Malaysia activated one of Southeast Asia’s most far-reaching social media regulatory frameworks in 2026 — and TikTok, Instagram, Facebook, and YouTube all fall squarely under its reach.
The Malaysian Communications and Multimedia Commission (MCMC) now regulates every platform with over 8 million local users under the Online Safety Act 2025 (ONSA). Two enforcement codes — the Child Protection Code (CPC) and Risk Mitigation Code (RMC) — took full effect on June 1, 2026. The headline rule: children under 16 can no longer create or hold accounts on any major platform.
But the rules go well beyond age restrictions. They govern how platforms detect harmful content, label AI-generated media, verify advertisers, and respond to scams.
This guide explains exactly what Malaysia’s social media regulation means for platforms, parents, everyday users, and businesses — in plain language, from the ground up.
What Is Malaysia’s Online Safety Act and Who Does It Actually Cover?
The Online Safety Act 2025 (ONSA) is a federal law that places legal obligations on social media platforms — not individual users — to detect, prevent, and remove harmful content. It covers any licensed platform with at least 8 million users in Malaysia, including TikTok, Instagram, Facebook, WhatsApp, YouTube, and Telegram.
ONSA received Royal Assent on May 6, 2025, and came into force on January 1, 2026. It builds on an earlier licensing framework introduced in January 2025, which already required platforms above the user threshold to obtain an Applications Service Provider (ASP) class licence from the MCMC.
The critical gap exposed in that earlier phase: by late 2025, only TikTok, WeChat, and Telegram had actually obtained licences. Meta’s Instagram, Facebook, and WhatsApp — along with YouTube and X — were all operating without formal approval. To close this loophole, the government invoked Section 46A of the Communications and Multimedia Act 1998, which allows a Ministerial Declaration to “deem” large platforms as registered licensees. As of January 1, 2026, every qualifying platform is treated in law as a licensed entity, whether it applied or not.
MCMC deputy managing director Eneng Faridah Iskandar has been clear on one key point: ONSA regulates companies, not citizens. Individual users face no penalties under the law. The financial and legal exposure sits entirely with the platforms.
Platforms Deemed Licensed Under ONSA (Effective January 1, 2026)
| Platform | Owner | User Base Qualifier |
|---|---|---|
| TikTok | ByteDance | ✅ 8M+ users in Malaysia |
| Meta | ✅ 8M+ users in Malaysia | |
| Meta | ✅ 8M+ users in Malaysia | |
| Meta | ✅ 8M+ users in Malaysia | |
| YouTube | Google/Alphabet | ✅ 8M+ users in Malaysia |
| Telegram | Telegram FZ-LLC | ✅ 8M+ users in Malaysia |
| X (Twitter) | X Corp | ✅ 8M+ users in Malaysia |
How Does Malaysia’s Under-16 Social Media Ban Actually Work?
From June 1, 2026, no user under the age of 16 may register a new account on any major social media platform in Malaysia. Existing under-16 accounts are subject to a six-month transition period, after which they may be restricted, suspended, or removed if age verification fails.
This is the most visible and most debated element of Malaysia’s new framework. The minimum age was set at 16 — a deliberate step up from an earlier proposal of 13 — aligning Malaysia with Australia’s world-first law (in force since December 2025) and Indonesia’s ban (effective March 28, 2026).
The Age Verification Process
Platforms must verify users’ ages against official government documents. Accepted forms of identification include:
- MyKad — Malaysia’s national identity card
- Passport — for foreign nationals and Malaysians without a MyKad
- MyDigital ID — Malaysia’s national digital identity system
The ONSA framework is outcome-oriented, not prescriptive. Platforms have flexibility in how they verify ages, but bear full accountability for the results. MCMC has indicated it will run a regulatory sandbox with Meta, Google, and TikTok to test and refine these verification methods.
What Happens to Existing Accounts?
Users found to be under 16 will receive one month to secure or transfer their data — including photos, videos, and saved content — before their accounts face restriction or deletion. MCMC has been explicit that parents and guardians will not face penalties for their children’s non-compliance. All consequences fall on the platforms.
One important legal distinction: ONSA defines a “child” as anyone under 18 for protective purposes, but the account registration ban specifically applies to users under 16. This reflects a policy judgment that 16-year-olds have greater cognitive capacity to assess digital risks and manage online interactions.
What Do the Child Protection Code and Risk Mitigation Code Require?
The two codes issued by MCMC under ONSA are the operational heart of Malaysia’s new framework. The Child Protection Code (CPC) focuses on keeping minors safe, while the Risk Mitigation Code (RMC) targets harmful content, scams, deepfakes, and platform accountability for all users. Both took effect June 1, 2026.
In tracking how this rollout has developed, the pace of regulatory action stands out. From ONSA’s Royal Assent in May 2025 to full enforcement of both codes in June 2026, Malaysia moved faster than most comparable democracies in converting framework legislation into actionable platform obligations.
