The Federation of Malaysian Consumers Associations (FOMCA) strongly opposes any requirement that forces Malaysians to submit their MyKad, passport, or other highly sensitive personal identification documents directly to international social media platforms, foreign technology companies, or overseas-based verification providers.
While FOMCA acknowledges the need to protect children and minors online, consumer safety and national data sovereignty must never be sacrificed in the process. The current proposal raises extremely serious concerns involving privacy, cybersecurity, misuse of personal information, and loss of national control over Malaysiansβ personal identity data.
Malaysians should not be compelled to upload copies of their ICs, passports, or other official documents to companies that operate outside Malaysiaβs jurisdiction. Once such sensitive data leaves the country or is managed by international corporations, consumers lose visibility and control over how their information is used, stored, analysed, shared, monetised, or retained.
There are major unanswered questions surrounding the entire implementation. Consumers still do not know who exactly will manage the verification system, where the data will be stored, how long the data will be kept, whether the information will be transferred overseas, whether third-party vendors are involved, and whether the collected data could eventually be used for profiling, behavioural advertising, artificial intelligence training, commercial analytics, or data mining activities.
FOMCA is particularly concerned that this system could open the door to large-scale exploitation of Malaysiansβ identity data by private technology companies whose business models are heavily dependent on data collection and user profiling. Consumers must not become products in a digital economy where their personal identities are treated as commercial assets.
The issue goes far beyond age verification. This involves highly sensitive national identity information belonging to millions of Malaysians. Any data breach, leak, hacking incident, or misuse could expose consumers to identity theft, financial fraud, cybercrime, impersonation, scams, and long-term privacy violations.
FOMCA stresses that national identity documents are not ordinary information. MyKad data contains extremely sensitive details that can be abused if they fall into the wrong hands. Consumers are already facing increasing threats from scams, phishing syndicates, fake loans, mule account activities, and identity fraud.
Requiring citizens to upload identity documents across multiple social media platforms may significantly increase those risks.
FOMCA also rejects any approach that allows international companies to become gatekeepers of Malaysiansβ identities. Verification of citizensβ identity should remain under strict national control and must be governed through secure local infrastructure that complies fully with Malaysian laws and national cybersecurity requirements.
Instead of allowing social media platforms or overseas technology companies to directly collect identity documents, the government should explore safer alternatives such as a secure home-based Digital ID ecosystem managed under strict national governance and independent oversight. Verification systems should minimise data exposure and avoid unnecessary collection of sensitive documents.
FOMCA believes that any digital verification mechanism must follow the principles of necessity, proportionality, transparency, accountability, and data minimisation. Consumers should only provide the minimum information required for verification, without exposing full identity documents to multiple entities.
International experience has shown that age verification systems can easily become controversial when implemented without strong privacy safeguards. Several countries have faced criticism after citizens raised concerns about surveillance, excessive data collection, cybersecurity vulnerabilities, and the possibility of sensitive information being commercially exploited.
Malaysia must learn from these global concerns instead of rushing implementation without proper public consultation. Policies involving personal identity data require public trust, and trust cannot exist without transparency. FOMCA therefore calls for the immediate postponement of the proposed implementation until comprehensive stakeholder engagement is conducted involving consumer groups, cybersecurity experts, digital rights advocates, privacy specialists, parents, youth groups, legal experts, and industry stakeholders.
The government must first present a clear and transparent framework explaining how the system will function, who will manage the data, what legal protections exist, how independent oversight will be conducted, and how consumersβ rights will be protected.
Protecting children online is important, but protecting the privacy, dignity, and sovereignty of Malaysiansβ personal data is equally critical. Consumer rights and national interests must never be compromised in the pursuit of digital regulation.
Dr. Saravanan Thambirajah
Chief Executive Officer
