Malaysia has officially begun enforcing mandatory age verification for social media registrations and account access, marking a major step in protecting children under the age of 16 from online threats and cyber-related harm.
The new requirement comes into effect alongside the enforcement of the Child Protection Code (CPC) and Risk Mitigation Code (RMC) under the Online Safety Act (ONSA) 2025, overseen by the Malaysian Communications and Multimedia Commission (MCMC).
Under the regulations, individuals below the age of 16 are no longer allowed to open social media accounts. Users registering for new accounts must now provide official government-issued identification documents, including a MyKad, passport or MyDigital ID, to verify their age.
The verification process will not only apply to new users. Existing account holders may also be required to verify their identities to ensure they continue to meet platform eligibility requirements.
The move places Malaysia alongside countries such as Australia and Indonesia, which have introduced similar measures aimed at restricting underage access to social media platforms and strengthening online safety for young users.
Malaysia’s approach is expected to stand out due to its use of MyKad legislation and the MyDigital ID ecosystem, providing an additional layer of security and identity authentication.
According to MCMC, the implementation of the CPC and RMC is designed to strengthen child protection across digital platforms while requiring service providers to take greater responsibility in tackling harmful online content.
The codes were developed following extensive consultations and public engagement sessions involving industry players, civil society groups and other stakeholders since February this year.
Under the Child Protection Code, platform operators must adopt a “safety by design” approach, ensuring their services are built to reduce risks that could expose children to cyber exploitation, online grooming and inappropriate content.
Meanwhile, the Risk Mitigation Code requires digital service providers to conduct comprehensive risk assessments, implement stricter content governance measures and introduce labelling systems for manipulated content to combat scams, misinformation and fake news.
Companies that fail to comply with requirements under the RMC could face severe penalties, including fines of up to RM10 million.
In a further effort to curb online fraud, paid advertisements for products and services will only be permitted if uploaded by advertisers or users whose identities have been verified using official government-issued documents.
MCMC has also directed platforms to review and adjust their recommendation algorithms to reduce the likelihood of users being exposed to harmful material, including child sexual abuse material (CSAM), pornography and financial scams.
The commission said digital service providers will be given a reasonable implementation period to integrate age-verification systems while ensuring user privacy remains protected.
The Online Safety Act was fully enforced on January 1, 2026, and aims to place greater accountability on digital platforms to detect, prevent and respond more effectively to harmful online content in Malaysia’s rapidly evolving digital landscape.
