The tension between protecting citizens from online harms and preserving fundamental freedoms continues to define digital regulation across the Asia-Pacific region. At the International Regulatory Conference 2026 in Kuala Lumpur, Datuk G. Thiyagu, Deputy Director-General (Law Reform) at the Legal Affairs Division of the Prime Minister's Department, highlighted this persistent challenge facing policymakers in Malaysia, Australia, the United Kingdom and Canada. His remarks underscored how governments worldwide are wrestling with the same problem: crafting rules that shield vulnerable users without strangling the open discourse that democratic societies depend upon.
Malaysia's approach centres on the Online Safety Act 2025 (ONSA), which represents the government's latest attempt to impose standards on social media platforms while respecting constitutional protections for speech. Thiyagu explained that the legislation adopts what officials call a system-based approach, essentially shifting accountability from individual users to platform operators themselves. Rather than policing what people say, the law compels technology companies to build safer systems and remove harmful content more aggressively. This methodology reflects a subtle but important philosophical shift in how regulators think about digital harms—treating them as design problems rather than speech problems.
The principle of proportionality anchors Malaysia's legal framework, according to Thiyagu. This constitutional doctrine requires that restrictions on fundamental rights be necessary, suitable and not excessive relative to their intended purpose. Proportionality serves as a guardrail against overreach, ensuring that in pursuing online safety, lawmakers do not inadvertently create tools for suppressing legitimate dissent or unpopular viewpoints. Article 10 of the Federal Constitution guarantees Malaysians freedom of speech, though this right is not absolute—it yields to compelling state interests in public order, morality and national security. The challenge lies in applying these exceptions with restraint and clarity.
Dr Farah Nini Dusuki, Children's Commissioner at the Human Rights Commission of Malaysia (Suhakam), offered a diagnosis that resonates across Southeast Asia: the problem is not a shortage of laws but rather their anaemic implementation. Malaysia already possesses a reasonably comprehensive body of legislation designed to protect children's interests online, yet these rules often languish unenforced or are enforced sporadically. Stronger oversight mechanisms are needed to monitor whether authorities are actually applying these laws, identify gaps in their design and refine them based on real-world experience. Without such monitoring, legislation becomes mere parchment, reassuring in its presence but hollow in its effect.
Dr Farah Nini advanced a conceptual framework that deserves wider adoption throughout the region: the distinction between preventive and reactive safety measures. Just as societies invest heavily in safer infrastructure—better roads, better playground design—to protect children before accidents happen, the online environment should be engineered for safety from the ground up rather than patrolled reactively once harm occurs. This preventive mindset requires platforms to redesign their algorithms, notification systems and content moderation processes before children encounter dangerous material. The success of ONSA ultimately hinges on whether regulators can translate this prevention principle into enforceable obligations with real consequences.
Gurtaj Singh Padda, Chief Executive Officer of Malaysian telecommunications company Tune Talk, offered a more muscular perspective on enforcement. He contended that financial penalties alone prove insufficient to modify the behaviour of multinational social media giants, which can absorb fines as mere costs of doing business. Instead, enforcement should threaten platform access itself—the ultimate sanction being the ability to block or restrict access to non-compliant services within Malaysia. Tune Talk has begun enabling parents to use a simple one-touch system to block access to platforms like TikTok and Facebook while allowing customised, age-appropriate internet access for their children. This approach shifts some responsibility to parents while simultaneously demonstrating that alternative models exist.
Padda argued that the most efficient path to platform compliance bypasses complex regulation entirely. Platforms, he suggested, should be required to verify that all content appearing on their services has been reviewed and approved before publication—essentially treating user-generated content more like traditional media editorial processes. This draconian standard would likely prove unworkable at scale, yet it illustrates the frustration that some stakeholders feel with platforms' current moderation efforts. The deeper insight is that platforms respond more decisively to threats of economic exclusion than to fines, suggesting that regulatory design should emphasise market access rather than purely monetary penalties.
Australia's experience offers instructive lessons for Malaysian policymakers. Australian High Commissioner Danielle Heinecke described her country's recent legislation requiring social media platforms to prevent users under sixteen from holding accounts, essentially imposing age verification obligations on services. Australia has empowered regulators to demand that platforms employ age inference, estimation and verification technologies—a requirement that shifts the burden of compliance from parents and children to technology companies themselves. Most significantly, Australia recently elevated maximum penalties for non-compliance to A$99 million (approximately RM284 million), creating genuine financial consequences for recalcitrant platforms. This dramatic increase signals that penalties need to reach thresholds where they genuinely constrain corporate decision-making.
The Australian model reveals the escalating sophistication of regulation across the developed democracies. Rather than relying solely on criminal law to punish individual users for harmful speech, modern approaches target platform infrastructure and corporate behaviour. Age verification represents a particularly controversial intervention because it creates privacy risks of its own—to verify age, platforms must collect and process biometric data or government identification information. This illustrates the deeper paradox facing digital regulators: that solutions to one problem often create new ones. Malaysia and other Southeast Asian nations must carefully consider whether age verification technologies genuinely enhance safety or simply transfer risk from one category to another.
Malaysia's position within this global regulatory conversation is notably progressive. The country is being recognised as a leader in moving beyond simple prohibition toward more sophisticated approaches that combine platform accountability, parental empowerment and technological design changes. However, recognition from international peers carries implicit expectations for rigorous implementation and transparent enforcement. Malaysian regulators must ensure that ONSA does not become a law that exists on the statute books but struggles in practical application, as Dr Farah Nini cautioned. This requires dedicated resources for the Malaysian Communications and Multimedia Commission (MCMC) to monitor compliance, sufficient technical expertise to understand how platforms actually operate, and a commitment to iterative refinement based on evidence about what works.
The dialogue at the International Regulatory Conference demonstrated that Southeast Asian nations are not passive consumers of Western regulatory templates but active contributors to a global conversation about digital governance. Malaysia's approach, informed by local constitutional values and adapted to the regional context, offers a model that balances innovation with rights protection. Yet the consensus among speakers was clear: having good laws matters far less than enforcing them rigorously and adapting them as technology evolves. For parents, platforms and regulators alike, the real work of online safety lies not in passing legislation but in the unglamorous daily labour of implementation, monitoring and adjustment.
