The tension between protecting internet users—particularly children—and maintaining freedom of expression has emerged as a defining policy challenge across democracies worldwide, with Malaysia firmly at the centre of this global struggle. At the International Regulatory Conference 2026 in Kuala Lumpur, Datuk G. Thiyagu, Deputy Director-General (Law Reform) at the Prime Minister's Department's Legal Affairs Division, underscored how this balancing act shapes the very foundation of modern regulatory frameworks governing digital platforms. The discussion highlighted that Malaysia is not alone in grappling with these competing demands; countries including Australia, the United Kingdom and Canada face identical pressures as they attempt to craft legislation that serves both imperatives without surrendering either.
Malaysia's response to this challenge is the Online Safety Act 2025 (ONSA), a system-based framework that shifts primary accountability to platform operators rather than users or governments alone. Thiyagu explained that the legislation imposes specific obligations on social media providers, requiring them to implement safeguards ensuring their platforms function safely. This approach reflects a philosophical pivot away from purely punitive measures toward structural responsibility, compelling companies to embed protective measures into their business operations from inception. The framework's architecture acknowledges a fundamental reality: effective online safety cannot be achieved through legislation alone, but requires platforms themselves to become active agents in harm prevention. By placing the burden on those with the greatest technical capacity and commercial incentive to modify algorithms and content moderation practices, ONSA attempts to address safety at its source rather than after damage occurs.
Central to ONSA's legitimacy is its alignment with Article 10 of the Federal Constitution, which guarantees Malaysian citizens the right to freedom of speech while recognising that such rights exist within boundaries. Thiyagu emphasised that the principle of proportionality—ensuring regulations do not unnecessarily restrict fundamental freedoms—has been threaded throughout the legislation's drafting. The government acknowledges that restrictions on expression may be imposed on narrow grounds including public order, morality and national security, yet the challenge lies in applying these grounds without mission creep or bureaucratic overreach. This constitutional grounding provides important reassurance to civil society groups concerned that online safety regulations could be weaponised to suppress legitimate political discourse or dissent. The balance Malaysia has attempted to strike reflects evolving global jurisprudence on digital rights, where free expression advocates and child safety campaigners increasingly recognise they share common ground in opposing authoritarian abuse of emergency powers.
Yet enforcement rather than legislation has emerged as the actual bottleneck in Malaysia's online safety ecosystem. Dr Farah Nini Dusuki, Children's Commissioner at the Human Rights Commission of Malaysia (Suhakam), pointed out that comprehensive laws already exist protecting children's rights, but the critical gap lies in their consistent, vigorous enforcement and the mechanisms needed to monitor implementation over time. This observation carries particular weight in Malaysia's institutional context, where regulators often operate under resource constraints and shifting political priorities. Without robust oversight architecture and dedicated monitoring capacity, even well-intentioned legislation becomes symbolic rather than substantive. The implication is that Malaysia's next regulatory frontier should focus less on creating new laws and more on building enforcement infrastructure—training personnel, establishing clear performance metrics, and ensuring accountability for regulatory bodies themselves.
Dr Farah Nini further advocated for a preventive rather than reactive approach to online safety, drawing an analogy to physical infrastructure. Just as societies build safe roads and playgrounds rather than expecting children to navigate hazards, digital environments should be engineered to protect vulnerable users from the outset. This prevention-first philosophy suggests Malaysia should prioritise platform design modifications and algorithmic transparency over post-hoc removal of harmful content. It implies supporting research into protective technologies, promoting industry standards for age verification and content filtering, and examining whether platforms' profit incentives fundamentally conflict with child safety objectives. The approach recognises that regulation can establish baseline requirements, but genuine protection emerges when digital spaces are designed by those implementing systems to resist harm before it proliferates.
