, provide user support mechanisms, and establish reporting channels for harmful content.  Platforms must submit an Online Safety Plan to the Malaysian Communications and Multimedia Commission (MCMC) and make it publicly available.<ref name=":0" /><!-- Page 2, #5 -->

They must also implement child-specific safeguards including limiting communication between children and adults, regulating recommendation systems to prevent harmful content exposure, addressing addictive design features, and protecting children's personal data.{{CitationNeeded|reason=generated citation is irrelevant >}} <ref name=":7">{{Cite web |last=[404!] |title= |url=https://www.thestar.com.my/tech/tech-news/2025/12/31/what-you-need-to-know-about-the-online-safety-act-2025 |url-status=dead}}</ref>

===Enforcement===
The Act is overseen by the Malaysian Communications and Multimedia Commission (MCMC).<ref name=":1">{{Cite web |last=[525]\[404] |first= |title= |url=https://www.mcmc.gov.my/en/media/press-releases/online-safety-act-2025 |url-status=dead}}</ref> Service providers can face fines up to RM10 million for non-compliance with the Act's requirements. <ref name=":4">{{Cite web |last=[404!] |title= |url=https://www.thestar.com.my/news/nation/2026/01/01/online-safety-act-2025-comes-into-effect |url-status=dead}}</ref>The Act establishes an Online Safety Appeal Tribunal to handle grievances related to Commission decisions and enforcement actions.<ref name=":5">{{Cite web |title= |url=https://lom.agc.gov.my/act-view.php?language=eng&type=act&no=866&year=2025}}</ref>

==Age verification and under-16 ban==
In November 2025, the Malaysian government announced plans to ban children under 16 from having social media accounts starting in 2026, raising the minimum age from 13.<ref>{{Cite web |last=[404!] |title= |url=https://www.thestar.com.my/news/nation/2025/11/24/malaysia-plans-to-ban-under-16s-from-social-media |url-status=dead}}</ref> Communications Minister Fahmi Fadzil stated that social media platforms would be required to implement electronic know-your-customer (eKYC) identity checks using government-issued identity documents such as the MyKad identity card, passports or the national digital ID.<ref name=":8">{{Cite web |last=Yusof |first=Iman |date=2025-11-24 |title=Malaysia’s bid to bar under-16s from social media using ID checks stokes privacy fears |url=https://www.scmp.com/week-asia/lifestyle-culture/article/3333904/malaysias-bid-bar-under-16s-social-media-using-id-checks-stokes-privacy-fears |url-status=live |archive-url=https://web.archive.org/web/20260101084907/https://www.scmp.com/week-asia/lifestyle-culture/article/3333904/malaysias-bid-bar-under-16s-social-media-using-id-checks-stokes-privacy-fears |archive-date=2026-01-01}}</ref>

The government also raised the use of biometric authentication as part of identity verification, with platforms expected to adopt a combination of document verification, biometrics, and risk signals to limit minors' access.<ref name=":9">{{Cite web |last=Myers |first=Teresa |date=2025-11-25 |title=Malaysia Under-16 Social Media Ban Plans and eKYC Age Checks |url=https://facia.ai/news/malaysia-under-16-social-media-ban-plans-and-ekyc-age-checks/ |url-status=live |archive-url=https://web.archive.org/web/20251207153118/https://facia.ai/news/malaysia-under-16-social-media-ban-plans-and-ekyc-age-checks/ |archive-date=2025-12-07}}</ref> Deputy Communications Minister Teo Nie Ching announced a regulatory sandbox process that would allow MCMC to collaborate with platform providers to test age verification mechanisms and AI for the detection of high-risk content.<ref name=":10">{{Cite web |last=Lee |first=Benjamin |last2=Vethasalam |first2=Ragananthini |date=2026-01-28 |title=Age verification system for social media users in the pipeline, Dewan Rakyat told |url=https://www.thestar.com.my/news/nation/2026/01/28/age-verification-system-for-social-media-users-in-the-pipeline-dewan-rakyat-told |url-status=live |archive-url=https://web.archive.org/web/20260130093418/https://www.thestar.com.my/news/nation/2026/01/28/age-verification-system-for-social-media-users-in-the-pipeline-dewan-rakyat-told |archive-date=2026-01-30}}</ref>

