Malaysia Online Safety Act 2025 (ONSA): Difference between revisions

The '''Online Safety Act 2025''' ('''Act 866''') is Malaysian legislation that came into force on January 1, 2026, requiring social media and messaging platforms with over 8 million Malaysian users to remove harmful content and implement safety measures.<ref>{{Cite web |title= |url=https://www.thestar.com.my/news/nation/2025/01/01/online-safety-act-2025-comes-into-effect |url-status=dead}}</ref> The Act targets nine categories of harmful content including child sexual abuse material and financial fraud, with platforms facing fines up to RM10 million for non-compliance.<ref name=":1">{{Cite web |title= |url=https://www.mcmc.gov.my/en/media/press-releases/online-safety-act-2025}}</ref> Civil society groups have raised concerns about potential censorship and surveillance, while the government maintains the Act targets platform accountability rather than individual users.<ref name=":2">{{Cite web |title= |url=https://www.article19.org/resources/malaysia-online-safety-act-threatens-freedom-of-expression/}}</ref>

Between January and November 2025, Malaysian police recorded RM2.7 billion in reported losses from online scams.<ref name=":3">{{Cite web |title= |url=https://www.thestar.com.my/news/nation/2025/12/01/rm27bil-lost-to-online-scams-jan-nov}}</ref> A UNICEF study identified more than 100,000 children in Malaysia at risk of online sexual exploitation, with police operations uncovering hundreds of thousands of files containing child sexual abuse material.<ref>{{Cite web |title= |url=https://www.unicef.org/malaysia/press-releases/unicef-malaysia-online-child-safety-report}}</ref>

Between January 2024 and November 2025, major platforms removed 92% of 697,061 harmful posts flagged by Malaysian authorities, but 58,104 posts remained accessible online.<ref>{{Cite web |title= |url=https://www.malaymail.com/news/malaysia/2025/12/30/online-safety-act-to-take-effect-jan-1-service-providers-must-comply/138924}}</ref> These ongoing challenges prompted the Malaysian government to introduce the Online Safety Act 2025 to strengthen platform accountability for harmful content and protect Malaysian internet users, particularly children.<ref name=":1" />

The Act applies to licensed service providers under the Communications and Multimedia Act 1998, specifically Applications Service Providers (ASPs), Content Applications Service Providers (CASPs), and Network Service Providers (NSPs).<ref name=":1" /> Social media or messaging platforms with over 8 million users in Malaysia are automatically deemed licensees and subject to the Act's requirements.<ref name=":4">{{Cite web |title= |url=https://www.thestar.com.my/news/nation/2026/01/01/online-safety-act-2025-comes-into-effect}}</ref> The Act has extra-territorial reach, applying to companies outside Malaysia if they provide services within Malaysia and fall under the licensing framework.<ref name=":5">{{Cite web |title= |url=https://lom.agc.gov.my/act-view.php?language=eng&type=act&no=866&year=2025}}</ref>

*'''Facebook''': With 31.3 million users (88.2% of population)<ref name=":6">{{Cite web |title= |url=https://stats.napoleoncat.com/social-media-users-in-malaysia/2025/}}</ref>

Other major platforms including WhatsApp, TikTok, X (formerly Twitter), YouTube, Telegram, and WeChat also operate in Malaysia and are understood to exceed the 8 million user threshold.<ref>{{Cite web |title= |url=https://www.malaymail.com/news/malaysia/2026/01/01/enforcement-of-online-safety-act-takes-effect-strengthening-online-protections-for-children-and-families-says-mcmc/203923}}</ref>

The Act identifies nine categories of harmful content that platforms must address, including child sexual abuse material, financial fraud, harassment, incitement to violence or terrorism, and other harmful categories.<ref name=":0">{{Cite web |title= |url=https://www.mcmc.gov.my/skmmgovmy/media/General/pdf2/ONSA-FAQ-English.pdf}}</ref> Child sexual abuse and financial fraud are designated as "priority harmful content" subject to additional regulation and faster response requirements.<ref name=":7">{{Cite web |title= |url=https://www.thestar.com.my/tech/tech-news/2025/12/31/what-you-need-to-know-about-the-online-safety-act-2025}}</ref>

