The measures come into force under the Online Safety Act 2025 and are being implemented by the Malaysian Communications and Multimedia Commission (MCMC) through two complementary frameworks: the Child Protection Code, which obliges platform providers to adopt a safety-by-design approach, and the Risk Mitigation Code, which mandates risk assessments, content governance and a content labelling mechanism.
New and existing users must now verify their age using recognised identification – including Malaysia’s national identity card, the MyKad, a passport or the government’s MyDigital ID system. Platforms must also reconfigure their algorithms and content recommendation systems to reduce users’ exposure to harmful material. Paid advertising will be restricted to verified account holders.
Platforms that fail to meet the Risk Mitigation Code’s requirements face fines of up to 10 million ringgit (US$2.5 million). The MCMC said an implementation grace period would be granted to service providers to come into compliance.
The roll-out follows a series of violent incidents that Malaysian authorities have attributed, at least in part, to social media and online gaming.
That same month, a six-year-old in Johor was allegedly attacked by his nine-year-old brother after accidentally deleting progress on the gaming platform Roblox. Separately, eight teenagers in Terengganu and Malacca states were arrested in two gang rape cases in which suspects were accused of filming and circulating the assaults online.