When Pixels Lie: The Legal Minefield of AI-Generated Content in Malaysia

Media & Journalism Calculating...

JoeGetz
01 Jul 2026
44
SubCategory | Fact-Checking

When Pixels Lie: The Legal Minefield of AI-Generated Content in Malaysia

by JoeGetz | 01 July 2026

The video looks real. The voice sounds authentic. The meme is hilarious—or devastating. But none of it happened.

We are entering an era where seeing is no longer believing. AI-generated videos, posters, and memes are flooding Malaysian social media, and the consequences are no longer theoretical. From deepfake scams impersonating the King and Prime Minister to AI-manipulated content that inflames racial and religious tensions, the technology has outpaced both public awareness and, in some cases, the law ^1,4.

The question is no longer if this content will harm someone. It's when, and whether our legal system is ready to protect the innocents caught in the crossfire.

The Scale of the Problem: An Eightfold Surge

Let's start with the numbers, because they tell a story of a crisis accelerating faster than our response.

The Malaysian Communications and Multimedia Commission (MCMC) received 7,967 complaints about deepfake content in just the first half of 2026—an eightfold increase from the 917 complaints recorded in all of 2024 ^9,10. Between January and mid-August 2025 alone, MCMC identified 439 pieces of deepfake content with fraudulent elements and successfully removed 417 of them ³.

Over the broader period since 2024, more than 11,600 items of false or AI-generated content have been taken down ⁹.

This isn't a fringe issue. It's a systemic failure of platform moderation and a vulnerability being ruthlessly exploited.

When the King Becomes a Target: The 3R Crisis

The most alarming case study emerged in May 2026, when a fake TikTok account impersonating His Majesty Sultan Ibrahim, the Yang di-Pertuan Agong, used AI technology to spread deeply offensive content ^4,6.

Among the posts was a video falsely claiming that the King "enjoyed eating pork"—a statement that the Johor Royal Press Office described as "untrue and touching on sensitivities, given that His Majesty was a Malay Ruler and the Muslim Head of State" ⁴. Another image superimposed the monarch's face onto an animal's body ⁷.

The MCMC issued a formal warning to TikTok, accusing the platform of failing to take "sufficient and timely action" against the offensive content ⁷. The regulator found that the posts may violate Section 233 of the Communications and Multimedia Act 1998 and other provisions of the Penal Code ⁷.

Johor Menteri Besar Datuk Onn Hafiz Ghazi condemned the account, stating that "freedom of speech cannot be used as a pretext to spread slander, hatred, and insults against the royal institution" ⁷.

This case demonstrates precisely how AI-generated content can weaponise the sensitive 3R issues—race, religion, and royalty—that define Malaysia's social contract.

The Legal Arsenal: What Do We Actually Have?

So, is the law adequate? The answer is complicated.

The Existing Framework

Malaysia does not yet have a dedicated AI statute. Instead, AI is regulated indirectly through existing laws, policies, and guidelines ¹⁴.

The Sedition Act 1948 remains the primary instrument for addressing insults to the monarchy. Section 3(1)(f) defines a "seditious tendency" as any act that brings "hatred or contempt or excites disaffection against any Ruler or against any government" ⁵.

Section 233 of the Communications and Multimedia Act 1998 criminalises the improper use of network facilities or applications, including the dissemination of offensive content ^4,6.

Section 504 of the Penal Code addresses intentional insult with intent to provoke a breach of peace ⁶.

The Personal Data Protection Act 2010 (PDPA) regulates the processing of personal data, but as we'll discuss, it has significant limitations when it comes to AI ^13,14.

The Gaps

Here's where the problems emerge.

Platform compliance is inconsistent. Between January and August 2025, MCMC submitted 1,602 requests to remove AI-based scam content, but only 1,346 were taken down—a compliance rate of about 84 per cent ¹. Communications Minister Fahmi Fadzil has publicly stated that "social media platforms are not taking online safety issues involving AI content seriously" ¹.

