Protecting children from online harm without trampling on freedom of expression represents one of the most pressing regulatory dilemmas facing Malaysia and democracies worldwide. At the International Regulatory Conference 2026 in Kuala Lumpur, Datuk G. Thiyagu, Deputy Director-General at the Prime Minister's Department's Legal Affairs Division, underscored that this tension sits at the heart of modern governance as nations craft digital-age legislation. Countries from Australia to the United Kingdom and Canada are confronting identical problems, yet there remains no consensus blueprint—suggesting that culturally tailored solutions matter.
Malaysia's approach centres on the Online Safety Act 2025 (ONSA), which pivots on a system-based regulatory model rather than blanket restrictions. Thiyagu explained that the legislation imposes specific duties on platform operators to design their services with safety at the core. This design-first philosophy acknowledges that reactive enforcement—waiting for harm to occur then punishing—proves inadequate in an ecosystem where content spreads globally within seconds. By placing onus on technology companies to implement preventive mechanisms, Malaysia attempts to shift responsibility upstream to those with the greatest technical capacity to intervene.
The principle of proportionality underpins ONSA's construction, functioning as a constitutional guardrail against regulatory overreach. Article 10 of Malaysia's Federal Constitution guarantees freedom of speech, yet does not render it absolute—exceptions exist for public order, morality and national security. Thiyagu acknowledged that defining these boundaries requires precision to avoid authorities weaponising vague provisions against legitimate expression. The drafting process therefore necessitated careful calibration, distinguishing between genuine child protection measures and mechanisms that might inadvertently suppress dissent or minority viewpoints. This constitutional anchoring provides a legal defence against authoritarian mission creep.
Yet legislation alone proves insufficient without enforcement teeth. Dr Farah Nini Dusuki, Children's Commissioner at the Human Rights Commission of Malaysia (Suhakam), identified a critical implementation gap: Malaysia possesses comprehensive child protection laws already on the statute books, but oversight mechanisms remain inadequate. The problem is not legislative ambition but institutional capacity to monitor compliance, identify failures and iterate improvements. She compared inadequate online safety oversight to accepting unsafe physical playgrounds because regulations exist—the mere presence of rules changes nothing if no one verifies compliance. Her advocacy for preventive rather than reactive approaches reflects a philosophical shift from punishment to environmental design, treating platform accountability much like mandatory building codes that prevent accidents before they happen.
Suhakam's commissioner stressed that ONSA's ultimate efficacy depends entirely on the robustness of regulations supporting its implementation. Ambiguous language, weak enforcement procedures or resource-starved regulators would render even well-intentioned legislation ceremonial. For Malaysian parents and children, this means the difference between genuine protection and performative governance. The regional implications extend beyond Malaysia—if ONSA succeeds, neighbouring countries may adopt similar models; if it fails due to poor implementation, scepticism about digital regulation will spread across Southeast Asia.
A more radical enforcement philosophy emerged from Gurtaj Singh Padda, Chief Executive Officer of Tune Talk, who argues that financial penalties prove insufficient against global technology giants. Australia's recent increase of maximum non-compliance fines to AUD 99 million demonstrates escalating penalties, yet such sums amount to rounding errors for trillion-dollar corporations. Singh Padda advocates for market-based enforcement: require platforms to remove their services entirely from countries whose laws they breach rather than simply paying fines as a cost of business. This approach treats compliance as a binary condition rather than a negotiable financial calculation, fundamentally altering platform incentives.
Tune Talk's innovative parental control technology demonstrates how the private sector can supplement regulatory frameworks. By enabling parents to selectively block access to specific platforms or customise age-appropriate internet usage through simple interfaces, the company empowers households rather than relying solely on government intervention. This distributed model distributes responsibility across multiple stakeholders—platforms, regulators, parents and schools—rather than concentrating power in state hands. For Malaysian families managing digital exposure, such tools represent practical shields while policy debates continue.
Australia's regulatory experience offers instructive lessons for Malaysia's ongoing implementation. The Australian approach mandates that social media platforms prevent users under 16 from creating accounts, shifting age verification burden to technology companies rather than government agencies. Methods include age inference, estimation and verification—recognising that perfect accuracy proves impossible while requiring platforms pursue reasonable diligence. Australia's enforcement escalation to AUD 99 million penalties signals determination to compel compliance, though critics question whether financial leverage proves sufficient against companies whose revenue dwarfs these fines.
The international regulatory landscape reveals fragmented approaches yielding different protections across jurisdictions. Within Southeast Asia, Malaysia's ONSA positions the nation as a regional standard-setter, potentially influencing how Singapore, Indonesia and Thailand calibrate their own digital governance frameworks. If Malaysia successfully balances child protection with free expression rights, the model gains legitimacy; if implementation falters or rights protections erode, neighbouring democracies will pursue alternative paths. The stakes extend beyond child safety to encompass the principle that robust regulation can coexist with democratic freedoms—a proposition many sceptical technologists dispute.
Refining ONSA through future legislative phases offers opportunity to address emerging challenges and terminology refinements. Thiyagu indicated openness to strengthening content duration measures and deepening system-based accountability mechanisms based on early implementation experience. This iterative approach acknowledges that digital dynamics outpace static legislation; frameworks designed for 2025 conditions may require recalibration as platforms innovate and societal expectations evolve. Malaysian policymakers wisely signal flexibility rather than defensive entrenchment, essential for maintaining regulatory legitimacy across changing technological landscapes.
The deeper challenge extends beyond law-making to culture-building. Effective online safety ultimately requires parents, educators, technologists and regulators functioning as coordinated ecosystems rather than adversaries. Malaysian schools must teach digital literacy alongside literacy itself, preparing citizens to navigate online environments safely. Technology companies must genuinely embed safety into product development rather than treating compliance as external constraint. Regulatory agencies require sufficient funding and expertise to match corporations' sophistication. For Malaysia to achieve balanced online governance, these elements must reinforce rather than contradict one another—a civilisational project far more ambitious than passing legislation.
