Is Telegram Spam Legal? What Malaysian Businesses Need to Know

Important Note

This article explains the relevant Malaysian laws and Telegram's own policies in plain language for general business planning. It is not legal advice — if your business operates in a regulated industry or you're unsure how a specific campaign applies, consult a Malaysian lawyer before launching.

What Counts as Spam Under Malaysian Law?

Malaysia does not have a single law that defines "spam" the way some countries do. Instead, unsolicited or abusive messaging is generally caught under Section 233 of the Communications and Multimedia Act 1998 (CMA), which criminalises using a network facility or service to transmit content that is obscene, indecent, false, menacing, or offensive in character, with the intent to annoy, abuse, threaten, or harass another person. A conviction carries a fine of up to RM50,000, imprisonment of up to 1 year, or both, plus a further RM1,000 for every day the offence continues after conviction. The key word is intent. A single, honestly-labelled promotional message to someone who never opted in is unlikely to meet Section 233's bar on its own — the section was written for genuinely abusive, harassing, or menacing content, not ordinary unwanted marketing. But a business that keeps messaging someone after being told to stop, or disguises a scam or misleading claim as a legitimate offer, moves squarely into the territory Section 233 was built to punish.

Is There a Law Specifically Against Unsolicited Commercial Messages in Malaysia?

Yes, but it isn't in force yet. The Communications and Multimedia (Amendment) Act 2025 introduced a new Section 233A that specifically prohibits sending unsolicited commercial electronic messages that contravene the CMA or its regulations — closing the gap that Section 233 was never really designed to cover. As of this writing, Section 233A is on the books but not yet enforceable: it is waiting on the MCMC to issue the subsidiary regulations that will define exactly what counts as "unsolicited" and set out how the provision is enforced in practice. Until those regulations are issued, Section 233A doesn't change what's legally required today — but it is a clear signal of where Malaysian policy is heading. Businesses that build consent-based, opt-out-friendly messaging practices now won't need to scramble to comply once the regulations land.

Does the Personal Data Protection Act (PDPA) Apply to Telegram Marketing?

Yes, and this is the law that already has real teeth today. The Personal Data Protection Act 2010 (PDPA) requires a business (a "data user" in the Act's language) to have the individual's consent before processing their personal data — and a phone number or Telegram handle used to add someone to a marketing list counts as personal data. Contacting someone on Telegram for marketing purposes using contact details you collected without their consent, or that you scraped or bought from a third-party list, is a PDPA breach independent of anything in the CMA. In practice, this means the safest and most legally defensible Telegram contact list is one built entirely from people who gave you their number or joined your channel voluntarily — not one assembled by scraping public groups or buying a contact database.

What Happens If You Get Reported for Spam on Telegram?

Separate from Malaysian law, Telegram enforces its own spam policy at the platform level, and this is usually the first consequence a business actually experiences — well before any legal action would ever be considered. Telegram's Terms of Service for Bots prohibit third-party bots from harassing or spamming users with unsolicited messages, and Telegram's moderation team reviews messages that users report as spam. Based on documented user reports, as few as 5–7 spam reports against an account within 24 hours can trigger a temporary restriction on messaging people who haven't started a conversation with that account first; repeated violations can lead to a permanent restriction. Telegram also caps how fast a bot can send messages: the default limit is 30 messages per second, though a business with a genuine, good-faith use case can apply for a higher limit (up to 1,000 messages per second) directly through @BotFather. Exceeding these limits, or using them for a use case Telegram doesn't consider legitimate, is itself a policy violation separate from the spam-report system.

How Can Businesses Send Bulk Telegram Messages Without Being Considered Spam?

The practices that keep you compliant with Malaysian law and inside Telegram's own rules are largely the same:

• Only message people who opted in — joined your channel, messaged your bot first, or gave explicit consent to be contacted
• Identify your business clearly in every message; never disguise who is sending it
• Include a simple way to opt out, and remove anyone who asks immediately and permanently
• Avoid repeated, identical messages to the same recipient in a short window — Telegram's spam detection weighs this heavily
• Send through Telegram's official Bot API rather than a personal account, and stay within its published rate limits
• Keep records of consent (when and how someone opted in) in case you ever need to demonstrate compliance

Running campaigns through a dedicated Telegram broadcast service rather than a personal Telegram account also reduces risk in practice — personal accounts have much lower tolerance thresholds before Telegram restricts them, since they aren't provisioned for business-scale messaging in the first place.

What Should You Do If Your Telegram Account Gets Restricted?

If Telegram limits your account after spam reports, you can appeal directly through Telegram's own @SpamBot, which will tell you whether the restriction can be lifted and let you contest it if you believe it was applied in error. Telegram has signalled limited patience for accounts with a pattern of repeated violations, and some restrictions on serial offenders may not be reversible — which is exactly why building consent-based practices from the start is cheaper than trying to recover a flagged account later.

Send Compliant Bulk Messages Across Telegram and Beyond

If you want to run Telegram outreach at scale without relying on a personal account or guessing at rate limits, Yaeris's Telegram Blaster service handles delivery through the official Bot API, with the same consent-first approach this article recommends.

Frequently Asked Questions (FAQs)