Five months after Malaysia began enforcing a minimum age of 16 for social media, most of what circulates about the rule is either out of date or wrong. It is not a ban on children using the internet, it does not cover every app your child has, the deadline for existing accounts has not arrived yet, and the late-October headlines about under-16s and WhatsApp describe advice to parents, not a new rule.
The rule itself is read from the primary documents: the Online Safety Act 2025 (Act 866) as published by the Malaysian Communications and Multimedia Commission (MCMC), the Child Protection Code itself, MCMC's media statement of 1 June 2026, its FAQ on the Child Protection Code dated the same day, and MCMC's under-16 information page, first read on 13 September 2026, with MCMC's page and FAQ re-checked on 2 November 2026. Later developments are credited to the reports they came from.
Where the rule comes from
The Online Safety Act 2025 received royal assent on 6 May 2025, was published in the Gazette on 22 May 2025 and came into force on 1 January 2026. It regulates platforms, not individual users. Section 18 gives licensed platforms a duty to ensure their services are used safely by children, and the Act defines a child as anyone under 18.
Section 80 lets MCMC issue codes spelling out how those duties are met. The Child Protection Code was published on 22 May 2026 and took effect on 1 June 2026, alongside a separate Risk Mitigation Code. Paragraph 3.1 of the Child Protection Code is the line that matters: a licensed social media service likely to be used by children must use "effective age verification measures" so that only users identified as sixteen years and above can register and use the service.
Which platforms, and which they are not
MCMC's 1 June statement and its FAQ name Facebook, Instagram, TikTok and YouTube. The requirement applies to licensed social media services with eight million or more users in Malaysia, and FAQ question 28 says more platforms "may be brought within scope over time" if children move elsewhere.
WhatsApp and Telegram are also above the eight-million line, and The Star reported on 3 March 2026 that both are deemed licensed. But section 2(2) of the Act says it does not apply to a "private messaging feature", and neither app is named in MCMC's age-verification statement. So a 14-year-old's family WhatsApp group is not what this rule is aimed at.
WhatsApp and online games: what changed in October
WhatsApp and Telegram. Late-October headlines said the government wants parents to stop under-16s using WhatsApp. NST and SAYS both reported Communications Minister Fahmi Fadzil urging parents not to allow it, because they may not know who their children are talking to or what is shared in chat groups. That is a call to parents, not a law. In the reports we read it appears as a paraphrase. His direct quotes from the 28 October event, in Bernama's report, are about encrypted private groups, where "bullying sometimes begins or becomes widespread". He also confirmed that private messaging services are outside the Act: "The review of private communication platforms is ongoing, and no measures have been implemented at this stage."
He spoke alongside MCMC's latest count: 47,412 cyberbullying posts flagged for removal from January to 27 October, based on public complaints, with 81% on TikTok and 12% on Facebook.
The age figure needs care. Scoop reported Fahmi saying on 18 October that WhatsApp has set a minimum age of 16, and that he would ask MCMC to engage Meta. WhatsApp's terms of service, read on 2 November, say 13 "or such greater age required in your country or territory", and allow a parent-managed account below that age where available. We found no WhatsApp document stating 16 for Malaysia, so treat that figure as unconfirmed.
The pushback is practical. Malaysia Cyber Consumer Association president Siraj Jalil told NST on 29 October that WhatsApp has become the main channel between schools, parents and students, and that restricting it without alternatives could backfire. Meanwhile, ProductNation reported on 5 October that WhatsApp is gradually rolling out optional parental controls for teen accounts. Parents can decide who sees a teen's profile photo or adds them to groups, and loosening a setting needs a parent-set PIN. Parents cannot read messages, which stay end-to-end encrypted.
Online games. The Code and FAQ say nothing about gaming platforms, and MCMC told The Star on 4 October that online gaming is not a distinct licensed service category. On 19 October Fahmi said the government would study whether eKYC and age checks could extend to platforms such as Roblox. That is a study, not a rule. Separately, the Communications and Multimedia Content Forum has proposed a Gaming Sub-Code. The Star reports it could require high-risk features to be off by default on children's accounts, including voice chat with strangers, messages from non-contacts and paid randomised rewards. Its public consultation closed on 24 October, and it is expected to take effect next year, subject to registration with MCMC.
How the age check works
Paragraph 3.2 of the Code requires age to be verified against records issued by the Government of Malaysia, such as a MyKad, passport or birth certificate, or equivalent records from another country. MCMC calls its approach technology-neutral: no particular app or method is mandated, and FAQ question 17 points platforms to the electronic know-your-customer (e-KYC) practices used in banking. Neither the Code nor the FAQ names MyDigital ID as a requirement. On 23 October, Bernama reported Fahmi naming MyKid, birth certificates and MyKad as documents that can show a user is 16 or above.
The Code also limits what platforms may do with the documents. Data collected for the check must be limited to what is necessary and not kept longer than the check requires, in line with the Personal Data Protection Act 2010.
