Malaysia has moved from banning social media for under-16s to policing the exact tool millions of adults use for privacy: a VPN. On July 2, 2026, the Malaysian government confirmed it is working with the Malaysian Communications and Multimedia Commission (MCMC) to crack down on VPN abuse and fake identities as loopholes around the country's new social media age limits, and police say the act of using a VPN can now become part of a criminal investigation in its own right.
What Changed
Malaysia's social media age verification regime took effect on June 1, 2026, under the Online Safety Act 2025 (Act 866), requiring anyone opening a social media account to submit a MyKad, passport, or MyDigital ID and barring under-16s from holding accounts at all. Barely a month later, officials are acknowledging the obvious: a VPN, or simply logging in on a parent's or sibling's verified account, lets a minor route around the entire system in seconds.
Deputy Home Minister Datuk Seri Dr Shamsul Anuar Nasarah said the Royal Malaysia Police (PDRM) will now use VPN activity as investigative evidence, and treat circumvention through VPNs or borrowed identities as an aggravating element of an offence rather than a technical footnote.
The Legal Exposure
Malaysia isn't outlawing VPNs outright, but it is widening the net of laws that can attach to VPN use once it intersects with a crime. Officials named four statutes that can now apply:
- Penal Code: general criminal liability for offences facilitated through a concealed identity.
- Computer Crimes Act 1997: covers unauthorized access and misuse of computer systems.
- Communications and Multimedia Act 1998 (Act 588): governs misuse of network facilities and services.
- Online Safety Act 2025 (Act 866): the Child Protection Code and Risk Mitigation Code underpinning the age-verification rules themselves.
Officials specifically flagged child deception, online scams, and distribution of pornography as the offence categories where VPN-enabled anonymity will now be scrutinized alongside the underlying crime.
Why Now: The Numbers Behind the Crackdown
The government's justification rests on a sharp rise in cases: offences under the Sexual Offences Against Children Act 2017 nearly doubled, from 69 recorded cases in 2024 to 146 in 2025. That trend, officials say, is what pushed Putrajaya to move from a passive ID-check requirement to active policing of the tools used to bypass it.
Enforcement Hurdles
Even with new legal grounds, Malaysian authorities admit the crackdown faces real obstacles: fast-moving VPN and identity-spoofing technology, limited data retention by local telecom providers, and platforms hosted on servers outside Malaysian jurisdiction. To work around the jurisdiction problem, the government says it is leaning on Interpol and the Asean Chiefs of Police (Aseanapol) network for cross-border cybercrime cooperation.
What This Means for VPN Users
For the average adult using a VPN to protect banking sessions on public Wi-Fi or to keep browsing history away from advertisers, nothing here changes: a VPN by itself is not evidence of wrongdoing. The shift matters for anyone using a VPN specifically to spoof age or identity on a platform that legally requires verification, since that use case is exactly what investigators have now been told to look for. Malaysia's approach mirrors a wider pattern seen across Southeast Asia and beyond, where age-verification laws are pushing regulators to treat circumvention tools as part of the offence, not a neutral technology.
