On January 1, 2025, Malaysia became the first country in Southeast Asia to require large social media and messaging platforms to obtain a government license simply to operate. Under a framework administered by the Malaysian Communications and Multimedia Commission (MCMC), services with at least 8 million Malaysian users must hold an Applications Service Provider Class License (ASP-CL) issued under the Communications and Multimedia Act 1998. By the start of 2025, TikTok and WeChat had reportedly applied and received licenses; through 2025 and into 2026, Meta and X remained under enforcement scrutiny over delays in compliance.
Malaysian officials have framed the regime as a response to a genuine and visible problem: a surge in online scams, child sexual exploitation material, and cybercrime targeting Malaysian users. Those harms are real. But licensing platforms as if they were broadcasters or telcos — with conditions set by the regulator and revocable at the regulator's discretion — is a serious step. It risks importing the worst features of older communications regimes into the internet layer, and offering a template that less liberal governments in the region are already studying closely.
What the License Actually Does
The Communications and Multimedia Act 1998 was designed in the dial-up era to regulate network and applications services. By interpreting large social media platforms as "applications service providers," MCMC has effectively folded global content services into a permission-based framework originally built for telephony and broadcasting. The class license is not just a registration — it carries ongoing duties, reporting obligations, and the implicit possibility of suspension or non-renewal if the regulator concludes those duties have not been met.
Three features of the regime deserve close attention:
- Threshold-based scope. The 8-million-user trigger is high enough to exempt smaller platforms, but low enough that any service with national-scale reach falls inside. That is, by design, the entire mainstream public square.
- Conditions set by regulation, not statute. Licensing conditions are issued by MCMC and the Minister rather than debated as primary legislation. Civil society groups including ARTICLE 19 and the Centre for Independent Journalism Malaysia have warned that this concentrates rule-making power in the executive.
- Revocation as leverage. Because operating without a license is itself an offense under the CMA, the threat of license withdrawal becomes a de facto content-moderation lever — one that does not require a court order.
The Real Problem the Government is Trying to Solve
It would be wrong to caricature Malaysia's policy as content control dressed up as cybersecurity. Bank Negara Malaysia and the police have reported steep year-on-year increases in online financial scams since 2021, with losses running into the billions of ringgit. Investment fraud, romance scams, and "mule account" recruitment frequently begin on Facebook Marketplace, WhatsApp, Telegram, or TikTok. Child safety advocates have similarly highlighted the difficulty of getting takedowns processed at scale on services with minimal local presence.
These are the legitimate problems a regulator is supposed to address. The question is whether platform-wide licensing is the right tool — or whether it does too much work, and the wrong kind of work, to fix them.
Why Licensing Is the Wrong Default
Licensing regimes operate by reversing the burden: a platform is presumed not to be allowed to operate until the state says otherwise. For broadcasting and spectrum, that makes sense — radio frequencies are a scarce public resource. For online speech, it does not. The internet's defining feature, and the reason it has driven a generation of economic and civic gains, is that publishing does not require permission.
Conditioning access to the Malaysian public on a renewable government license:
- Creates a single point of pressure that future governments — of any ideology — can use to push platforms toward content decisions they would not otherwise make;
- Disadvantages domestic challengers and open-source services, which lack the legal and lobbying infrastructure of incumbents like Meta and ByteDance;
- Sets a regional precedent at a moment when neighbors including Indonesia, Vietnam, and Thailand are debating their own platform rules.
The contrast with the European Union's Digital Services Act is instructive. The DSA imposes far heavier duties on very large platforms — risk assessments, transparency reports, researcher access, independent audits — but does not require a license to operate. Obligations attach to conduct, not to permission.
A More Proportionate Path
Malaysia does not have to choose between unaccountable platforms and a licensing state. A proportionate framework would keep the legitimate harm-reduction goals while removing the structural risks:
- Statutory duties, not discretionary licenses. Codify clear obligations — fast scam takedown, financial-fraud cooperation, CSAM reporting, local point of contact — in primary legislation, with judicial review.
- Targeted scam infrastructure. Mandate platform-bank data-sharing protocols for verified fraud reports, modeled on Singapore's Online Criminal Harms Act mechanisms, rather than general license conditions.
- Transparency and audit, not revocation. Borrow from the DSA's risk-assessment and audit model so that enforcement is evidence-driven, not existential.
- Due-process guardrails. Any platform sanction with speech effects should require a reasoned, appealable decision — not a regulator's renewal letter.
What's at Stake
The MCMC regime will be watched closely across the region. If it succeeds primarily at reducing scams, it will be remembered as a pragmatic intervention. If it becomes a tool for pressuring platforms on lawful-but-unwelcome speech — political commentary, satire, criticism of officials — it will be remembered as the moment Malaysia normalized licensing the public square.
People of Internet's position is that online harms, including the very real scam and cybercrime problems Malaysia is grappling with, deserve serious, evidence-based responses. But the licensing model gets the architecture wrong. It treats speech as a privilege the state grants, rather than a right the state protects. Asia's next wave of platform rules can do better — and Malaysia, with its strong institutions and active civil society, is well placed to lead that revision rather than entrench a 1998-era frame.