Malaysia Social Media Ban Under 16: ONSA 2025 Exam Guide

The Online Safety Act 2025 (ONSA), formally Act 866, is Malaysia’s primary statutory instrument for regulating harmful online content and mandating platform responsibility. It received Royal Assent on May 6, 2025, was gazetted on May 22, 2025, and came into force on January 1, 2026.

ONSA applies to service providers holding Applications Service Provider (ASP), Content Applications Service Provider (CASP), or Network Service Provider (NSP) licences under the Communications and Multimedia Act 1998. Crucially, ONSA regulates platforms, not individual users — no penalties apply to minors or their parents for bypassing the system.

ONSA establishes an Online Safety Committee within the MCMC structure, comprising representatives from key ministries, law enforcement agencies, and other stakeholders. The Act grants MCMC broad enforcement powers including investigation, search and seizure, and the authority to issue directions, undertakings, and notices of non-compliance.

Under the CPC and RMC, social media platforms must verify user age before allowing account creation using government-issued documents — Malaysia’s national identity card (the MyKad), a passport, or the government’s MyDigital ID system. This applies to both new registrations and existing accounts.

Deputy Communications Minister Teo Nie Ching clarified that personal data collected during age verification will be used solely for that purpose; platforms will not retain the identity of account holders beyond verification. Similar eKYC (electronic Know Your Customer) mechanisms are already operational in Malaysia’s e-wallet and financial services sectors.

Beyond age-gating the sign-up process, platforms must also: implement parental control tools; set privacy and safety settings to the highest level by default for child users; restrict adults from viewing children’s personal information; limit adult-to-child communications; and reconfigure search and recommendation algorithms to reduce exposure to harmful content.

A grace period will be granted to platforms to complete the verification and compliance process, though the exact duration has not been specified. No penalties apply to parents whose children circumvent the system.

The policy response is underpinned by alarming empirical data. Between January and November 2025, Malaysians lost approximately RM 2.7 billion to online scams. The Internet Watch Foundation recorded 12,656 reports of Child Sexual Abuse Material (CSAM) originating from Malaysia in just the first six months of 2025 — representing 78% of the total 16,238 CSAM reports for the entire year of 2024.

Under Ops Pedo 2.0, a joint operation by the Royal Malaysia Police and MCMC from September 23–30, 2025, authorities seized nearly 900,000 CSAM files. MCMC separately received 1,578 requests between 2022 and early 2026 to remove highly offensive content involving children, of which 96% were successfully taken down.

Unicef Malaysia warned that CSAM had surpassed cyberbullying as the number one online threat to children in Malaysia. Two high-profile incidents directly accelerated legislative action: a TikTok cyberbullying case that ended in the suicide of a victim, and the exposure of paedophilia syndicates operating through social media platforms — both cited by Minister Fahmi Fadzil as catalysts for regulatory intervention.

The mandate applies to social media platforms with at least 8 million registered users in Malaysia — a threshold designed to capture dominant platforms while exempting smaller services. Platforms currently in scope include Facebook, Instagram, TikTok, and YouTube. Compliance is required regardless of whether a platform is based inside or outside Malaysia.

Platforms must implement: age verification for registration; restrictions on under-16s owning accounts independently; limits on high-risk features for child users; restrictions on adult-to-child communications; default high-privacy settings for child accounts; parental monitoring tools; effective harmful content reporting mechanisms; and active monitoring to detect adults creating accounts on behalf of minors.

The harmful content categories addressed under the RMC include: Child Sexual Abuse Material (CSAM), financial fraud, obscene or indecent content, harassment and distress-inducing content, content inciting violence or terrorism, content that may induce a child to self-harm, content promoting communal hostility, and material promoting dangerous drugs.

The enforcement has not been without controversy. The UN Committee on the Rights of the Child, in its Concluding Observations on Malaysia in February 2026, expressed concern that the government’s approach was inadequate in ensuring inclusive digital access, flagged a significant digital divide and lack of digital literacy infrastructure, and recommended that Malaysia adopt a child rights-based approach rather than a blunt age-based prohibition.

Civil society organisations raised concerns about executive overreach: the restrictions were introduced through subsidiary legislation (the two codes) rather than through primary legislation, raising questions of democratic legitimacy. Critics argued that Section 18 of ONSA itself contemplates children’s access to digital platforms and focuses on making those environments safer — making the ban via subsidiary code potentially inconsistent with the parent Act.

Privacy advocates highlighted concerns about large-scale biometric and document-based age verification. Experts also warned that a blunt ban may push young users into less regulated spaces — VPNs, dark-web platforms, or messaging apps below the 8-million-user threshold — without actually reducing exposure to harmful content. A consultation period (February 12–March 31, 2026) was criticised as insufficient by several stakeholders.

Malaysia’s ban is part of a significant international movement towards state-mandated age restrictions on social media, with variations in approach and enforcement across jurisdictions.