Malaysia's Communications and Multimedia Commission (MCMC) will enforce two new codes under the Online Safety Act (ONSA) 2025 starting June 1, 2026. The Child Protection Code will bar users under 16 from registering social media accounts. The Risk Mitigation Code introduces stricter rules for managing harmful content on digital platforms nationwide [1, 2, 3, 4, 5, 6].
The Child Protection Code requires platforms to implement age restrictions and protections to limit exposure to harmful content. Platforms must also restrict high-risk features for those under 16, ensuring age-appropriate safety measures [1, 2, 4, 5, 6, 7]. Social media providers such as Facebook, Instagram, TikTok, and YouTube will be required to verify user ages with government-issued IDs to prevent underage registration [8, 6, 7, 9].
The Risk Mitigation Code mandates proactive risk assessments and stronger governance over content. Platforms must improve reporting mechanisms, verify advertisers, and label manipulated or AI-generated materials. Failure to comply may lead to fines up to RM10 million (about USD 2.3 million) [1, 2, 10, 4, 5, 11, 7, 9].
MCMC said the codes “set clear expectations for service providers to take greater responsibility in addressing harmful content on their platforms, particularly in protecting children and vulnerable users” and offer flexibility in how providers meet safety and privacy requirements [2]. Officials added the step “helps strengthen child protection in the online environment, while giving parents added confidence in navigating increasingly complex digital risks” [5].
The government conducted a public consultation from February 12 to March 31 involving industry and civil society to develop the codes [1, 2, 4, 5, 11]. Legal experts argue that age limits alone are insufficient without stronger identity checks, parental controls, mandatory faster removal of child abuse material, and harsher penalties for cybercrime syndicates [8]. Some critics express concerns about impacts on freedom of speech and privacy due to expanded real-name verification and increased government oversight risk [7, 9].
The regulations target risks including child sexual abuse materials, financial fraud, obscene content, harassment, violent or terrorist incitement, self-harm promotion, hate speech, and drug-related content [10, 11, 7, 9]. They mirror international trends after Australia’s 2025 under-16 social media ban, with countries like Indonesia, the UK, and several European nations adopting similar frameworks [6, 7, 9].
A recent enforcement example includes a statutory demand issued to TikTok for failure to promptly remove content offensive to Malaysia’s royal family, including AI-generated manipulated videos [1, 7, 9].
Platforms have been given a reasonable transition period to implement these systems before enforcement begins. The new codes will take effect nationwide from June 1, 2026 [1, 2, 5, 6, 9].
