Malaysia's MCCA Nails the Digital Education Argument and Misses the Obvious Conclusion

Key Takeaways

• Starting June 1, Malaysia's ONSA codes require social media users to verify their age with government-issued documents, blocking under-16s from opening accounts.
• The Malaysia Cyber Consumer Association supports the mechanism but says it must be paired with comprehensive digital education to prepare young people for online life.
• MCCA president Siraj Jalil is correct that education is the foundational tool for digital safety, but that argument points away from ID-based gatekeeping, not toward it.
• A child who has been taught critical thinking, privacy awareness, and safe online behavior doesn't need a government ID checkpoint to be protected online.

The Part Where MCCA Gets It Exactly Right

On May 26, MCCA president Siraj Jalil appeared on Bernama TV's Ruang Bicara program to voice his support for Malaysia's incoming age verification mechanism while calling for something the government has so far treated as an afterthought: actual education. Effective June 1, the Malaysian Communications and Multimedia Commission's Child Protection Code and Risk Mitigation Code require social media users to upload official government-issued documents for age verification, blocking anyone under 16 from opening accounts.

Siraj's education argument is worth taking seriously on its own terms. He said education on safe internet and social media usage should be instilled from an early stage, that parents need to improve their own cybersecurity literacy before they can meaningfully guide their children, and that, without preparation, young people entering digital platforms face culture shock rather than competence.

All of that is correct. It's the kind of thing that rarely comes from consumer associations backing government policy, and it deserves the acknowledgment. Siraj is right that knowledge is the key factor in shaping responsible digital users. And yet, this unfortunately comes together with another, much less forward-thinking decision.

The Part Where the Logic Eats Itself

If education is what actually prepares children for a safe digital life, then the ID verification gate is a bypass of that preparation, not a supplement to it. A child blocked from social media until 16 hasn't learned anything. They've been held back. A child who has been taught from age 10 how platforms work, how data moves, what manipulation looks like, and how to protect their privacy arrives at 16 with something worth far more than a cleared checkpoint.

This is exactly the argument Estonia made at the EU level when regulators were debating how to handle teenagers online. Rather than endorsing age gates, Estonia pushed to regulate the platforms themselves and invest in digital literacy. The logic was the same: you don't protect children by keeping them ignorant behind a door. You protect them by teaching them what's on the other side of it. Siraj's own framing supports this conclusion. He just somehow failed to follow it there.

What the ID Requirement Actually Builds

The June 1 mechanism doesn't ask for a PIN, a parental approval tick, or a school email. It asks for government-issued documents uploaded to social media platforms. That’s pretty much a surveillance feature pretending to be a child safety measure, and Malaysia has been moving toward mandatory identity verification on social media for some time. The ONSA codes are the mechanism that finally enforces it.

What that infrastructure produces is a database of identity documents held by platforms with well-documented breach histories, available to any government that decides it needs them, anchored by a verification mechanism that a determined 14-year-old with access to a parent's ID can circumvent in minutes. Not only doesn’t it make the internet safer for children (or, for that matter, stop them from accessing those platforms), but it actually makes it all even more dangerous.

Teach Kids, Ditch the Gate

I'd put it simply: MCCA has made the right argument and drawn the wrong conclusion. If the goal is digital safety, then digital education isn't the thing that should come alongside age verification, but something that should replace it. Build the curriculum, upskill the parents, and run the community dialogues Siraj is calling for. Do all of that, but scrap the document upload requirement, because it protects no one and compromises everyone.

If you're navigating a digital landscape increasingly built on identity collection and data exposure (which, let’s be real, you most likely are), Mysterium VPN is built for exactly that. The reality is that things are hardly getting any better, so get Mysterium VPN with 82% off now and protect your privacy yourself before the “ban everything for child safety” campaign turns it into a thing of the past.