Personalised by Data, Exposed by Design: Legal Implications of AI-Driven Cosmetic Marketing and Data Privacy in Malaysia

The cosmetic industry is increasingly shaped by artificial intelligence, biometric analysis and data driven marketing. In Malaysia, AI powered cosmetic platforms are now capable of analysing facial images, skin texture, pigmentation, pores, behavioural preferences and purchase patterns to generate personalised product recommendations. Although such technology enhances consumer engagement and commercial efficiency, it also introduces significant legal concerns relating to biometric data, informed consent, algorithmic profiling, consumer manipulation and liability for harm. This article examines the legal implications of AI driven cosmetic marketing in Malaysia, with reference to the Personal Data Protection Act 2010, the Personal Data Protection Amendment Act 2024 and the Consumer Protection Act 1999. It argues that the 2024 amendment represents an important development because it introduces biometric data into the definition of sensitive personal data, but this reform does not fully resolve the broader challenges created by AI cosmetic systems. These systems remain difficult to regulate because they operate through opaque algorithms, fragmented data processing arrangements and complex relationships between cosmetic companies, platform providers and technology vendors. Through doctrinal and comparative legal analysis, this article draws selected insights from Australia and South Korea, both of which provide useful models on biometric data protection, consent and privacy governance. The article concludes that Malaysia requires a more integrated regulatory framework for AI cosmetic marketing, combining stronger data protection enforcement, clearer consent standards, algorithmic accountability, shared liability and sector specific guidance for cosmetic businesses using AI technologies.

AI cosmetic marketing, biometric data, data privacy, PDPA 2010, cosmetic liability, algorithmic profiling

1. A v National Blood Authority [2001] 3 All ER 289 [Google Scholar] [Crossref]

2. Amin, N. (1999). Product liability under the Consumer Protection Act 1999. IIUM Law Journal, 7(2), 175–198. [Google Scholar] [Crossref]

3. ASEAN. (2024). ASEAN guide on AI governance and ethics. Association of Southeast Asian Nations. https://asean.org/wp-content/uploads/2024/02/ASEAN-Guide-on-AI-Governance-and-Ethics_beautified_201223_v2.pdf [Google Scholar] [Crossref]

4. Barocas, S., & Nissenbaum, H. (2014). Big data’s end run around anonymity and consent. Privacy, big data, and the public good: Frameworks for engagement, 1, 44-75. [Google Scholar] [Crossref]

5. Belenguer, L. (2022). AI bias: exploring discriminatory algorithmic decision-making models and the application of possible machine-centric solutions adapted from the pharmaceutical industry. AI and Ethics, 2(4), 771-787. [Google Scholar] [Crossref]

6. Buiten, M. C. (2024). Product liability for defective AI. European Journal of Law and Economics, 57(1), 239-273. [Google Scholar] [Crossref]

7. Chagal-Feferkorn, K. A. (2019). Am I an algorithm or a product: when products liability should apply to algorithmic decision-makers. Stan. L. & Pol'y Rev., 30, 61. [Google Scholar] [Crossref]

8. Chynoweth, P. (2008). Legal research. In A. Knight & L. Ruddock (Eds.), Advanced research methods in the built environment (pp. 28–38). Wiley Blackwell. [Google Scholar] [Crossref]

9. Commonwealth of Australia. (1988). Privacy Act 1988. Federal Register of Legislation. https://www.legislation.gov.au/C2004A03712/latest/text [Google Scholar] [Crossref]

10. Donoghue v Stevenson [1932] AC 562. [Google Scholar] [Crossref]

11. Grant v Australian Knitting Mills Ltd [1936] AC 85 [Google Scholar] [Crossref]

12. Gryz, J., & Rojszczak, M. (2021). Black box algorithms and the rights of individuals: No easy solution to the" explainability" problem. Internet Policy Review, 10(2), 1-24. [Google Scholar] [Crossref]

13. Hash, M. G., Forsyth, A., Bret-Ashleigh, C., Li, V., Julia, V. B., & Frasier, K. M. (2025). Artificial intelligence in the evolution of customized skincare regimens. Cureus, 17(4). [Google Scholar] [Crossref]

14. Hussain, B., Aslam, S., & Imran, A. (2025). Manufacturing beauty: How AI and Social media are redefining aesthetic norms in emerging digital cultures. Acta Psychologica, 260, 105734. [Google Scholar] [Crossref]

