KUALA LUMPUR, July 30 — As Malaysia approaches the implementation of the Online Safety Act 2025, an important debate is emerging over the legislation’s age verification requirements.

The discussion centres on whether platforms should rely on government-issued identification such as MyKad, or adopt a multi-layered age assurance approach that prioritises user privacy while ensuring child safety.

The Malaysian Communications and Multimedia Commission (MCMC), however, received substantial feedback during public consultations, with stakeholders broadly advocating flexible, risk-based solutions rather than strict identification requirements.

To better understand the limitations of such a proposal, Malay Mail spoke to several experts for their views on the legislation.

The principles of age verification

Children’s Commissioner at the Human Rights Commission of Malaysia (Suhakam) Associate Professor Mohd Al Adib Samuri said a nuanced approach was needed, noting that platforms only needed to know whether a user was above or below the required age.

“They do not need the person’s full identity,” he said, adding that trusted verification services should confirm a user’s age without requiring sensitive personal data such as MyKad.

“Although age must be checked against government-issued records, social media platforms do not need to receive or store a copy of the MyKad.

“We must examine whether children are wrongly accepted, legitimate users are wrongly blocked, or certain groups are unfairly affected,” he said, stressing that the verification process needed to be carefully monitored and adjusted to minimise unintended consequences.

Echoing similar sentiments, Malaysian United Democratic Alliance (Muda) head of communications Shah Fariq Aizal Sha Ghazni emphasised the need to implement the most suitable solutions from the outset.

“We must be careful that in trying to solve one problem, we do not create another problem by normalising excessive collection of personal data,” he said.

Fariq also stressed the importance of prioritising privacy, urging the exploration of privacy-preserving approaches such as third-party verification providers, encrypted digital credentials, or anonymous age verification systems.

Concerns over mandatory verification

The MCMC’s consultation report highlighted significant concerns over mandatory government verification, with many stakeholders worried that it could lead to the creation of centralised databases and increase the risk of security breaches.

Centre for Independent Journalism (CIJ) executive director Wathshlah G Naidu expressed strong opposition to linking social media use with national identification documents.

“This should not be an ID verification approach but an age-assurance approach, similar to Australia,” she said.

Wathshlah pointed out that such requirements could exclude marginalised users, adding that the move could worsen digital exclusion and deepen existing divides.

“We will exclude a large number of children and users who don’t have national IDs, including stateless children, asylum seekers and refugees,” she said.

Privacy and surveillance issues

Wathshlah highlighted the risks of increased surveillance that could arise from linking social media accounts to national IDs.

“There is a huge potential for increased profiling based on who is using social media,” she said.

She cautioned that such profiling could lead to bias and greater government oversight of users’ online activities.

“Civil society organisations that rely on social media for advocacy would open themselves up to heightened surveillance,” she warned, highlighting potential implications for freedom of expression.

Wathshlah also raised concerns over how information would be protected, particularly in the event of a data breach.

“MyDigital ID sits in a vacuum of agencies not covered under the Personal Data Protection Act,” she said.

While Wathshlah highlighted the potential drawbacks of mandatory verification, Adib reminded stakeholders that comprehensive measures were still needed to address child safety.

“Age verification alone is not enough.

“Platforms must still remove harmful content, strengthen privacy settings, and prevent strangers from approaching children,” he said.

He added that every method carried risks.

“MyKad information could be leaked, stolen or misused.

“Facial age checks may be inaccurate, while a weak system may also be bypassed by children using an adult’s account,” he said.

Scalability and accountability

Fariq highlighted the need for a robust digital safety ecosystem.

“We need to ensure that any age verification framework holds platforms accountable for their responsibilities,” he said.

He added that a comprehensive strategy must also include “stronger accountability for platforms, faster response mechanisms for harmful content, and better digital literacy among children and parents”.

Wathshlah suggested a multi-layered approach inspired by Australia’s cascading model, which begins with self-declarations and incorporates behavioural analysis for users who may misrepresent their ages.

“If that system fails, platforms could impose more stringent scrutiny,” she said, stressing that an inclusive age verification framework must balance safety with privacy.

Wathshlah also noted that any framework must be comprehensive, taking into account pre-implementation, execution and post-implementation stages to identify and address potential risks.