Section 233 After Heidy Quah: When an Online Post Becomes a Crime

Readers who remember the headlines of August 2025, when the Court of Appeal struck down part of section 233 of the Communications and Multimedia Act 1998 (CMA), should know that this is no longer the position. On 6 February 2026 the Federal Court, in Government of Malaysia v Heidy Quah Gaik Li, unanimously reversed that part of the ruling. The words offensive and annoy remain in the offence, but the court said it must be applied narrowly. In the meantime Parliament has amended the section, and the Online Safety Act 2025 has come into force.

From a Facebook post to a constitutional challenge

In June 2020 Heidy Quah, the founder of a refugee non-governmental organisation, posted on Facebook about conditions at an immigration detention centre during the Covid-19 pandemic. In 2021 she was charged under section 233(1)(a) of the CMA with making an offensive communication with intent to annoy. In April 2022 the Sessions Court found the charge defective and granted a discharge not amounting to an acquittal.

Separately, she asked the civil courts to declare the words offensive and annoy in section 233(1)(a) unconstitutional. The High Court dismissed that challenge in September 2023.

Struck down in 2025, restored in 2026

On 19 August 2025 the Court of Appeal allowed her appeal. It held the two words inconsistent with Articles 8 and 10 of the Federal Constitution (equality before the law and freedom of expression): they were vague, supplied no objective standard and could criminalise even true speech. The ruling was to operate prospectively only.

The Federal Court allowed the Government’s appeal in part and held the words constitutional. In its view Article 10(1)(a) does not protect communications whose character and purpose is to cause harm, and section 233(1)(a) is aimed at misuse of networks: harassment, doxxing (publishing a person’s private details) and racially or religiously derogatory abuse. At the same time, the provision must be applied narrowly. As for Heidy Quah herself, the court said that her post, fact and opinion on a matter of public concern, was protected expression, and that section 233(1)(a) should not have been used against her.

Reading the narrowed test with care

Published accounts describe the narrowed test in different words. The court’s press summary speaks of reading the section down so that the prosecution must prove an express intent to annoy. One law-firm commentary describes two limbs: the objective character of the communication in its context, and the sender’s intent, meaning a dominant purpose of causing real distress or harm that cannot simply be inferred from the content. On that account, communications made for political discourse, public interest, education or satire fall outside the offence.

The two accounts are compatible, and what they share is the practical core: intent is a real element that the prosecution must prove, and honest comment on public affairs is not the target. Anyone who needs the precise formulation should consult the full grounds of judgment.

The 2025 amendments and the Online Safety Act

The Communications and Multimedia (Amendment) Act 2025 was gazetted on 7 February 2025, and most of its provisions took effect on 11 February 2025. As summarised in published commentaries, it replaced offensive with grossly offensive; raised the maximum penalty from RM50,000 or one year’s imprisonment or both to RM500,000 or two years or both; provided a heavier penalty where the offence is committed against a child; added Explanations, one of which indicates that good-faith statements of true fact and statements of opinion are not grossly offensive; and moved spam into a new section 233A. One commentary suggests the Federal Court’s reasoning applies equally to the amended wording. The Act itself should be checked before relying on these points.

The Online Safety Act 2025 took effect on 1 January 2026. It imposes duties, including risk mitigation, user guidelines and reporting and response mechanisms, on licensed service providers; social-media and messaging platforms with eight million or more Malaysian users are deemed licensees. Penalties run up to RM10 million. The Act works through nine categories of harmful content. In the published summaries we have seen, defamation is not among them.

Where defamation fits

Civil defamation and criminal liability are separate tracks. The same post may bring a letter of demand and a civil suit for damages; a complaint to the Malaysian Communications and Multimedia Commission (MCMC) or the police under section 233; and, in principle, a prosecution for criminal defamation under sections 499 and 500 of the Penal Code, punishable with up to two years’ imprisonment, a fine or both. Falsity remains one of the characteristics listed in section 233, so sharing fabricated claims about a person with intent to harass is caught. A criminal complaint does not, however, produce damages for the person defamed.

Practical takeaways

• After Heidy Quah, honest fact and opinion on matters of public concern should not be prosecuted under section 233(1)(a). Abusive, harassing or hate-driven posts remain squarely within it, now with a maximum of RM500,000 or two years’ imprisonment or both.

• Anything written on the footing that the two words were struck down is out of date.

• Do not forward fabricated claims about a named person. That can be a crime as well as a civil wrong.

• Business owners targeted online: a police report or MCMC complaint can run alongside a civil claim but will not yield compensation. Decide which outcome you need.

• Group and page admins: the Online Safety Act puts its duties on the large platforms, not on you. It gives users a statutory reporting route for content such as threats and harassment but, on the summaries available, not for ordinary defamation.

Status

The Federal Court’s decision is final. Some civil-society groups continue to call for the repeal of section 233; another view is that the provision, narrowly applied, is needed to deal with online abuse.

Authorities and sources

• Government of Malaysia v Heidy Quah Gaik Li [2026] MLJU 384 (Federal Court, 6 February 2026)

• Heidy Quah Gaik Li v Government of Malaysia (Court of Appeal, 19 August 2025)

• Communications and Multimedia Act 1998, sections 233(1)(a) and 233A; Communications and Multimedia (Amendment) Act 2025; Online Safety Act 2025 (Act 866); Penal Code, sections 499 and 500; Federal Constitution, Articles 8 and 10

• Federal Court press summary, 6 February 2026; commentaries by LHAG, Yew Huoi, How & Associates, Christopher & Lee Ong, Baker McKenzie, Nazmi Zaini Chambers, AmerBON, Rahmat Lim, Rödl, Richard Wee Chambers and RDS Law Partners; statement by ARTICLE 19

• Malay Mail, 19 August 2025; The Star, 11 February 2025; Bernama (reports on the amendments and on the Federal Court’s decision)

This article is general legal information only and is current as at 19 September 2026. It is not legal advice and does not create a solicitor-client relationship. Court decisions may be appealed and the law may change; please seek advice on your own circumstances. — Chris & Partners, Advocates & Solicitors