Do not confuse this with Google's own system. On 23 September Google said it was bringing age estimation to Malaysia. It is a separate check at under 18, not 16, and it guesses from signals already on your account, such as the types of things you search for. An account it estimates to be under 18 gets SafeSearch on by default, mature material blocked on Play and Gemini, and no personalised ads. An adult wrongly caught can correct it by uploading a government ID photo or a selfie.
The deadline that has not arrived yet
New accounts have been age-checked since 1 June. Existing accounts are different. MCMC's statement gives platforms up to six months to verify existing users progressively. Counting from 1 June, that window closes at the end of November 2026; MCMC has not printed a calendar date. As of 2 November we found no announcement extending it, and the FAQ file on MCMC's page is still the version created on 1 June.
Within that period, an existing user identified as under 16 gets one month to download or transfer their data, including photos and videos, before the platform restricts, suspends or otherwise acts on the account. FAQ question 13 adds that users who do not complete verification, or cannot be verified as 16 or older, will lose access once any grace period ends.
If your teenager has not yet been asked to verify on Instagram or TikTok, that is not a sign they have been missed. It is more likely that their platform has not reached them in its rollout.
The parent's account: two MCMC pages disagree
This is the part most families will run into. MCMC's under-16 page, written for parents, says: "Your child under 16 may access social media through your account, with your knowledge and supervision." Its message to children says the same. The page divides users into three bands: 15 and below, no social media account; 16 and 17, accounts with parental controls and the highest privacy settings by default; 18 and above, free to use.
MCMC's FAQ, published the same day, answers the question "Can child users simply use their parents' accounts instead?" differently. It calls the use of adult accounts by children "a recognised risk" and says platforms are expected to prevent and mitigate it, including by detecting suspicious account behaviour.
Both can be true at once: a supervised child on a parent's phone is tolerated, while an adult account run by a child is something platforms are expected to catch. But it means a shared account is not a guaranteed workaround, and it may be flagged.
What else changes for under-18s
The Code's protections do not stop at 16. For every user under 18, licensed platforms must:
- Detect and remove the nine types of harmful content listed in the Act's First Schedule, which include child sexual abuse material, financial fraud, content inducing self-harm and content promoting dangerous drugs.
- Offer reporting tools that children can understand, and stop repeat exposure to content already reported.
- Provide parental controls to monitor and manage a child's activity.
- Set privacy to age-appropriate or the highest level by default, and limit unknown adults from contacting children.
- Limit design features that keep children using the service longer, and switch on safe search by default.
What happens to platforms that do not comply
Under section 39 of the Act, a licensed platform that fails any of its Part III duties, which include the child-safety duty, can be made to pay a financial penalty of up to RM10 million. Separately, ignoring certain written instructions from MCMC is an offence carrying a fine of up to RM1 million on conviction plus up to RM100,000 for every day it continues. Some coverage has blended the two figures.
On enforcement so far, the Communications Ministry told Parliament in a written reply reported by The Star on 4 August 2026 that MCMC had issued written notices under section 30(2) asking social media providers to explain instances of non-compliance and their age-verification measures. We found no announced penalty against any platform as of 2 November 2026.
On 23 October, Bernama reported Fahmi saying providers could be fined up to RM10 million per offence "from early next year". "We are giving them time, but I hope it will not come to the point where we have to impose fines," he said. The Act has been in force since January, so we read that as a signal of when penalties may start, not a change in the law.
Parents are not penalised. FAQ question 24 says regulatory action is not intended against parents or guardians.
The rule has critics. In April 2026 the rights group ARTICLE 19 and more than 70 organisations wrote to the Prime Minister asking for the plan to be withdrawn, citing the privacy risk of tying social media accounts to identity documents. The objections have not gone away since the Code took effect. Malay Mail reported on 16 September 2026 that MCMC's public consultation drew 21 respondents, including Meta, Google, TikTok, X Corp and Roblox as well as the major telcos, and that most argued for flexible, risk-based age assurance rather than strict ID checks. The Centre for Independent Journalism warned that people without national IDs, such as stateless children and refugees, could be shut out, and Suhakam's Children's Commissioner flagged the risk of MyKad details being leaked or misused. None of this has changed the rule: the MyKad-or-equivalent requirement in paragraph 3.2 still stands.
What to do now
- When a platform asks your teen to verify, use the platform's own in-app flow. MCMC's page tells users to follow the guidance their platform provides. Nobody needs to send a MyKad photo to a stranger who messages about "verification".
- If your child is under 16 and has an account, download their photos and videos now rather than waiting for the one-month notice.
- Set up the platform's parental tools. MCMC's parent resources link to Meta Family Centre, TikTok Family Pairing, Google Family Link and Apple Screen Time.
- Treat WhatsApp as a family decision. No law requires you to remove it, and school groups may run on it. If your child stays on it, check whether WhatsApp's teen controls have reached your account, and ask who is in their groups.
- Report harmful content on the platform first, then to MCMC at aduan.mcmc.gov.my.
