Malaysia Under-16 Social Media Ban Explained
If you run a platform, app, or digital service with users in Southeast Asia, there’s a new regulatory reality you need to understand. On June 1, 2026, Malaysia became one of the world’s strictest enforcers of child online safety rules, and the ripple effects reach far beyond its borders.
In Malaysia children under 16 can no longer open social media accounts. While for families this ban means a change in their digital habits, for businesses, especially social media platforms, it signals a clear regulatory shift: age checks, identity verification, and child protection controls are becoming mandatory compliance requirements, not optional features.
This article breaks down what Malaysia’s under-16 social media ban means, why it’s happening, how it’s enforced, and what it means for your business.
Overview of Malaysia’s New Social Media Restrictions
Malaysia’s new child safety rules – the Online Safety Act 2025 (ONSA) – received royal assent in May 2025 and came into force on January 1, 2026. But the moment that grabbed international headlines came on June 1, 2026, when active enforcement under two new regulatory codes began.
Under the Child Protection Code (CPC) and the Risk Mitigation Code (RMC), issued by the Malaysian Communications and Multimedia Commission (MCMC), all licensed social media platforms with at least 8 million users in Malaysia, including Facebook, Instagram, TikTok, and YouTube, must now:
- Block users under 16 from registering new accounts
- Verify the ages of all existing users
- Implement safety-by-design features for child protection
- Detect and remove harmful content proactively
One important distinction worth noting is that ONSA defines a “child” as anyone under 18, but the account registration ban specifically applies to users under 16. It’s a deliberate policy choice made by policymakers – a change to an earlier proposal to set the minimum age at 13.
Existing users identified as under 16 will be given one month to download or transfer their data before their accounts are restricted. Age verification for existing users will be rolled out progressively over six months, giving platforms time to implement age verification systems.
Why Has Malaysia Introduced This Ban?
Malaysia’s ban is a social response to recent tendencies reported by the country’s statistics, specifically that children are spending more time online, and the risks of being exposed to harmful content are becoming harder for parents, schools, and platforms to manage.
For example, Malaysia’s cyberbullying complaints surged dramatically in just one year: the MCMC recorded 3,199 cyberbullying complaints in 2023, which jumped to 8,399 complaints between January and November 2024 alone – an average of 27 cases per day.
More so, research from the Malaysian Mental Health Association found that at least 20% of youth self-harm (suicides) in recent years were connected to cyberbullying. Children may also come across violent material, hate speech, or misinformation before they are ready to process it, which plays a significant role in driving a mental health crisis.
Child sexual abuse material (CSAM) is an even more alarming driver. According to the Internet Watch Foundation, Malaysia recorded 12,656 CSAM reports in just the first half of 2025, which is equivalent to 78% of all 16,238 reports recorded in the entire year of 2024. Medical experts estimate that roughly 100,000 Malaysian children (at least 4% of internet-using children) had been subjected to clear instances of online sexual exploitation and abuse, with many cases going unreported.
Next are scams and manipulation. Children are often less able to recognize fake giveaways, impersonation accounts, phishing messages, or “urgent” requests for money or personal data, as well as sextortion cases.
Malaysia’s ban is meant to reduce such risks by delaying access until children are older, and helping both parents and platforms not only to filter negative content, but to control the escalating harmful tendencies. Of course, a parent can set rules at home, but if the platform itself has no guardrails, those rules are only as strong as the child’s willpower. The ONSA shifts that responsibility from the family to the platform.
💡 Check Ondato specialist’s new article about why parents can’t fight online child abuse alone and how platforms can help prevent online child exploitation.
How the Rules Are Going to Be Enforced
The MCMC has been clear – parents and guardians will not face penalties for their children’s non-compliance. The responsibility and the consequences sit solely with the service provider, not parents.
Age verification methods accepted under the framework include:
- MyKad – Malaysia’s national identity card
- Passport
- MyDigital ID – the government’s official digital identity system
Deputy Communications Minister Teo Nie Ching has said users may need to verify their age using government-issued documents such as identity cards, passports, or other official documents.