===Privacy concerns===
Harris Zainul, director of research at the Institute of Strategic and International Studies Malaysia, warned that the eKYC requirement could compromise user privacy and anonymity, which can be crucial for whistle-blowers and human-rights defenders.<ref name=":8" /> Critics noted that alternatives such as zero-knowledge proofs could confirm users' eligibility without revealing additional personal information, suggesting the eKYC method might be overly intrusive.<ref name=":11">{{Cite web |last=Yeoh |first=Tricia |date=2025-12-11 |title=Malaysia’s Social Media Ban for Under-16s: Protection or Overreach? |url=https://fulcrum.sg/malaysias-social-media-ban-for-under-16s-protection-or-overreach/ |url-status=live |archive-url=https://web.archive.org/web/20260121065903/https://fulcrum.sg/malaysias-social-media-ban-for-under-16s-protection-or-overreach/ |archive-date=2026-01-26}}</ref>

Digital rights organizations raised concerns that mandatory identity verification would create comprehensive databases of social media users that could be vulnerable to data breaches or government surveillance. <ref name=":2" />Privacy advocates warned that once biometric data is collected, there are limited guarantees about how long it will be retained or whether it could be used for purposes beyond age verification.<ref name=":9" />

===Technical accuracy issues===
Experts raised concerns that facial recognition technology-based age verification might not always be accurate and can have racial or gender biases, potentially putting legitimate users at risk of having their accounts deleted.<ref name=":12">{{Cite web |last=Basha |first=Azdhan |date=2025-11-25 |title=Malaysia Joins Global Push To Restrict Under-16 Users On Social Media, Plans ID-Based Age Verification |url=https://www.medianama.com/2025/11/223-malaysia-under-16-users-social-media-id-based-age-verification/ |url-status=live |archive-url=https://web.archive.org/web/20251230074110/https://www.medianama.com/2025/11/223-malaysia-under-16-users-social-media-id-based-age-verification/ |archive-date=2025-12-30}}</ref> Studies have shown that AI age estimation systems perform less accurately on certain demographic groups, raising fairness concerns about who might be disproportionately restricted from accessing social media platforms.<ref name=":9" />

Technical researchers noted that age estimation technology remains imprecise, with error margins that could incorrectly flag adults as minors or vice versa, leading to both over-blocking and under-blocking.<ref name=":12" />

===Impact on children's rights===
Critics argued that the ban could cut children off from support groups, community support systems, and online opportunities for self-expression through art, music, and other forms.<ref name=":11" /> Amnesty International Malaysia and other civil society groups advocated for a more nuanced approach that protects children's privacy while prioritizing their rights to expression and access to information.<ref name=":11" />

Youth advocacy organizations warned that blanket age restrictions fail to account for the legitimate educational and social benefits that young people derive from social media platforms, including access to educational content, creative communities, and mental health resources.<ref name=":2" />

===Enforcement challenges===
International experience suggests enforcement difficulties, with the UK's age verification requirements leading to sharp drops in traffic but users quickly finding workarounds through VPN services, which saw an 1,800% spike in UK sign-ups within three days of implementation.<ref name=":12" /> Technology experts noted that determined users, particularly tech-savvy teenagers, can often circumvent age verification systems through various methods including VPNs, fake IDs, or using accounts registered by adults.<ref name=":9" />

Critics questioned whether the significant investment in age verification infrastructure would deliver the intended child protection outcomes, given the ease with which such systems can be bypassed and the potential for pushing young users toward less regulated platforms.<ref name=":11" />

==Criticism and concerns==

===Freedom of expression===
Civil society groups including the Centre for Independent Journalism, ARTICLE 19, and Sinar Project raised concerns that the Act grants excessive and largely unchecked powers to authorities to decide what content is considered "harmful", risking increased removal of lawful content.<ref name=":2" /> The groups argued that the broad definition of harmful content could be interpreted subjectively, potentially leading to censorship of legitimate political speech and criticism.<ref name=":13">{{Cite web |last=[404!] |title= |url=https://www.cijmalaysia.net/2025/12/statement-online-safety-act-2025/ |url-status=dead}}</ref>

