AGE VERIFICATION ID: MALAYSIA
Your teen opens TikTok at 9 at night. The app asks for a scan of your ID. Not a checkbox. A photo of your national card. Then a live look at your face. Malaysia made that real on June 1, 2026. Every social media user must prove their age this way. Adults must do it too. A US firm ran the same kind of check. Hackers watched every scan for over a year. Nobody caught them until it was done.
70 civil groups asked Malaysia to stop. They said the risk is too big. Hold that number in your head.
Your teen taps verify on the app. The app opens a live camera scan. The scan checks their face against MyKad records. A yes or no goes back to the app.
Malaysia set June 1, 2026 as the start date. Every platform must comply. The rule covers all users under 16.
You tap verify to keep scrolling. MyDigital ID logs your face and your card. A vendor stores that match result. Your national ID now sits in a private database.
The design sounds careful. But one US firm shows what careful still misses.
Malaysia passed the Children's Protection Code in 2025. Platforms got notice to prepare. The rule went live on June 1, 2026. Civil groups filed their objection that same month.
The government made its case plainly. A click saying I am 18 stops no one. So a real ID check is the only fix.
One vendor holds a lot after that check. Names and addresses sit in one place. ID photos and face scan results too. That pile is what a hacker wants.
Malaysia has 33 million people. One breach hits all of them. That is not a data leak. That is a nation's IDs gone.
If this helps, a like and a subscribe help us keep it coming.
This is not just Malaysia's problem. A US firm already lived this story. The breach ran for over a year unseen.
A click check costs nothing to fake. A card check costs your real ID. A click check takes 0 days to breach. A card check gives hackers 365 days of data. Your ID is not a checkbox.
Techdirt reported the breach ran for over a year. Hackers had a live feed of every scan. No one at the firm saw them. The feed ran for more than 12 months.
Hackers did not grab a file and run. They watched every scan in real time. Every new ID that came in, they saw it.
One breach can expose names and home addresses. ID numbers and face scans go with them. Every adult on the platform pays that price.
Techdirt broke the US breach story first. The CaraComp write up on this breach links that report. Both sources say the same facts. Every line here comes from those two.
The app only gets a yes or no. That felt safe. But the vendor still holds your full scan. The yes or no was never the whole picture.
You cannot opt out of Malaysia's law. But you can ask the right question tonight.
So what do you do right now? Ask the platform how long it keeps your scan. Look for that answer in plain writing. No clear answer is your answer.
A stolen password can be reset in 1 day. A stolen face scan cannot be reset at all. Only you can change a password. No one can change your face.
Your teen taps verify on the app. MyDigital ID sends the scan to the vendor. The vendor checks the face against MyKad. The result logs in a private database. That database is what a thief targets. One breach and your whole family is in it.
The CaraComp write up on this breach goes deeper on what to do. It names the vendor and the law. Read it before your family gets asked to scan.
The Center for Democracy and Technology flagged this clearly. Safe age checks that delete your data right away are not ready yet. They are still years from wide use.
Three things to do this week. Ask the app how long it keeps your data. Find out if a third party stores your scan. Tell your teen what a liveness check actually does.
More than 70 groups asked Malaysia to pause the plan. They want safer tools first. The ask is still open today.
Malaysia said the check protects kids. It does, if the vendor never fails. But one vendor breach ends that promise for every family on the platform.
Open the app's privacy page right now. Find the line that names the third party vendor. Look for how long that vendor keeps your scan. No answer on that page means no safe scan.
A face scan is not a password. No one can reset your face. Keep that at breakfast.
Every day we take one story like this and make it simple. Subscribe and tap the bell. Tomorrow's is free too. See you in today's briefing.
