Malaysia's fight against artificial intelligence-generated deception has intensified significantly, with authorities removing over 11,600 pieces of deepfake content since the start of 2024. Deputy Communications Minister Teo Nie Ching disclosed the escalating enforcement action during parliamentary questioning, underscoring the government's determination to combat the proliferation of manipulated multimedia content that threatens public trust and democratic discourse across the nation.
The trajectory of reported deepfake incidents paints a sobering picture of how rapidly AI misuse has metastasised across Malaysian digital spaces. Complaints lodged with relevant authorities jumped dramatically from just 917 cases in 2024 to 3,612 the following year, then accelerated further to reach 7,967 complaints by mid-June 2025. This roughly eightfold increase over roughly eighteen months demonstrates that deepfake technology is no longer a fringe concern but has become a mainstream threat that ordinary Malaysians increasingly recognise and report to authorities. The sharp climb suggests either a genuine explosion in creation and circulation of synthetic media or heightened public awareness—likely both factors are at play.
To combat this escalation, the Malaysian government has deployed regulatory machinery grounded in the Online Safety Act 2025, a landmark legislative framework that represents Malaysia's attempt to establish comprehensive digital governance standards. At the core of this approach sits the Risk Mitigation Code, which imposes binding obligations on licensed social media platforms to institute safeguards specifically targeting AI-generated and manipulated content. Rather than attempting to ban technology outright—a strategy often proved futile—the RMC places responsibility directly on platforms to implement detection, removal, and prevention mechanisms. This reflects a sophisticated understanding that content moderation must be shared responsibility between regulators, technology companies, and users themselves.
Teo revealed that the Malaysian Communications and Multimedia Authority has been actively engaging with platform operators to assess compliance with these new risk mitigation obligations. This oversight mechanism is crucial because it moves beyond merely reacting to complaints and instead establishes proactive accountability structures. Platforms now face regular audits and performance reviews, creating ongoing pressure to invest in detection technology and human review capacity. The approach acknowledges that deepfakes are not discrete violations but symptoms of systemic vulnerabilities in platform architecture that require systematic solutions rather than case-by-case takedowns alone.
Behind the headline figures, the MCMC has been coordinating with law enforcement agencies to investigate serious cases of AI misuse, particularly those involving fraud, election interference, or defamation. The authority provides critical technical assistance including digital forensic analysis, metadata profiling, and content origin tracing—investigative tools that deepfake creators have become increasingly sophisticated at evading. The regulator has also implemented proactive monitoring systems that scan social media in real time for synthetic content patterns, allowing authorities to identify emerging threats before they achieve viral circulation. This shift from reactive to preventative policing reflects lessons learned from incidents in other democracies where deepfakes spread unchecked before being addressed.
The regulatory framework has expanded beyond deepfakes themselves to address related harms, particularly fraudulent advertising that exploits platform vulnerabilities. Licensed social media platforms are now mandated to verify the identities of advertisers through official channels such as the Companies Commission of Malaysia, closing loopholes that have allowed scammers to create fake business accounts and launch sophisticated advertising campaigns. By tightening the funnel through which advertisers can access platform reach, this requirement aims to reduce the scale of fraud while maintaining space for legitimate commercial speech. The measure reflects recognition that deepfakes and scams often operate through overlapping supply chains and technical infrastructures.
Enforcement teeth are critical to any regulatory regime, and the Online Safety Act provides them. Licensed platforms that breach their RMC obligations face potential prosecution resulting in fines up to RM1 million, with additional financial penalties reaching RM10 million in serious cases. These penalties represent substantial liabilities that should command attention from corporate compliance departments and tech executives making content moderation investment decisions. However, critics have questioned whether such fines adequately deter multinational platforms with global revenues exceeding billions, suggesting that Malaysia may eventually need to escalate enforcement tools such as service restrictions or licence suspension for persistent violators.
The parliamentary disclosures came in response to questions from both government and opposition MPs, indicating that deepfake regulation has transcended partisan divides to become a shared concern across Malaysia's political spectrum. Datuk Seri Ismail Sabri Yaakob from the Barisan Nasional coalition and Syed Saddiq Syed Abdul Rahman from the Muda opposition party both pressed the government for action, suggesting that voters and lawmakers across the political divide increasingly view AI-generated deception as a threat to democratic integrity and social cohesion. This consensus may provide political cover for further regulatory expansion if current measures prove insufficient.
The deepfake crisis reflects broader regional trends across Southeast Asia, where inadequate digital literacy and platform market concentration have created conditions for synthetic media to flourish. Malaysia's approach—combining statutory obligations, active monitoring, technical assistance to law enforcement, and meaningful penalties—offers a template that neighbouring countries are watching closely. Thailand, Indonesia, and the Philippines all face similar challenges but have moved more slowly to implement comprehensive regulatory frameworks. Malaysia's early action positions it as a regional leader in digital governance, though questions remain about implementation consistency and whether platforms will comply in spirit rather than merely form.
Looking forward, the government faces mounting pressure to stay ahead of rapidly evolving deepfake technology. Detection systems trained on existing synthetic content become less effective as creation tools improve, creating an arms race dynamic that regulatory bodies must match with sustained technical investment and expertise. The MCMC's reliance on platform cooperation assumes that social media companies will prioritise digital integrity over engagement metrics, an assumption that history repeatedly suggests may be misplaced. Some analysts argue that Malaysia may eventually need to establish a dedicated deepfake investigation unit with independent forensic capabilities rather than depending on platforms' own detection infrastructure. The journey from 917 complaints to nearly 8,000 in less than two years suggests that unless enforcement and detection capabilities accelerate further, the problem will likely continue expanding despite current interventions.
