Malaysia targets criminal VPN misuse, but legal use remains permitted

Full text

Malaysia beefs up action against VPN used to facilitate crimes

Misuse includes bypassing the new under-16 social media ban

Officials have stressed that owning or using a VPN is not an offence

Malaysia is set to take action if VPN are used to facilitate criminal activities or help residents bypass the new social media age limit.

According to local reports , Deputy Home Minister Datuk Seri Dr Shamsul Anuar Nasarah said the government is working closely with the Malaysian Communications and Multimedia Commission (MCMC) to counter VPNs and borrowed identities that are being used to slip past newly enforced social media age limits.

For the many people who reach for the best VPN services to protect their browsing, encrypt their traffic, or simply keep their data out of advertisers' hands, the reassuring takeaway is that the tool itself is not the target. What the authorities want to reach is the small share of activity where a VPN is used as a shield for something illegal.

What Malaysia actually announced

The comments came during a question-and-answer session on cybercrime and age verification. Shamsul Anuar explained that police would draw on public complaints and their own investigations to identify cases where VPNs or identity-masking tools are being abused, and that such misuse could be treated as an added element of an offence.

He was clear that the crackdown is aimed at conduct, not software. The minister framed the effort as part of Malaysia's wider push to protect children online, pointing to a sharp rise in offences.

This sits on top of Malaysia's under-16 social media ban , which took effect on 1 June 2026 under the Online Safety Act 2025. Large platforms including Facebook, Instagram, TikTok, and YouTube must now verify users' ages and block under-16s from registering, with non-compliance carrying penalties reported at up to RM10 million.

VPNs enter the picture because they are an obvious way to make it look as though a user is somewhere the rules do not apply. Age verification laws elsewhere, such as Australia and the UK , have repeatedly triggered spikes in VPN sign-ups, with many often being adults looking to protect the sensitive documents these systems ask them to hand over.

What it means for everyday VPN users

For most people, this is not a reason to stop using a VPN, and it is not a ban in disguise.

Digital rights groups, however, have been sharply critical of the age-verification model underpinning the ban.

ARTICLE 19 , alongside local partners, has argued the measure was rushed, is disproportionate, and risks normalising surveillance while exposing people's identity documents and biometric data to misuse.