Innovation within Malaysia's telecommunications sector is beginning to exemplify this design-centric approach. Gurtaj Singh Padda, co-founder and Chief Executive Officer of Tune Talk, described the company's development of parental control systems enabling families to block access to platforms like TikTok and Facebook while customising age-appropriate internet access. By positioning technology companies—rather than government regulators or platform operators—as intermediaries, this solution leverages existing infrastructure to extend parental authority. Gurtaj Singh argued forcefully that financial penalties alone prove insufficient to modify behaviour among major technology corporations, and that the most effective enforcement mechanism involves restricting platform access for companies that fail compliance. This perspective implies that Malaysia's regulatory strategy should move beyond the traditional fine-based enforcement model toward a more radical approach: deplatforming companies that chronically violate safety obligations, effectively removing their ability to serve Malaysian users. Such measures carry obvious risks regarding market competition and corporate sovereignty, yet Gurtaj Singh contends they represent the only truly credible enforcement mechanism against organisations whose market valuations dwarf potential penalties.
Australia's experience offers instructive precedent for Malaysia's policymakers. Australian High Commissioner to Malaysia Danielle Heinecke outlined her country's child and online safety framework, which requires platforms to verify that users under 16 do not hold accounts. Australia's approach mandates age verification through inference, estimation and verification technologies, placing responsibility on platforms to develop and deploy such systems. The country recently raised maximum penalties for non-compliance to A$99 million (approximately RM284 million), substantially higher than financial penalties in many other jurisdictions. For Malaysian observers, the Australian model demonstrates both the technical feasibility of age restrictions and the necessity of calibrating penalties at levels that genuinely deter corporate non-compliance. Yet it also raises questions about privacy implications of age verification systems and whether such measures remain proportionate to the harms they prevent, particularly for older teenagers whose privacy and autonomy interests merit protection alongside younger children's safety needs.
The international regulatory conference proceedings reveal that Malaysia has positioned itself as an emerging thought leader in online safety rather than a passive adopter of overseas models. By grounding ONSA in constitutional principles, emphasising platform accountability, and experimenting with market-based enforcement mechanisms through telecommunications operators, Malaysia is developing a distinctive regulatory philosophy. This approach resonates with concerns expressed across Southeast Asia about the need for locally-calibrated solutions that respect regional values and institutional capacities. However, the conference also exposed the fragility of consensus on implementation details, with panellists disagreeing substantially on whether regulation through financial penalties, access restrictions, or technology mandates proves most effective. These unresolved questions will likely animate Malaysian regulatory debates as ONSA moves from legislation to practical enforcement.
Looking forward, Malaysia faces several critical implementation challenges. The success of ONSA ultimately depends on establishing credible, adequately-resourced enforcement mechanisms that can track platform compliance, investigate complaints and impose meaningful consequences without demonstrating partisan bias or enabling government overreach. Building public trust in these processes requires transparency about enforcement decisions and regular external review of whether restrictions on content prove proportionate to demonstrable harms. Additionally, Malaysia should invest in developing local expertise in platform accountability analysis, rather than relying entirely on overseas consultants whose understanding of Malaysian cultural context may be limited. The regulatory framework must also remain flexible enough to adapt as technology evolves; age verification systems that work today may become obsolete within years, and legislation drafted around specific platforms risks obsolescence as user behaviour shifts. Furthermore, Malaysian policymakers should explicitly address potential conflicts between online safety and other important interests, including market competition, innovation incentives and personal privacy, rather than treating online safety as a supreme value that automatically supersedes other concerns.
The dialogue session at the International Regulatory Conference 2026 ultimately illustrated that Malaysia's online safety challenge is not primarily legislative but institutional and cultural. The country possesses constitutional foundations, policy frameworks and emerging technological solutions necessary to protect children while preserving speech rights. What remains uncertain is whether implementation will match ambition—whether enforcement bodies will maintain independence and competence across political cycles, whether platforms will respond to market mechanisms and regulatory pressure by genuinely improving safety, and whether Malaysian civil society will maintain vigilance against regulatory mission creep. These questions will determine whether ONSA becomes a genuine advance in digital rights protection or merely another law that accomplishes less than its architects intended.
