The age verification debate

Malaysia's Online Safety Act 2025 has sparked debate over whether platforms should use government IDs like MyKad or adopt privacy-focused age verification methods.

Who's weighing in

MCMC received feedback from 21 respondents including human rights groups like CIJ and tech companies like Meta, Google, TikTok, and X Corp during public consultations.

Cybersecurity risks loom large

Experts warn Malaysia's history of data breaches makes mandatory ID verification dangerous. The Health Ministry's website was hacked in June.

“Malaysia has had serious data-security problems, with repeated leaks and breaches involving personal information”

Censorship fears for critics

United Youth Alliance warns linking accounts to personal identity could be abused against whistleblowers, journalists, activists, and government critics.

“If every social media account can easily be linked to an individual's identity, that infrastructure could potentially be abused”

Centralized databases raise alarms

MCMC's consultation report shows stakeholders worry mandatory government verification could create centralized databases vulnerable to security breaches.

MyDigital ID lacks protection

CIJ's Wathshlah Naidu warns MyDigital ID sits in a vacuum of agencies not covered under the Personal Data Act, leaving user information vulnerable.

“This should not be an ID verification approach but an age-assurance approach”

Marginalised users left out

Mandatory ID requirements would exclude stateless children, asylum seekers, and refugees who lack national identification documents.

“We will exclude a large number of users who don't have national IDs, including stateless children, asylum seekers and refugees”

Surveillance risks increase

Linking social media to national IDs could enable government profiling of users and heightened surveillance of civil society organizations doing advocacy work.

“Civil society organisations that rely on social media for advocacy would open themselves up to heightened surveillance”

A multi-layered alternative

Experts propose starting with self-declarations and behavioral analysis, only using stricter verification when users misrepresent their ages.

“If that system fails, platforms could impose more stringent scrutiny”

Don't create new problems

Muda's Shah Fariq warns against normalizing excessive personal data collection while trying to solve one problem.

“We must be careful that in trying to solve one problem, we do not create another problem”

Singapore's approach

Singapore is planning legislation for early 2027 requiring platforms to reduce children's exposure to harmful content without a blanket ban.

Europe's privacy protections

The EU's GDPR requires explicit consent before gathering data and gives citizens the right to erasure, forcing platforms to delete data on request.