Malaysia’s Online Safety Act 2025 (OSA) introduces significant reforms to the country’s online content regulatory framework, including a new Child Protection Code (the Code) that will materially affect how licensed service providers manage child safety obligations across their platforms.
Its scope applies to licensed applications service providers (ASPs) and licensed content applications service providers (CASPs) that use Internet access and covers age verification, harmful content management, duty of care obligations towards minors, and broader platform accountability measures across Malaysia’s digital economy.
The Code became effective on 1 June 2026 and was published alongside the Risk Mitigation Code on 22 May 2026 by the Malaysian Communications and Multimedia Commission (MCMC). Together, these instruments create a formal regulatory framework that requires licensed service providers to implement structured child safety mechanisms, deploy age assurance measures, and prepare documented Online Safety Plans addressing their duty of care obligations towards children under the age of 16.
The changes are intended to strengthen platform accountability and ensure that services likely to be accessed by children adopt proactive and operationally embedded safety measures rather than reactive or ad hoc responses. Importantly, however, the framework follows an outcome-based approach that allows providers flexibility in implementing safety measures, rather than prescribing a single method of compliance.
What falls within scope
The Code’s application is not limited to platforms explicitly targeting children. It applies to licensed social media services with at least 8 million users in Malaysia, a threshold that captures major platforms, including Facebook, Instagram, TikTok and YouTube.
Essentially, organisations should expect a wide range of consumer-facing platforms and applications to fall within scope, with obligations potentially arising in connection with:
- platforms and applications accessible via Internet services that children are reasonably likely to use, where the service meets the applicable licensing threshold
- the prohibition on users below the age of 16 from registering social media accounts, with platforms expected to implement reasonable measures to prevent such registrations
- age verification and age assurance processes applied at the point of access or account creation, verified against government-issued records
- parental controls, privacy and safety settings, and search and recommendation systems designed to protect child users
- the management and moderation of content that may be harmful to minors
- advertiser verification, synthetic media labelling, and internal assurance processes under the Risk Mitigation Code
- any failure to implement a compliant Online Safety Plan addressing duty of care obligations towards users under the age of 16
As a result, organisations operating consumer-facing digital services in Malaysia should assess carefully whether their platforms fall within the scope of the new framework.
Age verification requirements
Under the Code, licensed service providers must deploy age verification mechanisms across platforms likely to be accessed by children and take reasonable measures to prevent users below the age of 16 from registering social media accounts.
Verification is conducted against government-issued records, though the outcome-based nature of the framework means providers retain some flexibility in how they implement age assurance processes in practice. Given the sensitivity of the personal data involved, organisations should ensure their Data Protection Officer (DPO) is consulted on the design of age verification flows and any associated data retention or processing decisions.
For existing users, age verification will be implemented progressively by service providers over a period of up to six months, with individual platforms expected to announce their own verification processes and timelines
The Code also introduces broader operational obligations relating to how services are designed, governed, and monitored in respect of child safety.
Online Safety Plan obligations
Licensed service providers must prepare an Online Safety Plan documenting how they will meet their duty of care obligations towards minors under the age of 16. This requires organisations to take structured and documented steps to identify risks to children on their platforms, implement proportionate safety measures, and establish internal governance processes to monitor and review child safety performance on an ongoing basis.
The DPO can play a valuable role here, given the significant overlap between Online Safety Plan obligations and data protection impact assessment processes, particularly where age verification and child data processing are involved
Parental controls, privacy settings, and platform design
The Code introduces requirements across a broader range of platform features than age verification alone. Organisations must implement parental controls, privacy and safety settings, and measures governing search and recommendation systems to ensure these features operate in an age-appropriate manner for child users. These obligations reflect the Code’s child-safety-by-design philosophy, requiring platforms to embed protections into their core product architecture rather than applying them as surface-level controls.
Harmful content and platform governance
The Risk Mitigation Code, published alongside the Child Protection Code, introduces broader obligations on harmful content management, advertiser verification, synthetic media labelling, and internal assurance processes. Organisations must ensure that their content moderation frameworks, advertiser onboarding processes, and platform governance arrangements are capable of meeting these requirements.
Non-compliance carries fines of up to RM10 million, underscoring the seriousness with which Malaysian regulators are approaching platform accountability.
Updates to platform policies and user-facing communications
The Code also introduces proactive transparency obligations. Platforms must ensure that their terms of service, privacy notices, and user-facing safety communications are updated to reflect the new child safety framework. This includes informing users of the age verification requirements applicable to the service and the steps the organisation is taking to meet its duty of care obligations towards children. Individual companies are expected to announce their own verification processes and implementation timelines, meaning user-facing communications will need to be kept current as these processes are confirmed.
Organisations should review all relevant user-facing documentation and platform disclosures as a matter of priority.
Preparing for compliance
A reasonable implementation period has been confirmed by the MCMC, allowing service providers to operationalise requirements following the 1 June 2026 commencement date, with age verification for existing users to be rolled out progressively over a period of up to six months. However, organisations that have not yet begun preparing should act promptly. The following steps should be prioritised:
- Conducting a gap analysis of existing age verification, content moderation, parental controls, privacy settings, and platform governance frameworks against the requirements of the Child Protection Code and Risk Mitigation Code
- Assessing whether the platform meets the licensing threshold of 8 million users in Malaysia and confirming the scope of obligations that apply
- Drafting or updating internal child safety policies covering age assurance, the under-16 account registration prohibition, harmful content management, duty of care obligations, and escalation procedures
- Deploying age verification mechanisms against government-issued records, with an implementation plan for both new registrations and the progressive verification of existing users over the six-month rollout period
- Preparing a compliant Online Safety Plan that documents the organisation’s approach to identifying risks to minors, implementing safety measures, and maintaining ongoing governance oversight
- Implementing parental controls, age-appropriate privacy and safety settings, and measures governing search and recommendation systems in line with the Code’s child-safety-by-design requirements
- Reviewing and updating terms of service, privacy notices, and user-facing safety communications to reflect the new regulatory framework, and planning for ongoing updates as individual verification timelines are confirmed
- Documenting internal workflows for content moderation, advertiser verification, synthetic media labelling, and internal assurance processes in line with the Risk Mitigation Code
- Establishing internal governance structures with clearly defined ownership across legal, compliance, product, and trust and safety teams to ensure obligations are met consistently. The DPO should be included as a key stakeholder in this governance structure, given their expertise in data protection risk and their existing visibility across legal, compliance, and product functions.
- Reviewing contractual arrangements with third-party content providers, advertisers, and technology partners to ensure compliance obligations and cooperation requirements can be satisfied in practice
- Training relevant staff, including trust and safety teams, legal and compliance personnel, and customer-facing functions, on identifying child safety risks, applying age assurance procedures, and escalating concerns in accordance with the organisation’s Online Safety Plan
- Incorporating child safety metrics, Online Safety Plan performance indicators, and Risk Mitigation Code compliance outcomes into wider platform governance and senior management reporting processes
While many organisations already operate content moderation and user safety frameworks, the Child Protection Code and Risk Mitigation Code together create a formal statutory regime with prescribed obligations, stringent age assurance requirements, and significant financial penalties specifically focused on child online safety.
At HewardMills, we support organisations in building child safety and platform governance frameworks that are operationally sound and fully compliant with Malaysia’s Online Safety Act 2025 and the expectations of Malaysian regulators, from gap analysis and policy drafting through to Online Safety Plan preparation and staff training.
To discuss your organisation’s readiness, contact our team. We’re here to help.
