On 5 June 2026, Malaysia's Ministry of Digital announced that its MyGOV super-app had crossed 2.2 million users and would carry public broadcaster RTM's FIFA World Cup 2026 feed — TV1, TV2 and Okey TV — directly inside the app. There was one condition. As Digital Minister Gobind Singh Deo confirmed, the live stream is available only to users who have registered for MyDigital ID, the national digital identity scheme (The Star).
The tournament runs 11 June to 19 July. The timing is not incidental. The government has openly tied the most-watched sporting event on Earth to enrolment in a state identity system — a textbook nudge, and a revealing one.
The case for consolidation is real
It would be unfair to treat this as a sinister move. The strongest version of the government's argument is genuinely compelling. Malaysians have long navigated a maze of disconnected agency portals, each with its own login. MyGOV folds 51 services from 19 agencies — passports, road tax, birth registration, healthcare appointments, summonses, cash aid — into a single app launched in August 2025. MyDigital ID, by the government's own design, does not store ID copies or biometric templates; it verifies a user against National Registration Department records and returns only a confirmation (MyDigital ID). A single trusted login that spares citizens from photocopying their MyKad for every transaction is, on its face, exactly the kind of state-capacity upgrade a pro-innovation publication should welcome. Estonia built enormous public value on precisely this foundation.
The problem is not the architecture. It is the method of adoption.
Convenience as leverage
The government had earlier targeted 15 million MyDigital ID enrolments by the end of 2025 and missed it badly: by December 2025 the figure stood near 6.4 million, growing at roughly 50,000 a day, with a new goal of integrating 95% of federal services with the ID by 2030 (Biometric Update). When voluntary uptake stalls, a government has two honest options: make the system better, or make it genuinely optional and accept slower growth. Gating a free-to-air national broadcast behind enrolment is neither. RTM's World Cup coverage is a public good, funded by taxpayers, that Malaysians can already watch on terrestrial TV without identifying themselves. Restricting the app stream to ID holders manufactures an artificial scarcity whose only function is to drive registrations.
This matters because it fits a pattern of adoption-by-attrition. Since 1 May 2026, the Road Transport Department's MyJPJ app has accepted only MyDigital ID logins for users aged 18 and over — a service millions need for road tax and licences (Free Malaysia Today). Under the Online Safety Act, in force since 1 January 2026, platforms must roll out age and identity verification — with MyDigital ID an accepted method — by mid-2026, and under-16s are barred from new social media accounts (Biometric Update). Step by step, an officially "not compulsory" credential is becoming the only practical way to drive, transact, and now even watch football.
The safeguards still lag the mandate
The deeper objection is sequencing. Malaysia is requiring the identity first and promising the protections later. Its Personal Data Protection Act 2010 explicitly does not bind the federal or state governments — so a private firm faces fines for a breach, but Putrajaya does not. That gap is not theoretical in a country that has seen 46 million mobile subscriber records leaked in 2017, some 22.5 million records sold in 2022, and roughly 17 million MyKad records compromised in 2024 (Free Malaysia Today). Concentrating authentication for dozens of services into one credential raises the stakes of any single failure.
Civil society has said as much for months. In a joint statement on 4 October 2025, the Centre for Independent Journalism, ARTICLE 19 and Sinar Project warned that mandatory e-KYC tied to MyDigital ID risks normalising surveillance and chilling anonymous speech, and they urged comprehensive data-protection legislation and independent oversight before rollout, not after (CIJ/ARTICLE 19/Sinar Project). These are not anti-government activists; they are asking for the ordinary guardrails any liberal democracy applies to a centralised identity system.
A proportionate path exists
None of this requires scrapping MyDigital ID. A pro-innovation position favours exactly the kind of interoperable, single-login government MyGOV promises. But three things should travel with it, not behind it. First, amend the PDPA so the same breach-liability rules bind government agencies that handle citizen data. Second, keep genuinely public goods — a taxpayer-funded World Cup broadcast above all — accessible without an identity wall, so adoption rests on the system's merits rather than on engineered inconvenience. Third, legislate hard limits on data retention, cross-agency access and function creep before the ID becomes load-bearing for speech itself.
Malaysia is on track to make MyDigital ID one of the most consequential pieces of public digital infrastructure in Southeast Asia. Whether it becomes an Estonian success or a single point of failure will be decided not by the technology but by whether the government can resist the temptation to grow it through pressure rather than trust. Using the World Cup as an onboarding funnel suggests the temptation is winning.