The Online Safety Act Does Not Cover WhatsApp Messages Sent To You. Other Laws Do.

If messages are frightening you, help is available now.

• Talian Kasih 15999 — 24 hours. WhatsApp 019-261 5999
• WAO 03-3000 8858 — TINA WhatsApp 018-988 8058
• AWAM 03-7877 0224
• Talian HEAL 15555 — mental health, 8am–midnight
• Befrienders KL 03-7627 2929 — 24 hours
• Emergency: 999 · Scams: NSRC 997 You are not overreacting. Repeated unwanted contact is recognised as a criminal offence in Malaysia. In a WAO poll of 1,008 respondents, 88% reported experiencing at least one act related to stalking. Before you block: screenshot everything. Blocking can cut off your access to the message history you will need.

Here is something worth knowing before you report a problem to the wrong place.

Malaysia's Online Safety Act 2025 came into force on 1 January 2026 — and it does not apply to private messaging.

That is not an oversight in reporting; it is stated repeatedly and consistently. ONSA does not impose obligations on individual users, does not apply to private messaging features, and does not authorise general monitoring of users. Practitioner analysis lists private messaging as "a notable exclusion under the Act."

So if someone is sending you abusive WhatsApp messages, ONSA is not your route. The platform duties that apply to a public Facebook post do not apply to a one-to-one chat.

What does apply: the Penal Code and the Communications and Multimedia Act — and they cover this conduct properly.

One live development. In July 2026 the Communications Minister told Parliament that proposed regulations governing private-messaging features were undergoing public consultation until 20 July 2026, as the last of ten subsidiary instruments under ONSA. We could not verify whether those regulations have been made or what they contain — check the current position.

1. Section 507A — the stalking provision

The offence: whoever repeatedly, by any act of harassment, intending to cause, or knowing or ought to know that the act is likely to cause, distress, fear or alarm to any person or to the person's safety, commits the offence of stalking.

"Acts of harassment" under s.507A(2) — a non-exhaustive list, so the Court can interpret it case by case:

• following or tracking a person in any manner or by any means
• communicating or attempting to communicate with a person in any manner or by any means
• loitering at the person's residence or place of business
• giving or sending anything to a person in any manner or by any means

The second limb is the one that covers messaging. "Communicating or attempting to communicate… in any manner or by any means" plainly reaches WhatsApp, Telegram, SMS and DMs.

The "at least twice" requirement. To establish stalking, the offending behaviour must have been repeated on at least two occasions, the victim must have been disturbed by it, and they must be in a state of stress or fear as a result.

Three points people get wrong:

• It applies to online as well as physical stalking. Parliament passed it as covering both.
• You do not need to know who the stalker is. The section does not require the victim to know the stalker's identity.
• The stalker's actions need not actually have caused distress. It is enough that they knew or ought to have known their actions were likely to cause distress, fear or alarm.

Penalty: imprisonment up to three years, or a fine, or both.

Why it exists. Before 2023 there was no adequate Malaysian offence covering the pattern of ongoing conduct — existing laws treated each act separately, which missed the point of stalking. The provision followed the case of photographer Acacia Diana, whose stalker harassed her for nearly eight years, including tracking her to the UK. The first person charged under the new law was reported as Muhammad Safiq Rosli, 37.

2. Protection orders — section 98A CPC

This is the practical remedy most victims want and few know exists.

The Criminal Procedure Code was amended alongside the anti-stalking law to insert a new Chapter XA and s.98A, empowering the courts, on application, to issue a Protection Order against a person who is under investigation for, or has been charged with, stalking under s.507A.

What it does: it stops the perpetrator from further stalking you or coming near you.

Why this was significant: before the amendment, a protection order was in practice only available to divorced couples. WAO welcomed the change as giving victims a route to redress they did not previously have.

How to get one: apply to the Court. You will want a lawyer, and your police report is the foundation — the order is available against a person under investigation, so the report comes first.

3. Criminal intimidation — ss.503 and 506

Section 503 defines criminal intimidation. Section 506 provides the punishment.

Use this where the messages contain threats — to your person, reputation or property, or to someone you care about — intended to cause you alarm or to make you do or not do something.

Note the practical point: criminal intimidation does not require repetition. A single sufficiently serious threat can be an offence, where stalking under s.507A requires at least two occasions.

Section 509 covers words or gestures intended to insult modesty.

