Can You Film Strangers and Post Them Online in Malaysia?

Filming another person in a public place is not automatically illegal in Malaysia. The legal risk usually depends on the circumstances, including where the filming took place, whether the person was deliberately targeted, what the recording shows, why it was made and what happens when the footage is posted online.

There is an important difference between someone appearing incidentally in the background of a video and deliberately making a stranger the subject of a prank, filming their reaction and publishing it to thousands of people. The second situation creates considerably more legal risk because the recording and publication are intentional and directed at a particular person.

Is it illegal to film someone in public?

There is no general Malaysian law that makes every photograph or video of another person in a public place unlawful simply because consent was not obtained.

If you are filming a street scene and members of the public happen to appear in the background, that is very different from following one particular person, provoking a reaction and making that person the focus of your content.

The location also matters. A shopping mall, restaurant or café may be open to the public but still be privately owned. The owner can impose filming rules and may require you to stop filming or leave the premises.

The harder legal questions normally arise from the purpose and manner of the recording, and what is subsequently published.

Posting the video can create a separate legal problem

Recording and publishing should be treated as two separate acts.

A video that may have been relatively harmless while sitting on a phone can create very different consequences once it is edited, captioned and uploaded to TikTok, Instagram, Facebook or another platform.

The Communications and Multimedia Act 1998 is relevant to online publication.

Following amendments that took effect in 2025, section 233 applies to certain online communications that are obscene, indecent, false, menacing or grossly offensive, where the required intention, such as an intention to annoy, abuse, threaten or harass another person, is present.

The current maximum penalty under section 233(1) is a fine of up to RM500,000, imprisonment for up to 2 years, or both, together with a further fine for a continuing offence.

This does not mean every embarrassing TikTok video is automatically a criminal offence. Both the nature of the communication and the required intention still have to be established.

In PP v Rutinin Suhaimin [2012] MLRHU 1719, the High Court explained that the prosecution did not have to prove that the person targeted was actually annoyed or abused. The relevant issue included the offender's intention.

For content creators, the practical distinction is important. A stranger appearing naturally in the background is very different from deliberately setting up a situation to humiliate, harass or provoke that person for an online reaction.

What about prank videos?

Prank content creates additional risk because the person being filmed is often not incidental to the video. They are the content.

Suppose an influencer approaches a stranger in a mall, deliberately does something designed to shock or embarrass them, secretly records their reaction, then uploads a close-up of their face together with a mocking caption.

That situation is legally different from filming yourself walking through the same mall while unidentified members of the public happen to pass behind you.

Consent is not the only legal issue. The court or authorities may also look at the purpose of the filming, what was done to obtain the reaction, the editing, captions, accompanying statements, the extent of publication and the harm caused.

Removing the person's name may not solve the problem if the person remains clearly identifiable from their face, voice, uniform, workplace or surrounding circumstances.

Secret recordings can become much more serious

Section 509 of the Penal Code deals with conduct intended to insult the modesty of a person, including intrusion upon that person's privacy.

The section can carry imprisonment of up to 5 years, a fine, or both.

However, it should not be treated as a general prohibition against every secret recording.

The facts matter greatly.

In Pendakwa Raya lwn Nor Hanizam Mohd Noor [2019] MLJU 638, the accused secretly recorded a woman while she was bathing. The recording was subsequently circulated through WhatsApp. The High Court treated the conduct seriously and increased the sentence imposed.

That case involved intimate bodily privacy and an intention relating to the victim's modesty. It should not be read as meaning that every video taken without consent in a public place automatically commits an offence under section 509.

It does show that the law treats secret recording very differently where private or intimate circumstances are involved.

Can the PDPA apply to influencers and commercial content?

Possibly, but the Personal Data Protection Act 2010 does not apply to every person who happens to take a photograph.

The PDPA regulates the processing of personal data in connection with commercial transactions. Following the 2024 amendments, the legislation uses the term "data controller" for persons who control or authorise such processing.

An identifiable person's image may amount to personal data depending on how it is collected, stored and used.

An ordinary individual taking a personal photograph will therefore be in a different position from a business or content operation systematically collecting and using identifiable people's images as part of commercial activity.

For an influencer earning revenue from sponsored or monetised content, the question becomes more significant. Depending on the circumstances, the recording and use of identifiable individuals may be sufficiently connected with commercial activity for the PDPA to require consideration.

Consent is an important part of the PDPA framework, although the Act also contains exceptions and other lawful bases or situations in which processing may be permitted.

The safer approach for commercial creators is therefore to obtain proper consent where an identifiable stranger is deliberately being made part of the content rather than assuming that being in a public place removes all data-protection concerns.

What if the video damages someone's reputation?

A separate risk is defamation.

A video can become defamatory through what is said, the caption placed over it, selective editing or the impression created about the person shown.