In November 2025, the Malaysian government announced plans to ban children under 16 from having social media accounts starting in 2026, raising the minimum age from 13.<ref>{{Cite web |title= |url=https://www.thestar.com.my/news/nation/2025/11/24/malaysia-plans-to-ban-under-16s-from-social-media}}</ref> Communications Minister Fahmi Fadzil stated that social media platforms would be required to implement electronic know-your-customer (eKYC) identity checks using government-issued identity documents such as the MyKad identity card, passports or the national digital ID.<ref name=":8">{{Cite web |title= |url=https://www.scmp.com/week-asia/lifestyle-culture/article/3333904/malaysias-bid-bar-under-16s-social-media-using-id-checks-stokes-privacy-fears}}</ref>

The government also raised the use of biometric authentication as part of identity verification, with platforms expected to adopt a combination of document verification, biometrics, and risk signals to limit minors' access.<ref name=":9">{{Cite web |title= |url=https://facia.ai/news/malaysia-under-16-social-media-ban-plans-and-ekyc-age-checks/}}</ref> Deputy Communications Minister Teo Nie Ching announced a regulatory sandbox process that would allow MCMC to collaborate with platform providers to test age verification mechanisms and AI for the detection of high-risk content.<ref name=":10">{{Cite web |title= |url=https://www.thestar.com.my/news/nation/2026/01/28/age-verification-system-for-social-media-users-in-the-pipeline-dewan-rakyat-told}}</ref>

Harris Zainul, director of research at the Institute of Strategic and International Studies Malaysia, warned that the eKYC requirement could compromise user privacy and anonymity, which can be crucial for whistle-blowers and human-rights defenders.<ref name=":8" /> Critics noted that alternatives such as zero-knowledge proofs could confirm users' eligibility without revealing additional personal information, suggesting the eKYC method might be overly intrusive.<ref name=":11">{{Cite web |title= |url=https://fulcrum.sg/malaysias-social-media-ban-for-under-16s-protection-or-overreach/}}</ref>

Experts raised concerns that facial recognition technology-based age verification might not always be accurate and can have racial or gender biases, potentially putting legitimate users at risk of having their accounts deleted.<ref name=":12">{{Cite web |title= |url=https://www.medianama.com/2025/11/223-malaysia-under-16-users-social-media-id-based-age-verification/}}</ref> Studies have shown that AI age estimation systems perform less accurately on certain demographic groups, raising fairness concerns about who might be disproportionately restricted from accessing social media platforms.<ref name=":9" />

Civil society groups including the Centre for Independent Journalism, ARTICLE 19, and Sinar Project raised concerns that the Act grants excessive and largely unchecked powers to authorities to decide what content is considered "harmful", risking increased removal of lawful content.<ref name=":2" /> The groups argued that the broad definition of harmful content could be interpreted subjectively, potentially leading to censorship of legitimate political speech and criticism.<ref name=":13">{{Cite web |title= |url=https://www.cijmalaysia.net/2025/12/statement-online-safety-act-2025/}}</ref>

Malaysia's position on the World Press Freedom Index dropped from 73rd in 2023 to 107th in 2024, reflecting growing concerns about shrinking civic spaces.<ref>{{Cite web |title= |url=https://rsf.org/en/country/malaysia}}</ref> Digital rights advocates warned that the Act's implementation occurs against a backdrop of declining press freedom and increasing restrictions on online expression.<ref name=":2" />

Critics argued that the definition of harmful content is broadly worded and open to interpretation, potentially leading platforms to over-censor content to avoid penalties of up to RM10 million.<ref>{{Cite web |title= |url=https://www.thestar.com.my/news/nation/2025/12/15/concerns-over-online-safety-act-broad-definitions}}</ref> Legal experts noted that terms like "harmful to society" lack precise legal definitions, creating uncertainty for both platforms and users about what content is permissible.<ref name=":13" />