The PDPA doesn't empower victims. Lawyer Foong Cheng Leong, deputy chair of the Bar Council's intellectual property committee, has pointed out that under the PDPA, data subjects are dependent on the commissioner to initiate action on their behalf ^11,12. Victims cannot take private civil action to seek damages or injunctions against those who misused their image or voice. "This may take time," he noted ¹¹.

AI operates outside human oversight. The PDPA principles do not automatically apply to the automated collection, storage, and processing of data by an AI system that can operate without human guidance or instruction ¹³. A generative AI might collect and disclose personal data without the data subject's knowledge or consent, or retain data for "training" without providing a right to access, update, or delete it ¹³.

Copyright law is ill-suited to protect identity. Under the Copyright Act 1987, copyright protects the expression of an idea, not a person's features or likeness ^11,13. As Foong explained, "This (Danish-style proposal to grant rights over one's body and voice) flips the whole fundamental understanding of what is copyright. The entire copyright law will need to be changed... It would cause more chaos in the law rather than giving an advantage" ¹¹.

Enforcement is inconsistent. Analysts like University of Tasmania Professor Dr James Chin have noted that public perception of selective action has weakened trust in authorities ⁵. Universiti Sains Malaysia's Prof Dr Azeem Fazwan Ahmad Farouk added that "perpetrators will be able to get away most of the time" ⁵.

The Online Safety Act 2025: A New Dawn?

The government has enacted the Online Safety Act 2025 (Act 866), which is expected to come into force by the end of 2026 or early 2027 ^1,8.

Key provisions include:

Mandatory labelling of AI-generated content. Platforms will be required to use labels such as "AI Generated" or "AI Enhanced" on AI images or content ^1,2,8.

Risk Mitigation Codes (RMC). Licensed social media platforms must now implement risk mitigation measures specifically targeting AI-generated content ^9,10. Platforms that fail to meet their obligations can be prosecuted and, if convicted, face a fine of up to RM1 million, with additional financial penalties of up to RM10 million ⁹.

Online safety plans. Service providers must submit safety plans proving their compliance with obligations under Act 866 ^1,3.

An Online Safety Committee managed by the Minister in the Prime Minister's Department (Law and Institutional Reform), including representatives from multiple stakeholders ³.

This is progress. But let's be honest—labelling is a transparency measure, not a prevention mechanism. It helps users identify AI-generated content, but it doesn't stop bad actors from creating it in the first place.

What's Missing? The Gaps That Remain

Civil recourse for victims. The PDPA still lacks provisions allowing individuals to sue for damages when their image or voice is misused in AI-generated content. This is a fundamental gap.

Definition of "inventor" or "creator" for AI. Under the Patents Act 1983, the concept of an "inventor" appears to assume a human person who can conceptualise ideas, have a name, address, or sign a declaration ¹³. This creates the same dilemma for determining authorship and ownership of AI-generated content under the Copyright Act ¹³.

Dedicated AI legislation. Malaysia still lacks a comprehensive AI-specific statute. The Malaysian Artificial Intelligence Governance Framework (MAIGF, 2021) remains non-binding guidance rather than enforceable law ¹⁴.

Cross-border enforcement challenges. When content is generated outside Malaysia or hosted on foreign platforms, enforcement becomes exponentially more difficult. The MCMC's takedown success rate of 84 per cent suggests platform cooperation is still far from perfect ¹.

Circumventing the Problems: A Multi-Pronged Approach

How do we protect the innocents and hold perpetrators accountable?

For Lawmakers

Amend the PDPA to allow private rights of action for misuse of image, voice, and likeness in AI-generated content. As Foong has argued, data subjects should be able to seek injunctions, damages, and takedown orders ¹¹.

Enact a specific AI law that addresses liability for AI-generated harm, including provisions for criminalising the malicious use of synthetic media ¹¹.

Strengthen cross-border cooperation with ASEAN partners to create regional standards for AI content regulation ².

Establish expedited takedown processes for verified deepfake victims, particularly for vulnerable groups ¹¹.

For Platform Providers

Mandatory advertiser verification. Licensed platforms are now required to verify advertiser identities through agencies such as the Companies Commission of Malaysia to prevent fake accounts from being used for fraudulent activities ⁹.

