Malaysia is navigating one of the most contentious regulatory challenges of the digital age: protecting citizens from online harms while preserving the constitutional right to free speech. Speaking at the International Regulatory Conference 2026 in Kuala Lumpur, Datuk G. Thiyagu, Deputy Director-General at the Prime Minister's Department's Legal Affairs Division, underscored how this tension shapes policy across developed democracies including Australia, the United Kingdom and Canada. The dilemma extends beyond technical compliance; it strikes at the heart of how governments define the boundaries between safety and liberty.
Malaysia's response is embodied in the Online Safety Act 2025, a framework that departs from purely punitive regulation by imposing direct obligations on platform operators themselves. Rather than relying exclusively on government censorship or user restrictions, the legislation places responsibility squarely on social media companies to maintain safe digital spaces. This system-based approach reflects a recognition that the most effective safeguarding occurs at the design stage, before harmful content proliferates. Thiyagu emphasised that proportionality remains the cornerstone of this legislative architecture, ensuring that measures to combat online dangers do not become instruments of suppression.
The constitutional foundation for this balance lies in Article 10 of Malaysia's Federal Constitution, which guarantees freedom of speech while acknowledging that such freedoms are not unlimited. Legitimate grounds for restriction include public order, morality and national security—a formulation that mirrors international human rights standards. However, the practical application of these principles presents profound difficulties. How broad should "public order" be interpreted? When does protection of national security shade into political censorship? These questions haunted the drafting process and continue to generate debate among policymakers and civil society.
Dr Farah Nini Dusuki, Children's Commissioner at the Human Rights Commission of Malaysia, shifted focus from legislation to its enforcement, arguing that Malaysia's real challenge is not the absence of protective laws but rather their implementation gap. The country possesses comprehensive statutes safeguarding children's rights, yet oversight mechanisms remain fragmented and inconsistent. This enforcement deficit means that well-intentioned regulations often fail to materialise into tangible protection. She advocated for a preventive approach that reshapes the digital environment itself rather than expecting children to navigate hazardous online spaces independently. Just as societies invest in safe infrastructure—roads, playgrounds, schools—the online realm demands equivalent investment in protective design and active supervision.
The success of Malaysia's online safety framework ultimately hinges on how rigorously supporting regulations are enforced. This point resonates throughout regulatory conversations in the region. Without credible enforcement mechanisms, even comprehensive laws become symbolic gestures that fail to alter corporate behaviour. Platform operators, accustomed to facing only financial penalties in other jurisdictions, have limited incentive to modify systems that generate billions in advertising revenue. Strengthening oversight capacity at agencies like the Malaysian Communications and Multimedia Commission thus becomes not a technical bureaucratic issue but a fundamental prerequisite for meaningful child protection.
Gurtaj Singh Padda, Chief Executive Officer of Tune Talk, offered a provocative perspective on enforcement strategy, arguing that financial penalties alone prove insufficient to compel change from global technology giants. Instead, he advocated for market-based enforcement through access restrictions—preventing non-compliant platforms from operating within Malaysia's digital ecosystem. This approach represents a more dramatic intervention than traditional regulation but potentially carries greater motivational force. Tune Talk's recent launch of parental controls allowing selective blocking of platforms like TikTok and Facebook demonstrates how telecommunications providers can operationalise child safety without waiting for government mandates. The service enables granular customisation of age-appropriate internet access through simple, consumer-friendly technology.
Australia provides a closely watched regional precedent for this regulatory evolution. The Australian High Commissioner to Malaysia, Danielle Heinecke, outlined her country's increasingly stringent framework requiring platforms to verify users' ages before permitting account creation for minors. Rather than relying on user honesty or parental oversight, the legislation places verification responsibility on platforms themselves, using methods including age inference and technological estimation. Australia's recent increase of maximum penalties for non-compliance to A$99 million (approximately RM284 million) demonstrates a willingness to impose financially substantial consequences that might genuinely capture corporate attention. This escalation in penalties reflects growing impatience with voluntary compliance and corporate foot-dragging.
Malaysia's trajectory closely mirrors Australia's, suggesting a regional trend toward more activist regulatory intervention. As Southeast Asian economies mature and technology's social impacts become undeniable, governments are progressively rejecting the laissez-faire approach that characterised earlier digital policy. The question now centres not on whether to regulate but how aggressively to do so while maintaining democratic legitimacy. This shift reflects changing constituent demands, particularly from parents and educators concerned about screen time, digital addiction, online harassment and exposure to inappropriate content.
The dialogue at the International Regulatory Conference revealed emerging consensus on several principles. First, platform accountability must move beyond financial penalties to include behavioural consequences. Second, prevention through design proves more effective than reaction to harmful content. Third, effective enforcement requires substantial government capacity and political will. Fourth, freedom of expression protections remain essential and non-negotiable even as safety measures proliferate. These principles offer guideposts for Malaysian policymakers refining the Online Safety Act 2025 in future legislative phases.
Future refinements identified by Thiyagu include clarifying terminology, strengthening provisions addressing content duration and reach, adopting more comprehensive system-based approaches, and introducing various mitigation mechanisms. These improvements suggest official recognition that the current framework, while comprehensive, contains ambiguities and gaps requiring subsequent adjustment. This measured approach—treating legislation as a living instrument subject to iterative improvement rather than a finished product—acknowledges the complexity of regulating global platforms through national law. It also signals openness to evidence-based adjustment as implementation experience accumulates.
For Malaysia and its Southeast Asian neighbours, the online safety debate transcends technical regulatory concerns. It touches fundamental questions about how societies balance individual liberty, collective security, economic competitiveness and social harmony in an increasingly digital age. The decisions taken now will shape whether technology serves as a tool for democratic participation and human flourishing or becomes a vector for manipulation, exploitation and harm. The framework emerging in Malaysia represents a serious attempt to navigate this terrain, though its ultimate success will depend entirely on the rigour of implementation and the political courage to enforce restrictions even against powerful global corporations.