4. Section 233 CMA — the electronic communications route

s.233(1) covers making, creating, soliciting or initiating the transmission of any comment, request, suggestion or other communication which is obscene, indecent, false, menacing or grossly offensive in character, with intent to annoy, abuse, threaten or harass another person.

Following the 2025 amendments (gazetted 7 February 2025, in force 11 February 2025):

• penalty raised to RM500,000 and up to 2 years
• "offensive" became "grossly offensive", with explanatory notes added
• a heavier penalty where the offence involves a child under 18: RM500,000 and/or 5 years, plus a further fine of RM5,000 for each day the offence continues after conviction

An important caveat. Section 233 is under active constitutional challenge — the Court of Appeal held the pre-2025 wording unconstitutional in August 2025 and the Federal Court partly reversed that in February 2026. It remains in force and prosecutions continue, but do not treat it as a settled route. See (Someone Leaked Your Intimate Images. In June 2026 A Malaysian Court Upheld RM60,000 Against A Man Who Did That.).

5. If it is sexual harassment — TAGS may be better than the police

This is the choice most people do not know they have.

The Tribunal for Anti-Sexual Harassment (TAGS), established 8 March 2024 under s.3 of the Anti-Sexual Harassment Act 2022 (Act 840), hears complaints of sexual harassment occurring in Malaysia on or after 8 March 2024.

"Sexual harassment" under ASHA means any unwanted conduct of a sexual nature, in any form — verbal, non-verbal, visual, gestural or physical — committed against another individual which is offensive, humiliating or threatening. Messages plainly fall within "verbal" and "visual".

TAGS awards are enforceable. On 10 June 2026 the Kuala Lumpur High Court upheld a TAGS award of RM60,000 plus a written apology and counselling against a man who shared his ex-girlfriend's intimate images — the first TAGS decision challenged in court, and the challenge failed.

You can use both routes. TAGS is separate from a police report.

6. Preserving WhatsApp evidence properly

Do this before you block, report or delete anything.

The mistake people make: blocking first. Depending on your settings and device, blocking can remove your ability to see the profile, the number and sometimes the history you need.

The method:

1. Screenshot each message individually, making sure the screenshot shows: - the sender's number or contact name at the top - the date separator and the timestamp on the message - the message itself in full — scroll and take overlapping screenshots for long ones
2. Screenshot the contact's profile — number, display name, profile photo, "last seen" if visible.
3. Export the chat. WhatsApp's built-in export produces a dated text file of the whole conversation — far more complete than screenshots and much harder to dispute. Export with media if the messages include images or voice notes.
4. For group chats, screenshot the group name, description and participant list as well.
5. Do not edit, crop or annotate anything you are keeping as evidence.
6. Save in two places: on a device you control and in a cloud account with a password the sender has never had.
7. Keep a written log: date, time, what was sent, how it made you feel, whether anyone else saw it.
8. Note any witnesses — people in the group, or friends you showed the messages to at the time.

Do not reply to gather evidence. You do not need to bait a confession, and replying can complicate your position.

If you are being asked for money or images to stop the messages, that is extortion — a separate and serious offence. Do not pay. Preserve everything and report.

7. Block or report?

Both, in the right order.

A word on new numbers. Repeated contact from changing numbers strengthens a stalking case rather than weakening it — it evidences persistence. Preserve each one.

What to actually do

Right now: 1. Preserve the evidence — export the chat, screenshot with timestamps and sender visible. 2. Tell someone. Talian Kasih 15999, WAO 03-3000 8858, TINA 018-988 8058. 3. Do not pay anyone demanding money.

Then: 4. Lodge a police report. Bring your exported chat and screenshots on a device and, if you can, printed. Say clearly if the contact has been repeated and roughly how many times — the "at least twice" threshold matters for s.507A. 5. Ask about a protection order under s.98A CPC. It is available against someone under investigation for stalking. 6. Consider TAGS if the conduct is sexual harassment occurring on or after 8 March 2024 — file through e-TAGS. Compensation up to RM250,000, on the balance of probabilities. 7. Get legal advice. Bar Council Legal Aid Centres: malaysianbar.org.my.

If the person sending them is a partner, ex-partner or family member, the Domestic Violence Act 1994 may also apply, and WAO and AWAM can advise on that specifically.

If the recipient is a child, the position is more serious — s.233 CMA carries a heavier penalty where a child under 18 is involved, and other child protection provisions apply. Report immediately and call Talian Kasih 15999.