Malaysia's fight against deepfake and artificial intelligence-generated content is intensifying, with authorities reporting the removal of over 11,600 problematic items in less than 18 months as the scale of the problem becomes increasingly apparent. Deputy Communications Minister Teo Nie Ching disclosed the figures during parliamentary questioning, revealing that the Malaysian Communications and Multimedia Authority has systematically worked with social media companies to eliminate harmful content following formal takedown requests, marking a significant escalation in the government's response to emerging digital threats.
The trajectory of public complaints about deepfakes demonstrates how rapidly this issue has become embedded in Malaysia's digital landscape. In 2024, authorities received 917 complaints regarding synthetic media content. This number rocketed to 3,612 in 2025, representing a fourfold increase within a single year. By mid-June 2026, the figure had surged to 7,967, indicating that the problem is not stabilising but rather accelerating at an alarming pace. These statistics underline a growing public awareness of deepfake threats, yet they also suggest that artificial intelligence misuse is outpacing both public understanding and regulatory capacity in the region.
The government has responded by embedding new safeguards into the Online Safety Act 2025, specifically through the Risk Mitigation Code framework that now governs licensed social media platforms operating in Malaysia. This regulatory architecture represents a fundamental shift in how the state approaches platform accountability, moving beyond voluntary compliance to mandatory technical and operational standards. Platform providers must now implement comprehensive risk mitigation measures, with particular emphasis on identifying, flagging, and removing artificially generated content before it reaches wider audiences. The emphasis on prospective action rather than reactive takedowns signals a maturing regulatory approach that seeks to address the problem at source.
Implementation of these obligations has become a priority concern for regulators. The MCMC has begun systematic engagement with all licensed platform operators to audit their compliance with the new requirements, assessing whether each company has genuinely embedded AI detection and mitigation systems into their operational workflows. This oversight function is critical because platforms have historically resisted stringent content moderation requirements, viewing them as costly and technically challenging. The government's willingness to conduct formal assessments suggests that voluntary pledges have proven insufficient and that more direct intervention is necessary to ensure genuine compliance.
Beyond content removal, Malaysian authorities are building technical capacity to support broader law enforcement efforts. The MCMC provides critical assistance to police and investigative agencies by conducting digital forensic analysis, profiling suspected bad actors, and sharing intelligence derived from platform monitoring activities. This collaborative approach recognises that deepfake content often functions as a tool within larger criminal schemes—whether political disinformation campaigns, financial fraud, or harassment operations. By positioning itself as a technical partner to enforcement agencies, the communications regulator can amplify the impact of investigations and help prosecute cases that might otherwise escape notice.
Parallel to deepfake concerns, the government has also tackled the proliferation of scam-related advertising on social platforms. Licensed providers are now mandated to verify the identities of all advertisers, drawing on official databases maintained by agencies such as the Companies Commission of Malaysia. This verification requirement creates friction in the advertising supply chain, deliberately slowing down the process to prevent fraudsters from quickly establishing fake accounts and launching deceitful campaigns. For Malaysian consumers, this should reduce exposure to advance-fee scams, romance fraud schemes, and investment frauds that have increasingly exploited social media advertising networks.
The enforcement teeth built into the new framework may prove decisive in ensuring platform cooperation. Companies that fail to meet their obligations under the Risk Mitigation Code now face prosecution in court, with convicted platforms liable for fines up to RM1 million plus additional financial penalties reaching RM10 million. These penalties—particularly the cumulative exposure—represent a substantial business risk that should overcome platform resistance to compliance. The graduated penalty structure, combining immediate fines with ongoing financial liability, creates sufficient economic pressure to motivate genuine investment in content moderation infrastructure rather than superficial compliance gestures.
The deepfake surge reflects global trends but carries particular significance for Malaysia's political ecosystem. Synthetic media can weaponise political discourse by creating false evidence of statements or actions by public figures, potentially swaying electoral outcomes or undermining institutional trust. The spike in complaints during 2025-2026 coincides with heightened political activity and social polarisation, suggesting that bad actors have begun exploiting deepfake technology to amplify divisive narratives. Southeast Asian democracies, still developing sophisticated institutional defences against information manipulation, remain especially vulnerable to these novel attack vectors.
For ordinary Malaysians, the regulatory expansion carries both reassuring and concerning implications. On one hand, the visible enforcement action and technical monitoring suggest that authorities are taking synthetic media seriously and investing resources in detection and removal. On the other hand, the exponential growth in complaints indicates that deepfakes remain far ahead of regulatory capacity. Many harmful items likely circulate extensively before removal, and the gap between creation and detection continues to widen as AI tools become cheaper and more accessible. Consumer awareness campaigns emphasising critical media literacy may prove as important as platform-level technical controls.
The Malaysian regulatory model being developed around the Online Safety Act represents an intermediate approach, stronger than purely voluntary industry self-regulation but less restrictive than state-mandated content moderation systems common in more authoritarian contexts. Whether this balance proves sustainable depends on platform compliance, investigative capacity, and the government's willingness to enforce penalties consistently. The framework also remains untested against sophisticated adversaries who may exploit technical vulnerabilities or jurisdictional loopholes to continue spreading synthetic content.
Regional observers are likely watching Malaysia's implementation closely, particularly in Singapore, Thailand, and Indonesia where similar deepfake problems are emerging but regulatory responses remain nascent. If Malaysian authorities successfully reduce deepfake prevalence while maintaining democratic principles around content regulation, other Southeast Asian governments may adopt analogous approaches. Conversely, if the regime becomes a vehicle for suppressing legitimate political speech under the guise of combating synthetic media, it could set a cautionary precedent for the region's digital governance trajectory.
