The tension between protecting citizens from digital harm and preserving constitutional freedoms has emerged as one of the most pressing governance challenges facing Malaysia and its regional neighbours, according to senior government officials speaking at the International Regulatory Conference 2026 in Kuala Lumpur. Datuk G. Thiyagu, Deputy Director-General (Law Reform) at the Legal Affairs Division of the Prime Minister's Department, emphasised that countries across Asia-Pacific and beyond—including Australia, the United Kingdom and Canada—continue to wrestle with this same fundamental dilemma as digital platforms reshape how citizens communicate and consume information. The Online Safety Act 2025 (ONSA) represents Malaysia's legislative response to these concerns, though its success will ultimately depend on how effectively the government and private sector work together to enforce its provisions while respecting the constitutional protections enshrined in Article 10 of the Federal Constitution.
Thiyagu outlined the proportionality principle as the legislative framework's cornerstone, explaining that the ONSA adopts what he characterised as a system-based approach that imposes direct obligations on platform providers rather than relying solely on punitive measures against individual users. This structural model requires social media companies to implement safety measures at the architectural level—essentially building protection into their systems rather than reacting to harmful content after it spreads. Speaking during a panel discussion moderated by Malaysian Communications and Multimedia Commission (MCMC) Deputy Managing Director Eneng Faridah Iskandar, Thiyagu acknowledged that freedom of speech remained a central consideration throughout the legislation's development, reflecting Malaysia's commitment to Article 10's guarantee of citizens' right to free expression. However, he noted that this right has never been absolute, pointing to recognised limitations based on public order, national morality and security concerns—legal categories that appear in constitutions across the Commonwealth and beyond.
The challenge of balancing these competing interests becomes more acute when protecting vulnerable populations, particularly children. Dr Farah Nini Dusuki, Children's Commissioner at the Human Rights Commission of Malaysia (Suhakam), redirected the policy conversation away from questions of legal sufficiency toward implementation effectiveness. Malaysia's statute books already contain comprehensive child protection legislation, she argued, yet enforcement gaps and inconsistent application have limited their real-world impact. Rather than proposing entirely new laws, Dusuki advocated for strengthening oversight mechanisms—institutional structures designed to monitor how existing regulations function in practice, identify shortcomings, and recommend incremental improvements over time. Her perspective reflects growing recognition among rights advocates that legislative abundance without administrative capacity often fails vulnerable populations.
Dusuki advanced a preventive rather than reactive philosophy for online child safety, drawing a pointed analogy to urban planning and infrastructure design. Just as societies invest substantially in constructing safe roads, secure playgrounds and pedestrian protections rather than expecting children to navigate inherently dangerous environments unassisted, the digital realm requires similar proactive design thinking. This approach challenges the prevailing assumption that parents and young people should primarily shoulder responsibility for protecting themselves from platform harms. Instead, it redistributes accountability toward platform designers and corporate decision-makers who possess vastly greater technical capacity to shape user experiences. The ONSA's ultimate effectiveness, she suggested, hinges on whether implementing regulations translate its stated protections into measurable safeguards that actually reduce children's exposure to exploitative content, predatory contact and algorithms designed to maximise engagement regardless of developmental appropriateness.
The question of enforcement mechanisms has divided expert opinion, with some arguing that financial penalties alone prove inadequate against major technology corporations. Gurtaj Singh Padda, Chief Executive Officer of Tune Talk, contended that regulatory approaches relying primarily on fines fundamentally misunderstand corporate incentive structures. For technology giants operating across dozens of jurisdictions, even substantial penalties can be absorbed as a cost of doing business rather than triggering behavioural change. Instead, Padda advocated for enforcement strategies that strike at commercial viability—specifically, restricting platform access through telecommunications infrastructure rather than imposing monetary sanctions. This approach would task telecommunications providers and internet service providers with technological gatekeeping functions, creating leverage points where regulatory objectives could be enforced through network-level controls rather than litigation.
Tune Talk's recent initiative to become Malaysia's first telecommunications company enabling parental controls over access to major social media platforms exemplifies this enforcement philosophy in practice. The system allows parents to block applications like TikTok and Facebook entirely or customise age-appropriate internet access through simplified controls requiring minimal technical expertise. Padda's framing of this capability as a solution to platform non-compliance reveals an alternative governance model—one where regulatory compliance becomes a prerequisite for platform accessibility rather than a legal obligation subject to corporate negotiation and legal challenge. His assertion that true compliance requires platforms to implement content verification at the submission stage rather than relying on post-hoc moderation represents a significant shift in operational responsibility, placing the burden of safety infrastructure directly on service providers rather than on overwhelmed moderation teams managing millions of daily submissions.
International comparative experience provides additional perspective on enforcement trajectories and their consequences. Danielle Heinecke, Australian High Commissioner to Malaysia, described Australia's evolving regulatory framework as it has progressively strengthened requirements around age verification and platform accountability. Australian legislation now mandates that social media platforms implement reasonable age-verification systems—using methods such as age inference, estimation and technological verification—to prevent account creation by users under sixteen years old. Rather than leaving verification methodology entirely to corporate discretion, this approach establishes a performance standard: platforms must demonstrate they have taken reasonable steps to prevent underage access, with regulators evaluating compliance based on the sophistication and effectiveness of implemented systems. The regulatory environment has become more stringent as initial legislative versions failed to produce sufficient behavioural change, prompting policymakers to increase maximum penalties to A$99 million (approximately RM284 million) for corporate non-compliance.
Australia's escalating penalty structure reflects a lesson increasingly evident across jurisdictions: initial regulatory frameworks often underestimate the organisational and financial capacity of technology corporations to absorb compliance costs without substantive operational change. The jump to nine-figure penalties represents an attempt to reach a threshold where regulatory compliance becomes economically indistinguishable from ordinary operational expenses. For Malaysia's ONSA implementation, Australia's experience suggests that regulators should anticipate potential corporate strategies for circumventing legislative intent and prepare enforcement mechanisms with sufficient severity to eliminate financial incentives for non-compliance. This comparative dimension remains crucial for Malaysian policymakers as they navigate the immediate implementation phase and consider future legislative refinements.
Thiyagu indicated that Malaysia's regulatory framework anticipates evolution, noting that future iterations could refine terminology, strengthen content duration measures, adopt additional system-based approaches and introduce various mitigation strategies. This acknowledgment that legislation will require refinement as real-world implementation generates evidence suggests a degree of institutional humility about the difficulty of drafting comprehensive digital governance frameworks in rapidly changing technological environments. Regulators across jurisdictions continue discovering that platform behaviour, user conduct and technological capability evolve faster than statutory language can adapt. Building flexibility into legislative frameworks—through provisions enabling regulatory guidance updates, ministerial rule-making authority and periodic review requirements—may prove as important as the substantive obligations imposed on platforms and users themselves.
The gathering of Malaysian officials, international experts, human rights advocates and telecommunications executives at the IRC 2026 reflected the genuinely complex governance challenge that online safety represents. No participant argued that platforms should operate free from regulatory oversight or that child protection should be abandoned as impractical. Rather, disagreement centred on institutional mechanisms most likely to achieve genuine safety improvements while preserving democratic values around free expression and limiting government overreach. Malaysia's positioning within this global conversation carries particular significance given Southeast Asia's rapid digital adoption, the region's large young population and the potential for ONSA precedents to influence regulatory approaches across ASEAN. The success or failure of Malaysia's implementation will provide valuable evidence about whether primarily system-based platform accountability can meaningfully protect children while respecting fundamental freedoms—a question with implications extending far beyond Malaysia's borders.
