The government is working with the Malaysian Communications and Multimedia Commission (MCMC) to address the misuse of technologies such as virtual private networks (VPNs) and third-party identities to bypass age verification measures on social media platforms. Deputy Home Minister Datuk Seri Dr Shamsul Anuar Nasarah said the police will take into account publicly available information during investigations and will address the misuse of such technologies where appropriate.
He made the remarks in the Dewan Rakyat today in response to a supplementary question from Riduan Rubin (Independent-Tenom) on the government’s technical strategies to enforce the upcoming social media age limit. However, the Deputy Home Minister stressed that action will only be taken if they are used to facilitate criminal activities.
VPNs And Third-Party Identities Under The Spotlight
Shamsul Anuar said authorities are monitoring the use of VPNs and third-party identities that may be used to circumvent age verification systems implemented by social media platforms. “If it is used to facilitate criminal activities such as deceiving children, online scams, the dissemination of pornography, or other offences, action will be taken under the law, including the Penal Code, the Computer Crimes Act 1997, and the Communications and Multimedia Act 1998,” he said.
For the uninitiated, a VPN is a service that encrypts internet traffic and routes it through servers in another location, helping to improve privacy, secure connections on public Wi-Fi networks, or access services while travelling. However, it can also be misused to conceal a user’s location or identity while carrying out unlawful activities, such as online scams or distributing illegal content.
The deputy minister also referred to the use of “third-party identities”. In this context, it generally refers to using someone else’s identity or credentials, such as another person’s account, identification details, or phone number, or creating fake identities to bypass age restrictions or conceal a user’s true identity online.
Technical Challenges
According to Shamsul Anuar, enforcing online age restrictions is becoming increasingly challenging due to the rapid pace of technological development. Authorities also have to contend with limitations on how long telecommunications companies retain data, as well as the fact that many social media platforms and their servers are located overseas.
He also revealed that police recorded 69 cases under the Sexual Offences Against Children Act 2017 in 2024. That figure more than doubled to 146 in 2025, which he said underscores the need for stronger online safeguards for children.
For foreign platform providers, he said compliance with age verification and child protection requirements falls under MCMC’s jurisdiction through Malaysia’s existing legal framework. Companies that fail to comply with regulatory directives could face compliance orders, restrictions on access to their services or content, or legal action.
Separately, he said Malaysia is also working with Interpol and ASEANAPOL to tackle cross-border cybercrime.
Does This Mean VPNs Could Be Banned?
Shamsul Anuar’s remarks are likely to raise concerns among VPN users. However, his statement stopped short of suggesting that VPNs themselves would be prohibited. Instead, he reiterated that enforcement would focus on instances where the technology is used to facilitate criminal activities.
This is also consistent with MCMC’s previous position. In 2024, the regulator clarified that it had no plans to block VPN services in Malaysia, acknowledging their many legitimate uses for individuals and businesses. Instead, the commission said its focus was on tackling the misuse of VPNs rather than banning the technology altogether.
Questions Still Remain
That said, exactly how authorities intend to distinguish legitimate VPN usage from misuse remains unclear. While offences such as online scams, child exploitation, and the distribution of illegal content are relatively straightforward, the broader enforcement framework has yet to be publicly detailed. Without clearer operational guidelines, the implementation of such measures is likely to remain under scrutiny.
Malaysia would also not be the first country to regulate the misuse of VPNs. In Turkey, authorities have periodically blocked or restricted access to certain VPN services, though they are not banned. Meanwhile, the United Arab Emirates permits VPN use but imposes severe penalties when the technology is used to commit crimes or circumvent local laws.
Whether Malaysia ultimately adopts a similarly targeted approach remains to be seen. Based on current government statements, however, the emphasis appears to be on addressing criminal misuse rather than prohibiting VPNs outright.
(Source: Bernama)