Live Selling Compliance in Malaysia: CPETTR, KKM & MDC Rules

Why a live claim is a different legal problem than a written one

A written ad goes through review — someone reads the copy, a compliance checker flags the risky words, a manager approves it — before it ever reaches a customer. A live session doesn't. Whatever the host says the moment the camera is rolling is the claim, with no review step between the thought and the broadcast, and no edit available after a viewer has already heard it. That single structural difference is why live selling compliance deserves its own guide rather than a rehash of the rules already written for static ad copy.

CPETTR 2024: the marketplace disclosure layer

The Consumer Protection (Electronic Trade Transactions) Regulations 2024 (CPETTR 2024) replaced the older 2012 regulations and are the primary rulebook for how a Malaysian seller and marketplace must disclose information to a buyer online. The regulations are gazetted, passed and legally in force — seller identity, contact details, pricing, delivery estimates and applicable certifications all have to be disclosed accurately, and a live session's product information is not exempt just because it was said rather than typed.

One specific requirement needs a precise nuance, because getting it wrong in either direction is a real mistake: CPETTR 2024 originally set 24 June 2025 as the enforcement date for a rule requiring product titles and descriptions on major marketplaces to appear in Bahasa Malaysia. Malaysia's Ministry of Domestic Trade and Cost of Living (KPDN) postponed enforcement of that specific requirement pending feedback from platform operators, and as of this guide's last review, no revised enforcement date has been announced. The regulation itself remains legally valid — only enforcement of the BM-listing rule is on hold. Treating it as cancelled is the wrong lesson to take from the postponement; treating it as already-enforced is equally wrong. We track this explicitly in our freshness ritual for this page rather than leaving it stated once and going stale.

Consumer Protection Act 1999: the single most useful sentence on this page

The Consumer Protection Act 1999's provisions against false or misleading representation apply to a claim regardless of the medium it was made in — a spoken claim on a livestream carries the same legal exposure as the identical claim printed in a Facebook ad. A host who says a product "cures" something, guarantees a result, or overstates a comparison against a competitor on-stream has made exactly the kind of representation the Act was written to catch, and the fact that it was live and unscripted is not a defence — if anything, it removes the review step that would normally have caught it before publication.

Where KKM, MOH and MDC rules bind a live host's words

If a session touches skincare, supplements, aesthetic outcomes or dental treatment, Malaysia's existing KKM/MOH and MDC advertising rules apply to what the host says exactly as they apply to a written ad for the same product or clinic — before-and-after framing, outcome guarantees and prohibited claim categories don't become permissible because they were spoken rather than printed.

Here is the part worth being honest about, because oversell would defeat the point of publishing this guide: our own KKM ad checker and MDC ad checker can review a prepared script, a caption, or planned talking points before a session — they cannot review a live stream in real time. A host who improvises off-script mid-session generates claims neither tool ever sees. That gap is exactly why our live commerce service treats host briefing and claim guardrails as a distinct, mandatory phase before any regulated-adjacent session, not an optional add-on — and why clinic categories sit in our own honest-filter section as sessions we'll usually advise against rather than take the budget for.

SST on paid amplification, and PDPA on session leads

Once a live session is amplified with paid spend — boosting a clip, running ads to drive session viewers — Malaysia's Service Tax on digital advertising applies to that spend the same way it applies to any other paid social campaign; use the SST digital ads calculator to size the actual tax line rather than guessing it. Separately, any lead or DM capture generated off the back of a session — a viewer messaging to ask about a product, a form filled from a livestream link — falls under the same Personal Data Protection Act (PDPA) obligations as a lead captured through any other channel; our PDPA policy generator covers the same disclosure requirements for session-driven leads as for a website form.

Platform policy: describing the category of rule, not quoting one unverified

Shopee Live, TikTok Shop LIVE and Lazada Live each carry their own platform-level restrictions — categories of product that can't be sold live, claim types that trigger content review, and behaviour rules for hosts — layered on top of Malaysian law rather than instead of it. We describe that a category of platform rule exists rather than quoting a specific clause, because platform policy pages change without notice and a specific rule stated here would go stale faster than this guide gets re-reviewed; check the platform's own current seller policy before a session touching a restricted category.

The regulatory surface at a glance

What this means for booking your first session

None of this is a reason not to run live commerce — it's a reason to brief a host before the first session rather than after a complaint. A run-of-show that flags which product claims are pre-approved, which are off-limits, and which categories (clinical, health, beauty-outcome) need a script reviewed in advance rather than improvised live is the single highest-leverage compliance step available, and it costs nothing but planning time. See our live commerce management page for how host briefing and claim guardrails fit into a managed engagement, and our live commerce glossary for the terms used throughout this guide.