KUALA LUMPUR, Sept 16 — As Malaysia approaches the implementation of the Online Safety Act 2025, an important debate is emerging over the legislation’s age verification requirements.

The discussion centres on whether platforms should rely on government-issued identification such as MyKad and MyDigital ID, or adopt a multi-layered age assurance approach that prioritises user privacy while ensuring teen safety.

The Malaysian Communications and Multimedia Commission (MCMC), received substantial feedback during public consultations, with industry and civil society stakeholders broadly advocating flexible, risk-based solutions rather than strict identification requirements.

The consultation received feedback from 21 respondents, including human rights and civil society organisations, such as CIJ and technology companies such as Meta, Google, TikTok Service Pte Ltd, X Corp., Roblox, and Redone, alongside telco providers including Maxis, CelcomDigi, Telekom Malaysia, Time dotCom, YTL Communications and Astro.

To better understand the limitations of such a proposal, Malay Mail spoke to several experts for their views on the legislation.

Potential cybersecurity risks

One of the major concerns surrounding such a rule requiring social media platforms to seek government-issued identification for age verification lies within cybersecurity risks, especially in the event of mass hacks.

United Youth Alliance exco member Na’im Brundage said, “Malaysia has had serious data-security problems, with repeated leaks and breaches involving personal information,” referring to recent hacking incidents of government websites being hacked.

In June, the Health Ministry confirmed its official website was hacked after the portal displayed a message believed to have been left by the attackers.

Na’im also expressed his concerns over censorship and freedom of expression should social media accounts be linked to the personal identity of the user.

“If every social media account can easily be linked to an individual’s identity, that infrastructure could potentially be abused against whistleblowers, journalists, activists or ordinary Malaysians who are critical of those in power.

“That is why I think a multi-layered age-assurance approach deserves serious consideration,” he said.

According to him, less intrusive methods, such as age estimation or account and device signals, could be used first, with stronger verification such as MyKad and MyDigital ID only where necessary.

Concerns over data breaches

The MCMC’s consultation report highlighted significant concerns over mandatory government verification, with many stakeholders worried that it could lead to the creation of centralised databases and increase the risk of security breaches.

Centre for Independent Journalism (CIJ) executive director Wathshlah G. Naidu expressed strong opposition to linking social media use with national identification documents.

“This should not be an ID verification approach but an age-assurance approach,” she said.

Wathshlah also raised concerns over how information would be protected, particularly in the event of a data breach.

“MyDigital ID sits in a vacuum of agencies not covered under the Personal Data Act,” she said.

While Wathshlah highlighted the potential drawbacks of mandatory verification, Children’s Commissioner at the Human Rights Commission of Malaysia (Suhakam) Associate Professor Mohd Al Adib Samuri, highlighted that MyKad information could be leaked, stolen or misused.

Wathshlah pointed out that such requirements could exclude marginalised users, adding that the move could worsen digital exclusion and deepen existing divides.

“We will exclude a large number of users who don’t have national IDs, including stateless children, asylum seekers and refugees,” she said.

Privacy and surveillance issues

Wathshlah highlighted the risks of increased surveillance that could arise from linking social media accounts to national IDs.

“There is a huge potential for increased profiling based on who is using social media,” she said.

She cautioned that this profiling could lead to biases and increased governmental oversight of users’ online activities.

“Civil society organisations that rely on social media for advocacy would open themselves up to heightened surveillance,” she warned, highlighting potential implications for freedom of expression and censorship.

Alternative rights-respecting and privacy-preserving approach

Wathshlah suggested a multi-layered approach, which begins with self-declarations and incorporates behavioural analysis for users who may misrepresent their ages.

“If that system fails, platforms could impose more stringent scrutiny,” she said, stressing that an inclusive age verification framework must balance safety with privacy.

Wathshlah also noted that any framework must be comprehensive, taking into account pre-implementation, execution and post-implementation stages to identify and address potential risks.

Echoing similar sentiments, Malaysian United Democratic Alliance (Muda) head of communications Shah Fariq Aizal Sha Ghazni emphasised the need to implement the most suitable solutions from the outset.

“We must be careful that in trying to solve one problem, we do not create another problem by normalising excessive collection of personal data,” he said.

Fariq also stressed the importance of prioritising privacy, urging the exploration of privacy-preserving approaches.

How are other countries doing it?

Singapore is planning new legislation for early 2027 that will mandate strict teen safeguards.

The country has so far avoided a blanket ban; instead, the government has introduced measures requiring major social media platforms to reduce children’s exposure to harmful online content and improve safety features.

Under the proposed rules, platforms would have to improve controls over how teenagers interact with strangers online.

In European Union, the General Data Protection Regulation requires platforms to obtain explicit consent before gathering data.

The law gives citizens the right to be forgotten, or better known as the “right to erasure”, forcing platforms to delete their data upon request and protecting against the unauthorised misuse of identity under certain conditions.