When the Malaysian Communications and Multimedia Commission (MCMC) switched on its social media Class License regime on January 1, 2025, officials framed it as a modest accountability measure: any platform with 8 million or more Malaysian users would need to register under the Communications and Multimedia Act 1998 (CMA) or risk penalties. Sixteen months later, the picture looks far less modest. According to MCMC's own reporting, removal orders to licensed platforms surged into the tens of thousands in 2025, sweeping in everything from online gambling and investment scams to so-called '3R' content — race, religion, and royalty — and political criticism of the ruling coalition.
This is the textbook trajectory of licensing regimes. They are sold as registration. They become leverage. And once leverage exists, it gets used.
What the Class License actually does
Under the framework set by MCMC, social media and internet messaging service providers crossing the 8-million-user threshold must obtain an Applications Service Provider Class License under Section 126 of the CMA. Operating without one is an offence carrying fines and potential imprisonment for officers of the provider. The license itself is not a content rulebook — but it binds the licensee to MCMC's directives, including takedown notices issued under Section 263 of the Act, which obliges licensees to assist in 'preventing the commission or attempted commission of an offence under any written law of Malaysia.'
That phrase — any written law — is the trapdoor. Malaysia's statute book includes the Sedition Act 1948, the Penal Code's Section 233 on 'offensive' online communications, and the Communications and Multimedia Act's own broadly drafted offence provisions. Once a platform is a licensee, the question is no longer whether to engage; it is whether to comply or lose the license.
TikTok registered early. Meta and Google publicly resisted through 2025, citing concerns about scope and due process, before ultimately moving toward compliance to avoid disruption to Malaysian users and advertisers. The asymmetry is itself instructive: the platforms with the deepest legal teams and the strongest free-expression policies on paper still concluded that operating outside the regime was untenable.
The takedown surge
MCMC has touted the volume of removal requests as evidence the regime is working. The categories tell a more ambiguous story. Online gambling promotions, romance scams, and investment fraud are uncontroversially harmful and platforms already remove them under existing terms of service. But '3R' content and political criticism are different animals. They are defined by official sensitivity rather than concrete harm, and they have a long history in Malaysian enforcement of being deployed against opposition voices, satirists, and journalists.
When the same pipeline handles a scam ad and a critical post about a royal, the procedural and evidentiary standards collapse into one. Platforms processing thousands of orders cannot meaningfully second-guess each one. The path of least resistance — remove first, contest never — becomes the operating norm.
A regional pattern, not an outlier
Malaysia is not inventing this template. India's IT Rules 2021 (and the 2023 amendments creating a now-paused fact-check unit) similarly bind intermediaries to government takedown directions backed by safe-harbour loss. A pending defamation case brought by Motorola's Indian arm against X, YouTube, Meta, and Google — recently reported by Rest of World — illustrates how private litigants are now leveraging the same architecture to demand pre-emptive removal of 'defamatory' device reviews and any future similar content. Indonesia's MR5 ministerial regulation imposes comparable obligations on 'private electronic system operators.' Vietnam's Decree 147 went further still, mandating local data storage and 24-hour takedowns.
The common thread: licensing or registration as the gateway, broad statutory offences as the substantive law, and tight turnaround windows that make adjudication impossible. Each step is defensible in isolation. The aggregate is a regional infrastructure for executive-branch speech control with minimal judicial oversight.
What proportionate regulation would look like
Nothing in a pro-innovation, pro-speech position requires defending scams or child sexual abuse material. Targeted, narrowly drawn obligations for genuinely illegal content — anchored in clear definitions, with independent oversight and meaningful appeal — are entirely compatible with an open internet. The problem with Malaysia's framework is not that it exists; it is that it bundles harmful-content enforcement with categories that should never be subject to administrative takedown at all.
A better design would:
- Separate the pipelines. Scam, fraud, and CSAM takedowns belong in a different track than political or '3R' content, with different procedural safeguards and different transparency reporting.
- Require judicial oversight for any removal touching political speech, journalism, or commentary on public figures and institutions.
- Publish full transparency reports — order counts by category, requesting authority, and outcome — so the public can audit whether 'harm' enforcement is bleeding into speech suppression.
- Decouple license status from substantive compliance disputes, so platforms can contest individual orders without facing the existential threat of losing the license itself.
The chilling effect is the point
The MCMC framework's defenders argue that platforms remain free to push back on any specific order. Formally, that is true. Practically, when the licensing authority is also the takedown authority, pushback carries systemic risk. The 'guidance' a platform receives in a quiet meeting never appears in a transparency report. The orders that get withdrawn after compliance are not the ones that mattered.
Malaysia's experiment will be watched closely across Southeast Asia and beyond. If the takedown surge becomes the new baseline, the open internet's footprint in the region will quietly shrink — not through dramatic shutdowns, but through a thousand small removals that no court ever sees. Policymakers in Putrajaya still have time to draw the lines that the CMA's drafters in 1998 could not have anticipated. Whether they do will say a great deal about which Malaysia they want to build.