MCMC sets new age verification standards for social platforms

Malaysia’s latest push to tighten online safety regulation is set to reshape how social media platforms operate, with age verification emerging as a key requirement that marketers and agencies will need to factor into youth-focused digital strategies.

The Malaysian Communications and Multimedia Commission (MCMC) has published the Child Protection Code (CPC) and Risk Mitigation Code (RMC) under the Online Safety Act 2025 (ONSA), introducing a framework that places stronger accountability on social media platforms to protect children online.

At the centre of the CPC is a clear requirement, that users under the age of 16 will not be permitted to register for social media accounts. Platforms will be required to implement robust age verification systems to prevent underage account creation and ensure compliance across both new and existing users.

Don't miss: How agencies in M'sia are preparing for the under-16 social media ban

Platforms will be expected to verify age using government-issued records or equivalent official documentation, such as MyKad or passports. While implementation will vary across service providers, the CPC emphasises that systems must be secure, privacy-compliant and user-friendly. Existing under-16 users will also be required to undergo verification as part of the rollout.

Importantly, Malaysia’s approach is outcome-based rather than technology-prescriptive, meaning platforms can choose how they implement verification as long as regulatory requirements are met. This opens the door for a range of solutions, from document-based checks to more advanced identity verification systems, as long as they are accurate and secure.

The CPC also sets expectations beyond registration. Platforms must ensure that child users are not exposed to manipulative design features, that safe search is enabled by default, and that recommendation systems do not surface harmful content.

Privacy and safety settings must also be set to the highest level by default, while direct communication between unknown adults and child users must be restricted.

The Risk Mitigation Code (RMC) complements these measures by requiring platforms to take proactive steps in identifying and removing harmful content, including stronger reporting systems, advertiser verification measures and labelling of manipulated media where relevant.

Together, the CPC and RMC form part of Malaysia’s broader implementation of ONSA, which also includes platform accountability measures, enhanced reporting mechanisms and nationwide digital literacy efforts aimed at improving online safety across user groups.

"The codes set clear expectations for service providers to take greater responsibility in addressing online harms within their services, particularly in safeguarding children and vulnerable users," said the MCMC. 

The two codes will take effect from 1 June 2026, with a grace period provided for platforms to fully implement age verification and other compliance requirements.

In November last year, the Malaysian government had set in motion plans to bar teens under 16 from signing up for social media accounts, raising the age limit from the earlier proposed threshold of 13. 

The communications ministry shared at the time that all platform providers will be required to implement electronic know-your-customer (eKYC) identity verification by then. Registration will rely on official documents such as MyKad, passports and MyDigital ID.

The move is part of wider protections under the Online Safety Act (ONSA), which cameinto force on 1 January. It followed September's cabinet decision to raise the minimum age for social media users to 16. The proposal arrives amid mounting concerns over cyberbullying, sexual harassment and behavioural issues among schoolchildren, often tied to early and unregulated exposure to social media.

Related articles: 
Singapore considers Australia's social media ban for users under 16
Australia passes law banning social media access for children under 16 
Indonesia moves to bar under-16s from social media in sweeping digital safety push