Protect Kids, Not Harvest Data: Industry Groups Push Back Against Age Verification

Subscribe to our Telegram channel for the latest stories and updates.

The Malaysian Communications and Multimedia Commission (MCMC) has received strong feedback calling for a flexible, risk-based approach to age assurance measures rather than a rigid, one-size-fits-all age verification system for online platforms.

MCMC, in compiling responses from stakeholders, found that the majority of respondents largely supported the adoption of age assurance mechanisms that are proportionate to the level of risk posed by different online services.

According to the MCMC’s Public Consultation Report on Proposed Draft Codes under the Online Safety Act (ONSA) 2025, stakeholders argued that age assurance should be grounded in a “proportionate and risk-based framework”.

Under the framework, the level of verification required corresponds directly to the potential harm associated with a platform or service, where internet messaging services and social media platforms would be allowed to implement “reasonable, proportionate and risk-based” age assurance measures tailored to their specific design, user base and risk exposure.

“A significant body of feedback supported the adoption of age assurance methods rather than a single prescriptive age-verification model,” the report stated.

Respondents also recommended a multi-layered approach to age assurance, rather than relying solely on fixed identity checks for all users.

Instead, platforms should be allowed to combine multiple signals and behavioural indicators to identify underage users and take corrective action where necessary.

Such systems, according to the consultation feedback, would help platforms detect and remove underage accounts even in cases where users initially misrepresent their age.

This layered model is seen as more effective in balancing child protection objectives with privacy considerations, particularly as online risks and circumvention tactics continue to evolve.

Feedback also referenced international regulatory approaches as useful benchmarks for Malaysia’s policy direction.

Australia’s Social Media Minimum Age framework, the United Kingdom’s Online Safety Act 2023, and the European Union’s Digital Services Act were all cited as examples of systems that require platforms to take “reasonable steps” without mandating specific technologies.

A key concern raised during the consultation was the proposal for mandatory age verification using government-issued identity documents.

Respondents warned that such a requirement could conflict with principles of data minimisation and user privacy, as it would necessitate the collection and processing of highly sensitive personal data for all users, including adults.

They cautioned that this could lead to the creation of large centralised databases of identity information, significantly increasing the risk of data breaches and cybersecurity incidents.

Some submissions further argued that the potential consequences of a large-scale breach involving millions of Malaysians’ identity records could outweigh the intended benefits of stricter child safety enforcement online.