15. Hutchinson, T., & Duncan, N. (2012). Defining and describing what we do: doctrinal legal research. Deakin law review, 17(1), 83-119. [Google Scholar] [Crossref]

16. Kim, D. H., & Park, D. H. (2024). Automated decision-making in South Korea: a critical review of the revised Personal Information Protection Act. Humanities and Social Sciences Communications, 11(1), 1-11. [Google Scholar] [Crossref]

17. Malaysia. (1999). Consumer Protection Act 1999 (Act 599). Percetakan Nasional Malaysia Berhad. [Google Scholar] [Crossref]

18. Malaysia. (2010). Personal Data Protection Act 2010 (Act 709). Percetakan Nasional Malaysia Berhad. [Google Scholar] [Crossref]

19. Malaysia. (2024). Personal Data Protection (Amendment) Act 2024 (Act A1727). Government of Malaysia. [Google Scholar] [Crossref]

20. Ministry of Science, Technology and Innovation. (2024). The national guidelines on AI governance and ethics. Malaysian Science and Technology Information Centre. [Google Scholar] [Crossref]

21. National AI Office. (2024). Governance. Malaysia National AI Office. https://ai.gov.my/governance/ [Google Scholar] [Crossref]

22. National Pharmaceutical Regulatory Agency. (2022). Guidelines for control of cosmetic products in Malaysia (2nd ed.). Ministry of Health Malaysia. [Google Scholar] [Crossref]

23. OECD. (2019). OECD principles on artificial intelligence. Organisation for Economic Co-operation and Development. https://www.oecd.org/en/topics/ai-principles.html [Google Scholar] [Crossref]

24. Office of the Australian Information Commissioner. (2024a). Facial recognition technology: A guide to assessing the privacy risks. Australian Government. https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/facial-recognition-technology-a-guide-to-assessing-the-privacy-risks [Google Scholar] [Crossref]

25. Office of the Australian Information Commissioner. (2024b, November 19). Bunnings breached Australians’ privacy with facial recognition tool. Australian Government. https://www.oaic.gov.au/news/media-centre/bunnings-breached-australians-privacy-with-facial-recognition-tool [Google Scholar] [Crossref]

26. Paris, M. L. (2016). The comparative method in legal research: the art of justifying choices. Legal Research Methods: Principles and Practicalities (Clarus Press 2016), UCD Working Papers in Law, Criminology & Socio-Legal Studies Research Paper, (09/16). [Google Scholar] [Crossref]

27. Perret, J. K., & Schwientek, J. (2025). Beauty Tech—Customer Experience and Loyalty of Augmented Reality-and Artificial Intelligence-Driven Cosmetics. Digital, 5(2), 21. [Google Scholar] [Crossref]

28. Personal Information Protection Commission. (2022). Biometric information protection guideline. Republic of Korea. https://www.pipc.go.kr/eng/user/lgp/law/ordinancesList.do [Google Scholar] [Crossref]

29. Republic of Korea. (2011). Personal Information Protection Act. Korean Law Translation Center. https://elaw.klri.re.kr/eng_service/lawView.do?hseq=53044&lang=ENG [Google Scholar] [Crossref]

30. Roslan, M. A., Aziz, N. A., Abd Rani, A. R., Roslan, R., & Che Mohamad, C. A. (2023). Product liability law: Producer’s liability for harmful cosmetic products. Malaysian Journal of Social Sciences and Humanities, 8(5), Article e002323. [Google Scholar] [Crossref]

31. Sarabdeen, J. (2022). Protection of the rights of the individual when using facial recognition technology. Heliyon, 8(3). [Google Scholar] [Crossref]

32. Tene, O., & Polonetsky, J. (2012). Big data for all: Privacy and user control in the age of analytics. Nw. J. Tech. & Intell. Prop., 11, 239. [Google Scholar] [Crossref]

33. UNESCO. (2022). Recommendation on the ethics of artificial intelligence. United Nations Educational, Scientific and Cultural Organization. https://unesdoc.unesco.org/ark:/48223/pf0000381137 [Google Scholar] [Crossref]

34. Zakuan, Z. Z. M., & Ismail, R. (2019). Health supplement and product liability in Malaysia: A call for reform. Malaysian Journal of Consumer and Family Economics, 23(1), 33-55. [Google Scholar] [Crossref]

35. Zweigert, K., & Kötz, H. (1998). An introduction to comparative law (T. Weir, Trans.; 3rd ed.). Oxford University Press. [Google Scholar] [Crossref]