She specified: “We have now asked platforms to implement age verification. Users need to verify their age using government-issued documents such as identity cards, passports or other official documents. If it is merely self-declared, anyone can simply click and claim they are above 18 years old.”
The Malaysian government has also discussed a more standardized age verification mechanism. Thus, Communications Minister Fahmi Fadzil said MCMC was working with platforms through a regulatory sandbox and that Malaysia was looking beyond basic age assurance toward age verification.
In practice, platforms may need to:
- verify a user’s age before account creation
- detect and restrict existing users who are under 16
- give underage users a way to download or transfer their data before account restrictions apply
- improve parental controls and safety settings
- respond to regulator requests and demonstrate compliance
- manage identity data securely and minimize unnecessary data collection
It’s important to note that social media platforms may use third-party age verification providers if they comply with Malaysia’s Personal Data Protection Act. Importantly, the framework follows an outcome-based approach, which gives platforms flexibility in how they implement systems, as long as the outcome (keeping under-16s off the platform) is achieved.
Another important thing to note: even social media companies based outside Malaysia are subject to these obligations if their services are made available within the country and they fall within the relevant licensing framework. If you have 8 million or more Malaysian social media users, these rules apply to you too, regardless of where your servers are.
Non-compliance carries serious consequences: fines of up to RM10 million (approximately US$2.5 million). The MCMC has signaled it will view non-compliance seriously and pursue regulatory action. Under Malaysia’s Online Safety Act 2025, the regulator has a stronger legal basis to require online service providers to manage harmful content and child safety risks.
Global Trend: Similar Social Media Age Restrictions Around the World
Malaysia’s decision to ban social media for under-16s doesn’t appear in isolation. It’s part of a growing global concern, which is turning into an international consensus that platforms have been failing to protect children, and that voluntary measures haven’t worked.
Australia
On December 10, 2025, Australia became the first country to enforce a nationwide minimum age requirement preventing children under 16 from holding social media accounts under the Online Safety Amendment Act 2024. By mid-December 2025, platforms had already removed access to 4.7 million under-16 accounts across the country. In line with Australia’s social media ban, digital platforms face fines of up to AUD $49.5 million for failing to take reasonable steps to block underage users.
The European Union
The EU is taking a parallel approach through the Digital Services Act (DSA), which has been in application since February 2024. In July 2025, the European Commission published guidelines on the protection of minors under the DSA, including an open-source age verification app prototype.
The DSA requires any platform accessible to minors to implement “appropriate and proportionate measures” to ensure high levels of privacy, safety, and security. From 2025, the EU requires private-by-default settings, stricter age verification, and ethical design for platforms that children can access. Under the EU’s GDPR framework, 16 is the default age for digital consent, though member states can lower this to 13.
France was among the earliest movers, passing a law in 2023 requiring parental authorization for under-15s to access social media. Spain and Denmark have both advanced proposals and pilot programs targeting social media access for under-16s. Greece has also piloted age assurance mechanisms as part of broader digital safety reforms.
The United Kingdom
The UK, through the Online Safety Act, introduced in 2023 and progressively enforced since, places obligations on platforms to protect children from harmful content, including age-appropriate design requirements enforced by Ofcom.
The United States
The US has pursued age protection at the state level, with mixed results. At the moment, over 25 US states have introduced age verification laws with the aim of protecting minors from accessing explicit adult content online.
Florida, Georgia, Mississippi, Tennessee, Utah, Louisiana, and other states have each enacted legislation requiring age verification and parental consent for minors’ social media accounts. However, several laws, including those in Arkansas, California, and Ohio, have been blocked by federal courts on First Amendment grounds (free speech concerns), making the US regulatory picture more fragmented than in other regions.
Expected Impact on Children and Families
Malaysia’s government stated that the main goals of the ban are to reduce harm, restore balance, and give children a healthier relationship with technology.
For children, the ban may reduce exposure to adult content, grooming attempts, cyberbullying, scams, and addictive design features.
