Govt sets 16 as minimum age for social media under new online safety rules | Malaysia

Malaysia will mandate age verification for social media users starting June 1, 2026, under the Online Safety Act 2025. Communications Minister Datuk Fahmi Fadzil stated the “Await 16” initiative bars users under 16 from creating accounts, requiring official government-issued identification to ensure child safety and reduce online exploitation.

Why is Malaysia implementing the “Await 16” initiative?

The Malaysian government is introducing mandatory age verification to shield minors from harmful online content and exploitation. According to Communications Minister Datuk Fahmi Fadzil, children are more susceptible to digital risks due to their ongoing cognitive and emotional development.

Fahmi Fadzil noted that algorithm-driven content distribution increases the risk of excessive platform use and exposure to inappropriate material. The “Await 16” (Tunggu 16) initiative acts as a delay mechanism. It ensures users reach a specific level of maturity before accessing social media independently.

How will age verification work under the Online Safety Act 2025?

The Malaysian Communications and Multimedia Commission (MCMC) will oversee the framework through the Child Protection Code (CPC) and the Risk Mitigation Code (RMC). These codes shift the burden of proof from the user to the platform.

Users must provide official government-issued documentation to register. Accepted documents include MyKad, passports, and birth certificates. For foreign nationals, equivalent official documents are accepted to maintain equitable access. The government has explicitly banned the use of self-declaration for age verification.

To protect user privacy, the CPC mandates data minimisation. This means platforms can only collect information necessary for verification and must delete that data once the process is complete. Minister Fahmi Fadzil clarified that the government is not mandating a specific technology, provided the chosen method effectively prevents underage registration.

How does Malaysia’s approach compare to other countries?

Malaysia is following a global trend toward stricter digital boundaries for minors. Datuk Fahmi Fadzil cited Australia, Brazil, and Indonesia as nations that have already adopted age verification or age-appropriate design measures.

What happens to privacy and data security?

The requirement for government IDs raises concerns about data breaches. The government is addressing this by integrating “safety-by-design” requirements into the CPC. Platforms must comply with existing data protection laws to prevent the misuse of sensitive identification documents.

By requiring the deletion of verification data after the account is validated, the framework attempts to balance security with privacy rights. This approach mirrors trends seen in the GDPR (General Data Protection Regulation) framework in Europe, which emphasizes purpose limitation.

Will this stop children from using social media?

The government describes this as a “delay mechanism” rather than a permanent ban. The goal is to ensure users reach a threshold of maturity before they are exposed to the risks of independent digital engagement.

However, the effectiveness of such laws often depends on the rigor of enforcement. The Online Safety Act 2025 includes financial penalties for non-compliant providers to ensure that platforms do not ignore the verification requirements in favor of user growth.

For more information on digital safety, check out our guide on managing children’s screen time.

Frequently Asked Questions

When does the age verification start?
The Child Protection Code and Risk Mitigation Code become effective on June 1, 2026.

What is the minimum age for social media in Malaysia?
Under the “Await 16” initiative, individuals must be 16 years or older to register and maintain social media accounts.

Can I just type in my birthdate to verify my age?
No. The government has mandated reliance on official records (MyKad, passports, etc.) rather than self-declaration.

Will the government keep a copy of my ID?
According to the CPC, service providers must follow data minimisation principles and delete verification information once the purpose is fulfilled.