The basic issue is whether the publication conveys a defamatory meaning about an identifiable person and is communicated to someone else.

In Christina Liew Chin Jin v Leksun Injil [2021] MLRHU 1020, the High Court dealt with defamatory statements captured in a video that subsequently circulated through WhatsApp and Facebook. The court found that the wider publication was a natural and foreseeable consequence on the facts and awarded damages.

More recently, Nurul Shuhada Bashir v Sara Nurshazana Shahrudin & Anor [2026] MLRHU 331 confirmed that defamatory publication through social media can amount to libel and can be actionable without the claimant having to prove specific financial loss.

For creators, this means the video should be considered as a whole. A recording of someone's genuine reaction does not give the creator a licence to add an untrue caption suggesting that the person is dishonest, immoral, violent or otherwise deserving of public ridicule.

Can you sue simply for "invasion of privacy"?

The position is more complicated than a simple yes or no.

Malaysia does not presently have a clear, general standalone tort of invasion of privacy that applies to every situation where someone feels their privacy has been infringed.

Cases including John Dadit v Bong Meng Chiat & Ors [2015] MLRHU 1351 and Mohamad Izaham Mohamed Yatim v Norina Zainol Abidin & Ors [2016] 1 MLRH 317 rejected a broad standalone privacy cause of action.

Other decisions have recognised protection in narrower circumstances, particularly involving private information, bodily privacy or breach of confidence. The Malaysian authorities are therefore better understood as fact-sensitive rather than creating one general right to sue whenever a person is filmed without consent.

A victim may instead have a more appropriate claim in defamation, breach of confidence or another recognised civil dispute, depending on what was recorded and how it was used.

Can the video be taken down without filing a lawsuit?

Malaysia's Online Safety Act 2025, which came into force on 1 January 2026, creates additional reporting mechanisms for harmful online content.

Under sections 24 and 25, a user may report content believed to be harmful to the Malaysian Communications and Multimedia Commission. If the Commission determines on reasonable grounds that the content falls within the Act, it may direct relevant licensed service providers to make the content permanently inaccessible.

This does not mean every unwanted video qualifies for removal. The content must fall within the statutory framework for harmful content.

A person seeking removal should therefore also consider the platform's own reporting process, a formal demand to the publisher and, where appropriate, other legal remedies.

What should content creators do?

For ordinary background filming in public, the legal risk may be relatively low where no particular stranger is being targeted or portrayed negatively.

The position changes where the content is built around an identifiable stranger.

If you deliberately approach someone, provoke a reaction and intend to publish that reaction commercially or for a large audience, obtaining consent before publication is the safer approach. If consent is refused, blurring the person's face and removing other identifying details can reduce risk, although it does not cure every possible legal issue.

Creators should also avoid misleading captions, selective editing that creates a false impression, intimate recording, harassment and continued filming after the circumstances make clear that the person objects.

Frequently Asked Questions

Can I film strangers in public in Malaysia?

Generally, filming in a public place is not automatically unlawful simply because another person appears in the recording. The risk increases when a particular person is deliberately targeted or the footage is used in a harmful way.

Can I film someone for a prank and post their reaction?

There is no blanket rule making every prank video illegal, but deliberately targeting someone, provoking them, recording their reaction and publishing it creates substantially greater legal risk than incidental background filming.

Do I need someone's consent before posting them?

There is no universal consent rule covering every public recording. However, consent becomes particularly important where the person is the subject of the content, the recording is commercial, the circumstances are private, or publication may cause harm.

Can someone sue me because they do not like being filmed?

Dislike alone does not automatically create a legal claim. The person may nevertheless have remedies if the content is defamatory, confidential, commercially processed in breach of the PDPA, criminally intrusive or otherwise unlawful.

Final takeaway

The question is not simply whether someone was filmed without consent.

Malaysian law distinguishes between ordinary public recording and conduct that deliberately targets, humiliates, harasses, defames or intrudes upon another person's privacy.

A stranger appearing incidentally in the background of a video is therefore very different from a stranger being selected for a prank, filmed specifically for their reaction and then published online.

For creators, the safest principle is straightforward. The more a real person becomes the subject of your content rather than part of the background, the more carefully you should consider consent, context and the consequences of publication.

Speak to JPP LAW

Justin, Poh & Partners, also known as JPP LAW, assists clients with civil disputes, defamation, online publications, privacy-related disputes, digital content and technology-related legal issues in Malaysia.

If you have been filmed and posted online without consent, or you create social media content and need to assess the legal risks of publishing footage involving identifiable individuals, you may contact us to discuss the matter.

---

Disclaimer: This article is for general information only and does not constitute legal advice. The legal position depends heavily on where and how the recording was made, the purpose of the recording, the content published, the identity of the publisher and the harm alleged.