Malaysia's position on the World Press Freedom Index dropped from 73rd in 2023 to 107th in 2024, reflecting growing concerns about shrinking civic spaces.<ref>{{Cite web |title=Malaysia {{!}} RSF |url=https://rsf.org/en/country/malaysia |url-status=live |archive-url=https://web.archive.org/web/20260128063103/https://rsf.org/en/country/malaysia |archive-date=2026-01-28}}</ref> Digital rights advocates warned that the Act's implementation occurs against a backdrop of declining press freedom and increasing restrictions on online expression.<ref name=":2" />

Critics argued that the definition of harmful content is broadly worded and open to interpretation, potentially leading platforms to over-censor content to avoid penalties of up to RM10 million.<ref>{{Cite web |last=[404!] |title= |url=https://www.thestar.com.my/news/nation/2025/12/15/concerns-over-online-safety-act-broad-definitions |url-status=dead}}</ref> Legal experts noted that terms like "harmful to society" lack precise legal definitions, creating uncertainty for both platforms and users about what content is permissible.<ref name=":13" />

===Privacy and surveillance===
The government announced plans to require mandatory electronic Know-Your-Customer (eKYC) verification using government-issued documents for all social media users.<ref name=":8" /> Critics argue this would expose users to identification and tracking, making them vulnerable to state surveillance, selective enforcement, and self-censorship.<ref name=":2" />

Digital rights organizations warned that mandatory identity verification would eliminate online anonymity, which is essential for whistleblowers, journalists, activists, and marginalized communities to speak freely without fear of retaliation.<ref name=":13" /> Privacy advocates noted that once identity databases are created, they could be used for purposes beyond their original intent, including political monitoring or targeted enforcement against critics.<ref name=":14">{{Cite web |last=[404!] |title= |url=https://sinarproject.org/digital-rights/updates/online-safety-act-concerns |url-status=dead}}</ref>

Civil society organizations criticized the lack of transparency and independent oversight in enforcement, noting the risk of abuse and selective enforcement against government critics or opposition voices.<ref name=":2" /> The absence of robust judicial oversight or independent appeals mechanisms raised concerns that enforcement decisions could be politically motivated.<ref name=":13" />

===Platform over-compliance and economic impact===
Technology policy analysts warned that platforms might over-remove content to avoid hefty fines, leading to excessive censorship beyond what the law technically requires.<ref>{{Cite web |last=[404!] |title= |url=https://www.thestar.com.my/tech/tech-news/2025/12/20/platforms-may-over-censor-to-avoid-penalties |url-status=dead}}</ref> This "chilling effect" could result in removal of legitimate speech, satire, artistic expression, and political commentary that does not actually violate the Act's provisions.<ref name=":14" />

Smaller platforms and Malaysian tech startups expressed concerns about compliance costs, noting that the requirement to submit Online Safety Plans, implement content moderation systems, and provide user safety tools could create barriers to entry that favor large international platforms.<ref>{{Cite web |last=[404!] |title= |url=https://www.thestar.com.my/business/business-news/2025/12/18/local-platforms-worry-about-compliance-costs |url-status=dead}}</ref> Industry representatives warned this could stifle Malaysia's digital economy and innovation in the tech sector.<ref>{{Cite web |last=[404!] |title= |url=https://www.medianama.com/2025/12/223-malaysia-online-safety-act-platform-compliance-challenges/ |url-status=dead}}</ref>

===Lack of consultation and transparency===
Critics noted that the Act was passed with limited public consultation and without adequate engagement with civil society, digital rights groups, and affected communities.<ref name=":13" /> Media freedom organizations argued that rushed implementation without proper stakeholder input increased the risk of unintended consequences and ineffective enforcement.<ref name=":2" />

Transparency advocates called for MCMC to publish clear enforcement guidelines, data on content removal requests, and regular reports on how the Act is being implemented to ensure accountability.<ref>{{Cite web |last=[404!] |title= |url=https://sinarproject.org/digital-rights/updates/online-safety-act-transparency-demands |url-status=dead}}</ref> The lack of public information about how "harmful content" determinations are made raised concerns about arbitrary or inconsistent enforcement.<ref name=":13" />