The Child Protection Code (CPC): Key Requirements
Under the CPC, platforms likely to be accessed by children must:
- Block under-16 registrations with government ID-backed age verification
- Apply safety-by-default design principles — limiting features that expose children to grooming, exploitation, or inappropriate content
- Conduct child-specific risk assessments examining how platform features and recommendation algorithms may affect younger users
- Provide parental control tools — TikTok, for instance, already allows parents to link to a teen’s account and configure screen time, direct messages, and content filters
The Risk Mitigation Code (RMC): Key Requirements
The RMC carries broader obligations that apply to all users, not just minors:
- Annual harmful content risk assessments — platforms must document how their algorithms, recommendation systems, and user behaviour patterns may expose users to harm
- Advertiser verification — a direct response to Malaysia’s documented crisis with scam advertisements; Meta was reportedly generating over RM70 billion from scam ads in 2024 while ignoring over 96% of scam reports
- Synthetic media labelling — platforms must enable users to identify AI-generated and manipulated content, including deepfakes
- Pre-deployment risk evaluation for new features
- Algorithm review to reduce the spread of harmful content via recommendation systems
- Timely content removal — the code stops short of specifying exact timeframes but requires “prompt and effective” responses to takedown requests from MCMC
Harmful Content Defined Under Malaysian Law
ONSA identifies specific categories of priority harmful content requiring the fastest platform response:
- Child Sexual Abuse Material (CSAM)
- Financial fraud and online scams
- Obscene and indecent content
- Cyberbullying and harassment content
- Content inciting violence or terrorism
- Content inducing self-harm in children
- Content promoting racial or religious hostility
ONSA also includes a broader, more culturally specific category: content that is “profane in nature, improper and against generally accepted behaviour or culture.” Analysts at Flint Global note this wording gives MCMC considerable interpretive discretion that will play out contextually in Malaysia — distinct from the EU’s Digital Services Act approach or Australia’s eSafety framework.
What Are the Penalties — and What Do Critics Say About These Rules?
Non-compliant platforms face fines of up to RM10 million (approximately US$2.5 million) under ONSA. For licensing violations under the Communications and Multimedia Act, penalties can include fines of up to RM500,000, imprisonment of up to five years, or both, plus ongoing daily fines after conviction.
The MCMC has explicitly stated it will view non-compliance seriously. Between January and April 2026 alone, Malaysia recorded over 12,000 cybercrime cases involving online fraud, scams, and cyber harassment — a figure that underpins the government’s urgency to hold platforms accountable.
The Industry Pushback
Meta’s position has been the most prominent dissent from within the tech industry. Clara Koh, Meta’s director of public policy for Southeast Asia and ASEAN, argued at a media briefing in Kuala Lumpur on April 15 that blanket age bans tend to backfire: young people blocked from mainstream platforms typically migrate to less regulated services, creating worse safety outcomes, not better ones.
Meta has responded with its own measures — rolling out Teen Accounts for Instagram and Facebook in Malaysia in April 2026, with stricter default settings comparable to cinema age ratings. These accounts block search terms related to suicide, self-harm, and eating disorders, even if misspelled.
The Civil Society Critique
Multiple civil society organisations in Malaysia — including Aliran and a coalition of NGOs who wrote directly to Prime Minister Anwar Ibrahim — have described the under-16 ban as “misguided and disproportionate.” Their key arguments:
- Legal overreach: Section 18 of ONSA actually presumes children’s access to digital platforms and focuses on making those environments safer, not blocking access. Imposing a blanket ban via subsidiary legislation, they argue, contradicts the parent act and bypasses parliamentary scrutiny.
- Human rights concerns: The UN Committee on the Rights of the Child, in its February 2026 observations on Malaysia, raised concern that the age-based access restriction may limit children’s rights to information and inclusive digital participation.
- Effectiveness gap: Research cited by TechPolicy Press shows that teens consistently route around platform restrictions through borrowed accounts, older siblings’ profiles, or by shifting to smaller, less monitored services.
A 2024 cross-sectional study published in the Malaysian Journal of Public Health Medicine found that 73.71% of surveyed university students in Selangor showed signs of social media addiction — a figure that illustrates the scale of the underlying problem, even if it raises questions about whether access restrictions alone can solve it.
What Freedom House Has Documented
Freedom House’s Freedom on the Net 2025 report noted that Malaysia’s Communications and Multimedia (Amendment) Act 2024 criminalised “indecent, obscene, false, menacing, or grossly offensive” content online. The same cycle saw prominent activist Fahmi Reza’s TikTok account permanently banned in December 2024 during a live-streamed lecture on student activism — a case that illustrated how content regulation powers can reach beyond child protection into political and civil society expression.
How Does Malaysia’s Approach Compare to Other Countries?