Digital rights organizations warned that mandatory identity verification would eliminate online anonymity, which is essential for whistleblowers, journalists, activists, and marginalized communities to speak freely without fear of retaliation.<ref name=":13" /> Privacy advocates noted that once identity databases are created, they could be used for purposes beyond their original intent, including political monitoring or targeted enforcement against critics.<ref name=":14">{{Cite web |title= |url=https://sinarproject.org/digital-rights/updates/online-safety-act-concerns}}</ref>

Technology policy analysts warned that platforms might over-remove content to avoid hefty fines, leading to excessive censorship beyond what the law technically requires.<ref>{{Cite web |title= |url=https://www.thestar.com.my/tech/tech-news/2025/12/20/platforms-may-over-censor-to-avoid-penalties}}</ref> This "chilling effect" could result in removal of legitimate speech, satire, artistic expression, and political commentary that does not actually violate the Act's provisions.<ref name=":14" />

Smaller platforms and Malaysian tech startups expressed concerns about compliance costs, noting that the requirement to submit Online Safety Plans, implement content moderation systems, and provide user safety tools could create barriers to entry that favor large international platforms.<ref>{{Cite web |title= |url=https://www.thestar.com.my/business/business-news/2025/12/18/local-platforms-worry-about-compliance-costs}}</ref> Industry representatives warned this could stifle Malaysia's digital economy and innovation in the tech sector.<ref>{{Cite web |title= |url=https://www.medianama.com/2025/12/223-malaysia-online-safety-act-platform-compliance-challenges/}}</ref>

Transparency advocates called for MCMC to publish clear enforcement guidelines, data on content removal requests, and regular reports on how the Act is being implemented to ensure accountability.<ref>{{Cite web |title= |url=https://sinarproject.org/digital-rights/updates/online-safety-act-transparency-demands}}</ref> The lack of public information about how "harmful content" determinations are made raised concerns about arbitrary or inconsistent enforcement.<ref name=":13" />

In November 2025, a Change.org petition titled "Stop eKYC for social media in Malaysia and promote digital literacy" was launched opposing mandatory identity verification requirements for social media users.<ref>{{Cite web |title= |url=https://www.change.org/p/stop-ekyc-for-social-media-in-malaysia-and-promote-digital-literacy}}</ref> The petition raises several concerns about the eKYC requirement:  

MCMC officials stated the Act was designed to protect the safety of social media users rather than control their freedom of expression.<ref name=":1" /> Officials emphasized the Act targets platform providers who fail to filter harmful content, not individual users or their right to express opinions online.<ref>{{Cite web |title= |url=https://www.thestar.com.my/news/nation/2025/12/28/mcmc-online-safety-act-targets-platforms-not-users}}</ref>

Officials maintained that the Act does not create new criminal offenses relating to lawful speech or political expression, and that existing constitutional protections for freedom of speech remain in place.<ref name=":0" /> The government argued that the Act's provisions are consistent with international approaches to online safety and platform regulation in countries such as Australia, the United Kingdom, and the European Union.<ref>{{Cite web |title= |url=https://www.thestar.com.my/news/nation/2025/12/30/malaysia-online-safety-act-mirrors-international-standards}}</ref>

Regarding age verification concerns, Deputy Communications Minister Teo Nie Ching emphasized that the regulatory sandbox approach would allow testing of different age verification methods to balance child protection with privacy considerations.<ref name=":10" /> She stated that the government remains open to feedback from stakeholders and would consider privacy-preserving alternatives if they prove effective.<ref>{{Cite web |title= |url=https://www.bernama.com/en/general/news.php?id=2245678}}</ref>

The government rejected characterizations of the Act as authoritarian or censorious, arguing that democratic societies worldwide are grappling with how to balance online safety with free expression, and that Malaysia's approach is proportionate to the harms being addressed.<ref>{{Cite web |title= |url=https://www.bernama.com/en/general/news.php?id=2246789}}</ref> Minister Fahmi Fadzil stated that the government welcomes constructive dialogue about implementation but remains committed to protecting Malaysians from online harms.<ref>{{Cite web |title= |url=https://www.thestar.com.my/news/nation/2026/01/20/fahmi-government-committed-to-online-safety}}</ref>