Proactive AI detection using automated tools to identify and flag manipulated content before it goes viral. As cybersecurity practitioner Murugason R Thangaratnam has noted, "while technological detection tools have a role, they are inherently reactive; safeguarding the fundamental right to control one's image and identity demands proactive legal measures" ¹¹.

Full compliance with takedown requests. The current 84 per cent compliance rate is unacceptable. Platforms must be held to account for content hosted on their services.

For Platform Users

Verify before you share. Does the video seem too outrageous to be true? Look for AI-generated labels. Check multiple sources. Don't be the vector for viral disinformation.

Report suspicious content to MCMC through official channels.

Demand accountability from influencers and content creators who circulate deepfakes for likes and followers. As Communications Minister Fahmi Fadzil has repeatedly emphasised, platforms and users alike have a responsibility not to allow deepfake content to spread unchecked ⁸.

Exercise caution when posting content on social media, particularly on matters involving 3R issues ^4,6. The CID has made it clear they "will not compromise on matters that could threaten public safety and order" ⁶.

For Law Enforcement

Consistent and transparent enforcement. As Dr James Chin has noted, public perception of selective action weakens trust in authorities ⁵. All offenders—regardless of political affiliation or social status—must face the same legal consequences.

Strengthen digital forensic capabilities. MCMC has indicated it provides technical assistance, including profiling information and digital forensic analysis, to support enforcement agency investigations ⁹.

Holding Perpetrators Accountable

The legal mechanisms exist—at least in part—to hold perpetrators responsible.

Under existing laws, individuals who create or circulate deepfakes that insult the monarchy can face prosecution under the Sedition Act, Section 504 of the Penal Code, and Section 233 of the Communications and Multimedia Act ^4,6.

In the case of the fake TikTok account impersonating the King, police opened an investigation under all three provisions ^4,6.

For scammers and fraudsters, the Online Safety Act adds another layer of accountability. Platform providers can face fines of up to RM10 million for non-compliance ⁹.

But here's the uncomfortable truth: the vast majority of perpetrators—particularly those sharing content for likes and followers—get away with it. As Prof Dr Azeem Fazwan Ahmad Farouk put it, "These provocations will at times catch the eyes of the regulators but perpetrators will be able to get away most of the time" ⁵.

Viral Content, Viral Harm: The Social Cost

When AI-generated content goes viral, the damage is exponential. The target—whether an individual, a community, or an institution—faces reputational harm that cannot be undone by a simple takedown.

In the case of the King, the deepfake video was "clearly offensive and irresponsible," according to the Johor Royal Press Office ⁷. The fake account was eventually removed, but the harm was already done—the video had circulated, been shared, and been seen by thousands.

For private individuals, the consequences are even more devastating. Imagine your face superimposed onto explicit content, shared widely, with no legal mechanism to stop it or seek compensation. Imagine your voice cloned to create a fraudulent phone call that ruins your reputation.

This is not science fiction. This is happening now.

What You Can Do

Be skeptical. Question everything that seems too outrageous, too coincidental, or too perfectly timed to be true.

Seek labels. Look for "AI Generated" or "AI Enhanced" markers. They're coming. Use them.

Don't amplify. If you suspect content is AI-generated and harmful, don't share it. Don't comment on it. Don't make it viral.

Report it. Use MCMC's official channels to report suspicious content.

Support legislative reform. Demand that your elected representatives strengthen data privacy laws and create private rights of action for deepfake victims.

The AI genie is out of the bottle. We cannot put it back. But we can—and we must—build a legal and social framework that protects the innocent, holds perpetrators accountable, and ensures that technology serves humanity, not the other way around.

The laws we have are a start. They are not enough. The question is whether our lawmakers, our platforms, and our society will rise to the challenge, or whether we will let the pixels lie.

REFERENCES

Disclaimer

The views and opinions expressed in this article are solely those of the author and do not necessarily reflect the official stance of Kritik.com.my. As an open platform, we welcome diverse perspectives, but the accuracy and integrity of contributed content remain the responsibility of the individual writer. Readers are encouraged to critically evaluate the information presented.