Even though it’s hard to measure, the government hopes that the ban will help remove social media from younger teens’ daily routines and create space for more face-to-face interaction, sports, and healthier development patterns, like hobbies, family time, and in-person friendships.
So, by requiring platforms to implement safety-by-design principles and proactive content moderation, the framework aims to reduce children’s accidental (and intentional) exposure to violence, sexual content, and predatory behavior.
For parents, the ban aims to hand over more mechanisms that help monitor their children’s online activity, rather than relying on manual supervision of accounts that were never designed with children in mind. That’s why platforms are required to provide age-appropriate features and tools.
The Risk Mitigation Code also requires platforms to implement features that discourage excessive use, addressing the growing concern about screen time and its links to anxiety, depression, and sleep disruption among adolescents.
Yet, parents may still need guidance, because children can try to bypass restrictions by using a parent’s account, borrowing an older sibling’s phone, using VPNs, or moving to smaller platforms that are harder to monitor. Rules alone will not replace digital literacy, open conversations, and parental involvement.
But it’s worth highlighting what the policy is not about: the MCMC rules are not intended to prevent children from accessing the internet or technology altogether. The focus is specifically on social media accounts, not educational tools, or messaging services or apps between family members, or the internet in general.
Reactions from the Public and Industry
The public’s reaction is mixed: predominantly supportive of the intent but divided on the details. Many parents have welcomed the shift of responsibility to platforms, relieved that online safety no longer depends solely on their own supervision.
However, critics and civil society organizations have raised legitimate concerns.
For example, ARTICLE 19, an international freedom of expression organization, argued that the ban was implemented hastily, and that the MCMC’s own public consultation report indicated that the majority of stakeholders favored risk-based age assurance measures rather than a single blanket identity verification model.
Also, the UN Committee on the Rights of the Child raised concerns about limited digital literacy, the digital divide, and inadequate privacy protections in the implementation.
From the industry side, Meta’s director of public policy for Southeast Asia, Clara Koh, cautioned that a blanket ban could backfire by pushing teenagers toward unregulated corners of the internet. This is an argument that has been made in every jurisdiction that has introduced similar rules. Meta has been promoting its own “teen accounts” system as an alternative approach.
Industry concerns are also operational. For example, platforms need to build or integrate age verification, redesign onboarding flows, update privacy notices, manage appeals, handle false positives, and prepare regulator-facing compliance evidence.
As with most significant regulatory changes, the truth likely lies somewhere between the optimism of policymakers and the concerns of critics.
How This May Affect Businesses and Tech Platforms
If your platform serves users in Malaysia, here’s what you need to plan for:
Mandatory age verification infrastructure
The era of self-declared age is over, at least in Malaysia. Platforms must implement government-ID-linked verification systems, which require genuine technical investment, integration with identity verification workflows, and ongoing monitoring to catch underage accounts that slip through.
Outcome-based compliance model
Unlike some regulations that prescribe exact methods, the ONSA framework is outcome-oriented, meaning platforms have flexibility in how they verify ages, but they’re fully accountable for the results. Additionally, platforms need to assess and document their approach and be ready to demonstrate it to the MCMC.
Extraterritorial exposure
If your platform has 8 million or more users in Malaysia, you’re subject to these rules regardless of where you’re based. This is consistent with how the EU’s DSA and Australia’s Online Safety Act also operate – jurisdiction is determined by where your users are, not where your company is.
Serious financial risk for non-compliance
Fines of up to RM10 million (US$2.5 million) are substantial, but the reputational and operational risks of being publicly named as non-compliant in a market where child safety is a top political issue are far larger.
Content moderation obligations
Beyond age gating, the Risk Mitigation Code requires platforms to implement systems to detect and remove harmful content, manage deepfakes and AI-generated content, and enable user reporting. This is a broader operational commitment than just introducing stronger age verification measures.
To sum up, Malaysia’s ONSA framework is one of the most comprehensive child online safety regimes in the world, and it’s live right now. Whether you’re a global platform or a regional service, understanding your obligations and building the systems to meet them is a must.
FAQ
