
MAY 15 — In November 2025, leaked internal Meta documents revealed that the platform was deriving substantial revenue from advertising activities linked to online scams and prohibited goods.
These revelations found that Meta had failed to prevent the dissemination of approximately 15 billion “high-risk” advertisements to users each day, generating an estimated US$7 billion (around RM29 billion) in annualised revenue from ads exhibiting clear indicators of fraud.
The problem appears to have been further exacerbated by Meta’s advertising personalisation engine, which systematically amplifies users’ exposure to fraudulent content.
Rather than functioning as a protective mechanism, the system uses prior engagement signals to optimise and deliver additional high-risk advertisements, effectively transforming victims into prime targets for repeated scams.
Notwithstanding Meta’s unsatisfactory explanation, an important question arises as to what extent the newly enforced Online Safety Act 2025 can provide effective protection and remedies for the RM2.77 billion in losses arising from financial scams last year.
The sharp rise in both the number of cases and the resulting losses calls for a careful examination of advertising practices.
In an era where digital deception evolves as rapidly as the technology it inhabits, the public law injunction has emerged as a critical tool for regulatory bodies to protect the collective interests of online users.
While private litigation addresses individual harm, public law enforcement focuses on the prevention of systemic unfair commercial practices that threaten users’ safety and economic stability.
The Online Safety Act 2025 (the Act) imposes obligations on social media and messaging platforms with over 8 million users in Malaysia, classifying them as licensees required to comply with the law.
The Act includes measures to mitigate the risk of exposure to harmful content (Section 13), issue guidelines to users (Section 14), enable users to manage their online safety (Section 15), provide mechanisms for reporting harmful content (Section 16) and user assistance (Section 17), protect the online safety of child users (Section 18), establish procedures to make priority harmful content inaccessible (Section 19), and prepare an Online Safety Plan (Section 20).
In addition, the Act also specifies the actions that must be taken by the licensees to ensure compliance and effective implementation of these provisions.
The Online Safety Committee has the power to instruct the platforms to make the harmful content permanently inaccessible on its service to all users upon determination of the harmful content.
Non-compliance with the Act carries a maximum financial penalty of RM10 million (Section 39).
The Online Safety Act 2025 provides a systemic risk management framework and platform accountability framework for content policing.
Public law injunction has been a cornerstone of consumer protection and market regulation for decades, serving as a means to stop harmful commercial practices and malpractice. — Picture via Pexels
Despite its novelty in implementing safety by design, which requires social media and messaging platforms to submit annual online safety plans to the Malaysian Communications and Multimedia Commission (MCMC).
Relying on platforms’ online safety plans has limitations in preventing scam advertising because these plans often prioritize automated filtering over human oversight, allowing sophisticated scammers to bypass detection using AI-generated content.
Furthermore, since these plans are self-reported, they may lack the transparency needed for regulators to verify if the safety protocols are being strictly enforced in real-time.
Finally, the reactive nature of most safety plans means that fraudulent ads are often only removed after the financial damage has already occurred, highlighting the need for more aggressive public law injunctions to stop scams at the source.
Public law injunction has been a cornerstone of consumer protection and market regulation for decades, serving as a means to stop harmful commercial practices and malpractice.
Changes in design, safety plans from reporting, investigations, evidence gathering, and procedures in ensuring compliance take time and often allow fraudulent campaigns to achieve their maximum impact before any regulatory action is finalised.
While internal platform safety plans are essential for long-term systemic health, they are fundamentally slow-moving administrative processes that struggle to keep pace with the agility of modern scammers.
To bridge this gap, authorities should utilise public law injunction as a rapid-response mechanism.
Unlike the lengthy audit cycles of an Online Safety Plan, an injunction serves as an immediate “emergency brake”, allowing regulators to bypass procedural delays and legally compel platforms to freeze scam accounts or remove deceptive advertisements in real-time.
By deploying injunction alongside statutory investigations, it can prevent widespread financial loss while the more time-consuming work of evidence gathering and compliance auditing continues in the background.
In the landmark case of Zschimmer & Schwarz GMBH & Co. KG Chemische Fabriken v Persons Unknown and Mohammad Azuwan bin Othman (t/a Premier Outlook Services) 7 MLJ 178, the Malaysian high court had established a precedent for granting injunctions against “Persons Unknown”.
Utilising public law injunctions against “Persons Unknown” to combat anonymous cybercrime and scam advertising should serve as an immediate priority, allowing for the immediate freezing of the advertising scam, while awaiting the Online Safety Act 2025 transitions into full operation.
* The author is a Senior Lecturer at the Faculty of Law, Universiti Malaya and can be reached at tzechinong@um.edu.my
** This is the personal opinion of the writer or publication and does not necessarily represent the views of Malay Mail.