Malaysia became the fourth country in the world — and the second in Asia — to ban social media for users under 16, following Australia (December 2025), Indonesia (March 2026), and ahead of a proposed UK ban effective from spring 2027. Each country has taken a slightly different approach to enforcement, verification, and scope.
| Country | Age Minimum | Law / Framework | In Force |
|---|---|---|---|
| Australia | 16 | Online Safety Amendment Act 2024 | December 10, 2025 |
| Indonesia | 16 | PP Tunas framework | March 28, 2026 |
| Malaysia | 16 | Online Safety Act 2025 (ONSA) | June 1, 2026 |
| United Kingdom | 16 (proposed) | Children’s Wellbeing and Schools Act 2026 | Spring 2027 |
| European Union | No fixed age | Digital Services Act | Ongoing |
| United States | Varies by state | State-level laws (e.g., Utah) | Ongoing |
Australia provides the closest comparison. Since December 2025, platforms have deactivated over 4.7 million under-16 accounts in Australia — a concrete data point on what enforcement scale looks like. Malaysia’s Communications Minister Fahmi Fadzil has confirmed that his office has studied the Australian model closely.
The EU’s approach differs significantly. The Digital Services Act does not set a minimum age but requires platforms to apply proportionate protections for minors, including restricting targeted advertising and ensuring privacy by default. Malaysia’s outcome-based framework under ONSA shares some of this philosophy — platforms set their own verification methods, but MCMC holds them accountable for outcomes.
One distinctive feature of Malaysia’s framework is its AI-specific duties. Until Malaysia’s separate AI Bill is finalised, the Risk Mitigation Code makes ONSA one of the first laws in the region to impose binding synthetic media labelling and pre-deployment risk evaluation obligations on platforms.
Frequently Asked Questions
Does Malaysia’s social media regulation apply to me as an individual user? No. ONSA and the associated codes apply exclusively to licensed platform providers, not to individual users. You will not be fined or prosecuted for your own social media activity under ONSA. The legal and financial exposure sits entirely with the platform companies.
Which platforms are actually covered by Malaysia’s new rules? Any social media or internet messaging service with at least 8 million users in Malaysia falls under the framework. As of January 2026, that includes TikTok, Instagram, Facebook, WhatsApp, YouTube, Telegram, and X. Smaller or niche platforms below the 8-million threshold are not directly covered.
What happens to a child under 16 who already has an Instagram or TikTok account? Platforms have a six-month transition period to verify existing users’ ages. Users identified as under 16 will receive one month to save or transfer their data — photos, videos, and other content — before their accounts may be restricted, suspended, or deleted. Parents will not face penalties; the responsibility lies with the platform.
Can a parent consent on behalf of their child to allow them to use TikTok or Instagram under 16? Under the current rules, parental consent does not override the minimum age requirement. The ban applies regardless. Parents can, however, use parental control tools on platforms like TikTok — which allows account linking, screen time limits, and content filters — for teens who are 16 and older.
What counts as “harmful content” under Malaysian law? ONSA covers a wide spectrum: child sexual abuse material, financial fraud and scams, obscene content, cyberbullying, content inciting violence or terrorism, content promoting self-harm in children, and material that stirs racial or religious hostility. Notably, it also includes content “against generally accepted behaviour or culture” — a broader category than most comparable international frameworks.
What are the penalties for platforms that don’t comply? Platforms can face fines of up to RM10 million (approximately US$2.5 million) for non-compliance with ONSA’s prescribed duties. Under the Communications and Multimedia Act, licensing violations carry fines of up to RM500,000, prison terms of up to five years, and ongoing daily fines after conviction.
Is Malaysia’s under-16 social media ban permanent? There is no published sunset clause. The framework is designed as a standing regulatory regime, not a temporary measure. MCMC has indicated it will continue refining enforcement — including through a regulatory sandbox with Meta, Google, and TikTok — as verification technologies and compliance practices mature.
How does Malaysia’s law compare to Australia’s social media ban? Both countries set 16 as the minimum age and place enforcement responsibility on platforms. Australia’s law covers a broader range of platforms and was the first of its kind globally. Malaysia’s framework adds broader content moderation obligations — including AI labelling requirements and advertiser verification — that Australia’s age-focused law does not include in the same form.
Conclusion
Malaysia’s social media regulation in 2026 is not one rule — it is a layered system. The ONSA framework establishes the legal foundation. The deeming provision forces platform accountability. The Child Protection Code enforces the under-16 ban. The Risk Mitigation Code addresses everything from deepfakes to scam ads to recommendation algorithms.
For parents in Malaysia, the immediate action is practical: check whether your child is under 16 and prepare for the verification process that all major platforms are now rolling out. For platform operators, the compliance clock is running — the six-month transition window for existing accounts closes before the end of 2026.
The broader debate is genuine and unresolved. Civil society groups, the United Nations, and even Meta itself have raised legitimate questions about whether access restrictions alone can protect children, or whether they may push vulnerable users toward less regulated corners of the internet. Those questions deserve serious engagement — and MCMC has signalled it is watching closely how enforcement unfolds in Australia and Indonesia to calibrate Malaysia’s approach.
What is not in doubt: the era of major platforms operating in Malaysia without formal legal accountability is over.
Boost your skills today by exploring our most popular content right now.
