Experts fear data breaches, weak enforcement in child protection code

MALAYSIA’S newly enforced Child Protection Code (CPC) is facing growing scrutiny from experts who caution that stronger online safeguards for children could unintentionally create fresh cybersecurity and privacy threats unless enforcement, accountability and digital education are significantly strengthened.

While the framework has been welcomed as a necessary response to escalating online risks faced by minors, specialists say the effectiveness of the policy will ultimately depend on whether authorities can ensure robust oversight of social media platforms and prevent sensitive personal data from being compromised.

Consultant paediatrician and child disability activist Amar Singh HSS tod The Star that stricter online controls were increasingly important as children became more deeply immersed in digital platforms at younger ages.

However, he warned that aggressive age-verification mechanisms could also create dangerous concentrations of highly sensitive personal information vulnerable to cyberattacks and misuse.

“The concern with robust age verification is that platforms must collect more highly sensitive data. These become high-value targets for hackers,” he said.

Dr Amar explained that many verification systems may require parents or children to submit official identification documents such as MyKad records, passports or facial biometric scans, dramatically increasing the amount of confidential data stored by technology companies.

He noted that Malaysia’s history of recurring data leaks and cybersecurity breaches had already weakened public confidence in digital protection systems.

“We do not have a track record locally of good security with several data breaches,” he said, adding that the responsibility now falls on social media operators to ensure strong data security measures are in place.

Nevertheless, he questioned whether independent supervision and auditing mechanisms currently existed to verify whether platform operators were genuinely capable of protecting such sensitive information.

“Yes, the onus is on social media operators to ensure data security, but who will monitor the quality of their security?” he said.

Cybersecurity expert Fong Choong Fook said the Child Protection Code represented an important regulatory shift, but stressed that enforcement could not depend solely on voluntary compliance by digital platforms.

“Apart from regulations, there should also be a task force or watchdog to supervise execution by the platform operators,” he said.

Fong, who leads LGMS Bhd, also warned that technologically adept younger users could still bypass many restrictions despite tighter regulatory controls.

“The younger generation is quite creative,” he said.

He stressed that parental guidance remained one of the most effective safeguards against harmful online behaviour, arguing that regulations alone would not be enough to cultivate responsible digital habits among children and adolescents.

Fong added that electronic Know-Your-Customer (eKYC) systems could improve age verification and strengthen enforcement, but acknowledged that the use of such systems also heightened concerns about privacy and the sharing of official documents with commercial technology providers.

Beyond enforcement and cybersecurity, he argued that Malaysia’s broader education system needed reform to better prepare children for responsible engagement with social media and digital technology.

“We often overlook the importance of restructuring the education system in shaping the correct values among the younger generation to use social media platforms safely,” he said.

Meanwhile, early childhood education advocate Chiam Heng Keng cautioned that imposing age restrictions alone would not automatically produce responsible or emotionally mature social media users.

“Parents still play a critical role in helping children develop self-regulation, decision-making skills and healthy digital habits at a young age,” she stressed.

Chiam also questioned whether sufficient accountability and monitoring structures had already been implemented to ensure effective compliance by digital platforms under the new regulatory framework.

“I wonder whether the monitoring procedures are in place and what the accountability measures of the platforms are,” she said.

The debate surrounding the Child Protection Code reflects wider international concerns over balancing child safety with privacy rights in an increasingly data-driven digital environment.

Although the framework is regarded as one of Malaysia’s strongest recent attempts to regulate online safety for minors, analysts say its credibility and effectiveness will depend heavily on enforcement transparency, cybersecurity resilience and long-term cooperation between government agencies, technology companies, schools and parents. - May 23, 2026