Personalised by Data, Exposed by Design: Legal Implications of AI-Driven Cosmetic Marketing and Data Privacy in Malaysia

The cosmetic industry is increasingly shaped by artificial intelligence, biometric analysis and data driven marketing. In Malaysia, AI powered cosmetic platforms are now capable of analysing facial images, skin texture, pigmentation, pores, behavioural preferences and purchase patterns to generate personalised product recommendations. Although such technology enhances consumer engagement and commercial efficiency, it also introduces significant legal concerns relating to biometric data, informed consent, algorithmic profiling, consumer manipulation and liability for harm. This article examines the legal implications of AI driven cosmetic marketing in Malaysia, with reference to the Personal Data Protection Act 2010, the Personal Data Protection Amendment Act 2024 and the Consumer Protection Act 1999. It argues that the 2024 amendment represents an important development because it introduces biometric data into the definition of sensitive personal data, but this reform does not fully resolve the broader challenges created by AI cosmetic systems. These systems remain difficult to regulate because they operate through opaque algorithms, fragmented data processing arrangements and complex relationships between cosmetic companies, platform providers and technology vendors. Through doctrinal and comparative legal analysis, this article draws selected insights from Australia and South Korea, both of which provide useful models on biometric data protection, consent and privacy governance. The article concludes that Malaysia requires a more integrated regulatory framework for AI cosmetic marketing, combining stronger data protection enforcement, clearer consent standards, algorithmic accountability, shared liability and sector specific guidance for cosmetic businesses using AI technologies.