Three months after Malaysia began enforcing a minimum age of 16 for social media, most of what circulates about the rule is either out of date or wrong. It is not a ban on children using the internet, it does not cover every app your child has, and the deadline for existing accounts has not arrived yet.

Everything below is read from the primary documents: the Online Safety Act 2025 (Act 866) as published by the Malaysian Communications and Multimedia Commission (MCMC), the Child Protection Code itself, MCMC's media statement of 1 June 2026, its FAQ on the Child Protection Code dated the same day, and MCMC's under-16 information page, all read on 13 September 2026.

Where the rule comes from

The Online Safety Act 2025 received royal assent on 6 May 2025, was published in the Gazette on 22 May 2025 and came into force on 1 January 2026. It regulates platforms, not individual users. Section 18 gives licensed platforms a duty to ensure their services are used safely by children, and the Act defines a child as anyone under 18.

Section 80 lets MCMC issue codes spelling out how those duties are met. The Child Protection Code was published on 22 May 2026 and took effect on 1 June 2026, alongside a separate Risk Mitigation Code. Paragraph 3.1 of the Child Protection Code is the line that matters: a licensed social media service likely to be used by children must use "effective age verification measures" so that only users identified as sixteen years and above can register and use the service.

Which platforms, and which they are not

MCMC's 1 June statement and its FAQ name Facebook, Instagram, TikTok and YouTube. The requirement applies to licensed social media services with eight million or more users in Malaysia, and FAQ question 28 says more platforms "may be brought within scope over time" if children move elsewhere.

WhatsApp and Telegram are also above the eight-million line, and The Star reported on 3 March 2026 that both are deemed licensed. But section 2(2) of the Act says it does not apply to a "private messaging feature", and neither app is named in MCMC's age-verification statement. So a 14-year-old's family WhatsApp group is not what this rule is aimed at. The Code and FAQ say nothing about gaming platforms.

How the age check works

Paragraph 3.2 of the Code requires age to be verified against records issued by the Government of Malaysia, such as a MyKad, passport or birth certificate, or equivalent records from another country. MCMC calls its approach technology-neutral: no particular app or method is mandated, and FAQ question 17 points platforms to the electronic know-your-customer (e-KYC) practices used in banking. Neither the Code nor the FAQ names MyDigital ID as a requirement.

The Code also limits what platforms may do with the documents. Data collected for the check must be limited to what is necessary and not kept longer than the check requires, in line with the Personal Data Protection Act 2010.

The deadline that has not arrived yet

New accounts have been age-checked since 1 June. Existing accounts are different. MCMC's statement gives platforms up to six months to verify existing users progressively. Counting from 1 June, that window closes at the end of November 2026; MCMC has not printed a calendar date.

Within that period, an existing user identified as under 16 gets one month to download or transfer their data, including photos and videos, before the platform restricts, suspends or otherwise acts on the account. FAQ question 13 adds that users who do not complete verification, or cannot be verified as 16 or older, will lose access once any grace period ends.

If your teenager has not yet been asked to verify on Instagram or TikTok, that is not a sign they have been missed. It is more likely that their platform has not reached them in its rollout.

The parent's account: two MCMC pages disagree

This is the part most families will run into. MCMC's under-16 page, written for parents, says: "Your child under 16 may access social media through your account, with your knowledge and supervision." Its message to children says the same. The page divides users into three bands: 15 and below, no social media account; 16 and 17, accounts with parental controls and the highest privacy settings by default; 18 and above, free to use.

MCMC's FAQ, published the same day, answers the question "Can child users simply use their parents' accounts instead?" differently. It calls the use of adult accounts by children "a recognised risk" and says platforms are expected to prevent and mitigate it, including by detecting suspicious account behaviour.

Both can be true at once: a supervised child on a parent's phone is tolerated, while an adult account run by a child is something platforms are expected to catch. But it means a shared account is not a guaranteed workaround, and it may be flagged.

What else changes for under-18s

The Code's protections do not stop at 16. For every user under 18, licensed platforms must:

  • Detect and remove the nine types of harmful content listed in the Act's First Schedule, which include child sexual abuse material, financial fraud, content inducing self-harm and content promoting dangerous drugs.
  • Offer reporting tools that children can understand, and stop repeat exposure to content already reported.
  • Provide parental controls to monitor and manage a child's activity.
  • Set privacy to age-appropriate or the highest level by default, and limit unknown adults from contacting children.
  • Limit design features that keep children using the service longer, and switch on safe search by default.

What happens to platforms that do not comply

Under section 39 of the Act, a licensed platform that fails any of its Part III duties, which include the child-safety duty, can be made to pay a financial penalty of up to RM10 million. Separately, ignoring certain written instructions from MCMC is an offence carrying a fine of up to RM1 million on conviction plus up to RM100,000 for every day it continues. Some coverage has blended the two figures.

On enforcement so far, the Communications Ministry told Parliament in a written reply reported by The Star on 4 August 2026 that MCMC had issued written notices under section 30(2) asking social media providers to explain instances of non-compliance and their age-verification measures. We found no announced penalty against any platform as of 13 September 2026.

Parents are not penalised. FAQ question 24 says regulatory action is not intended against parents or guardians.

The rule has critics. In April 2026 the rights group ARTICLE 19 and more than 70 organisations wrote to the Prime Minister asking for the plan to be withdrawn, citing the privacy risk of tying social media accounts to identity documents.

What to do now

  1. When a platform asks your teen to verify, use the platform's own in-app flow. MCMC's page tells users to follow the guidance their platform provides. Nobody needs to send a MyKad photo to a stranger who messages about "verification".
  2. If your child is under 16 and has an account, download their photos and videos now rather than waiting for the one-month notice.
  3. Set up the platform's parental tools. MCMC's parent resources link to Meta Family Centre, TikTok Family Pairing, Google Family Link and Apple Screen Time.
  4. Report harmful content on the platform first, then to MCMC at aduan.mcmc.gov.my.

Related reads

*Cover image: paragraph 3 of the Child Protection Code (Image: Malaysian Communications and Multimedia Commission)*

*Read from MCMC's Child Protection Code, FAQ, 1 June 2026 media statement and under-16 page, and the text of Act 866, on 13 September 2026. MCMC notes that its FAQ is updated from time to time.*