The Malaysian Communications and Multimedia Commission (MCMC) announced two regulatory codes under the Online Safety Act 2025—the Children’s Protection Code (CPC) and the Risk Mitigation Code (RMC)—to take effect June 1, 2026. These codes require social media platforms to implement age verification and safety controls for users under 16 years old [1, 2, 3, 4, 5, 6, 7].

The CPC targets users below age 16 by mandating platforms embed child safety by design. It restricts account registration and ownership by minors and limits exposure to harmful content and exploitative interactions. The RMC compels providers to conduct risk assessments, content governance, establish reporting mechanisms, verify advertisers, and label manipulated or synthetic content [2, 4, 7].

Social media users will have to verify their age by submitting official government-issued documents like identity cards or passports starting June 1, 2026, to comply with the codes. Existing accounts must complete verification within a reasonable grace period set after discussions with platforms such as TikTok, Facebook, and Instagram. Failure to verify may lead to account closure or enforcement using AI to confirm users are 16 and above [1, 3, 5, 6].

The government decided children under 16 cannot open or own accounts on platforms with more than 8 million Malaysian users. MCMC has not mandated specific verification technology but may require AI tools if verification is incomplete [1, 3, 5, 6]. The codes followed public consultation held from February to March 2026 with industry, civil society, and stakeholders [2, 4, 7].

Between January and April 2026, Malaysian authorities recorded 23,367 online scam cases resulting in losses of RM680.3 million. Since launching in January 2025, the Safe Internet Campaign has run over 11,000 programs engaging more than 1.8 million participants nationwide [1, 3, 5, 6].

The government also plans to amend the Online Safety Act 2025 to strengthen child protections amid a rise in digital sexual crimes involving minors. Over 1.47 million child sexual abuse material-related digital files were detected from 2024 to April 2026 across four major operations, the Women, Family and Community Development Minister Datuk Seri Nancy Shukri said. She noted ongoing discussions with other ministries on setting up a registry for offenders, though no final decisions have been made [8].

Experts cautioned that collecting sensitive documents for age verification raises cybersecurity and privacy risks. Consultant paediatrician Amar Singh HSS warned such data could become a high-value target for hackers. Cybersecurity expert Fong Choong Fook said regulations must be paired with independent supervision or watchdog mechanisms to ensure platforms properly implement child protection and secure user data [9].

The implementation date for the CPC and RMC codes requiring social media age verification is June 1, 2026.