==Public Petitions and Advocacy==

===Stop eKYC Petition===
In November 2025, a Change.org petition titled "Stop eKYC for social media in Malaysia and promote digital literacy" was launched opposing mandatory identity verification requirements for social media users.<ref>{{Cite web |title= |url=https://www.change.org/p/stop-ekyc-for-social-media-in-malaysia-and-promote-digital-literacy}}</ref> The petition raises several concerns about the eKYC requirement: 

'''Data Breach Risks''': The petition cites international examples of age verification data breaches, including Discord's leak of approximately 70,000 users' identification documents in the UK, which exposed children to doxxing risks and enabled predators to attempt purchasing children's IDs for stalking and potential kidnapping.

'''Identity Theft''': Petitioners warn that bad actors could use leaked identification documents to commit identity theft and open false bank accounts in victims' names.

'''Freedom of Expression''': The petition argues that mandatory ID verification could enable government persecution of critics, citing claims that 30 people per day in the UK are imprisoned for social media posts under similar identity verification systems. Petitioners express concern that "power in excess only leads to an eventual abuse of a system and corruption." 

The petition advocates for promoting digital literacy and parental education as alternatives to mandatory identity verification, arguing that child safety should not come "at the cost of privacy, freedom of speech and anonymity."

==Government response==
MCMC officials stated the Act was designed to protect the safety of social media users rather than control their freedom of expression.<ref name=":1" /> Officials emphasized the Act targets platform providers who fail to filter harmful content, not individual users or their right to express opinions online.<ref>{{Cite web |last=[404!] |title= |url=https://www.thestar.com.my/news/nation/2025/12/28/mcmc-online-safety-act-targets-platforms-not-users |url-status=dead}}</ref>

The government defended the Act as necessary to combat significant financial losses from online scams and protect vulnerable users, particularly children. Communications Minister Fahmi Fadzil cited police statistics showing RM2.7 billion in reported losses from online scams between January and November 2025 as evidence of the urgent need for platform accountability.<ref name=":3" />

Officials maintained that the Act does not create new criminal offenses relating to lawful speech or political expression, and that existing constitutional protections for freedom of speech remain in place.<ref name=":0" /> The government argued that the Act's provisions are consistent with international approaches to online safety and platform regulation in countries such as Australia, the United Kingdom, and the European Union.<ref>{{Cite web |last=[404!] |title= |url=https://www.thestar.com.my/news/nation/2025/12/30/malaysia-online-safety-act-mirrors-international-standards |url-status=dead}}</ref>

Regarding age verification concerns, Deputy Communications Minister Teo Nie Ching emphasized that the regulatory sandbox approach would allow testing of different age verification methods to balance child protection with privacy considerations.<ref name=":10" /> She stated that the government remains open to feedback from stakeholders and would consider privacy-preserving alternatives if they prove effective.<ref>{{Cite web |date=2023-11-18 |title=BERNAMA - Mic To Set Up Aimst College, Hospital |url=https://www.bernama.com/en/general/news.php?id=2245678 |url-status=live |archive-url=https://web.archive.org/web/20240226171651/https://bernama.com/en/general/news.php?id=2245678 |archive-date=2024-02-26}}</ref>

The government rejected characterizations of the Act as authoritarian or censorious, arguing that democratic societies worldwide are grappling with how to balance online safety with free expression, and that Malaysia's approach is proportionate to the harms being addressed.<ref>{{Cite web |last=[404!] |title= |url=https://www.bernama.com/en/general/news.php?id=2246789 |url-status=dead}}</ref> Minister Fahmi Fadzil stated that the government welcomes constructive dialogue about implementation but remains committed to protecting Malaysians from online harms.<ref>{{Cite web |last=[404!] |title= |url=https://www.thestar.com.my/news/nation/2026/01/20/fahmi-government-committed-to-online-safety |url-status=dead}}</ref>

==References==
{{reflist}}