Malaysia's Online Safety Codes Are Live and So Is the Age Verification Problem

Key Takeaways

• Malaysia's MCMC published the Child Protection Code and Risk Mitigation Code under the Online Safety Act 2025 on May 22, with both taking effect June 1, 2026.
• The codes require social media platforms to verify users' ages using government-issued documents such as national ID cards and passports, blocking account registration for anyone under 16.
• The Risk Mitigation Code mandates proactive content moderation, risk assessments, content governance, and advertiser verification, with fines of up to RM10 million for non-compliance.
• During public consultation, stakeholders including ARTICLE 19 and Amnesty International Malaysia warned that "harmful content" is too broadly defined and that the framework hands MCMC excessive regulatory power.
• Age verification via government ID means platforms will hold sensitive identity data on all users, not only minors.

Not Australia, but Not Without Its Problems Either

Age verification laws follow a pattern. A government identifies a real problem, builds a regulatory framework around it, and the framework looks reasonable on paper while the implementation runs on government ID and hands a single regulator broad definitional power. Malaysia's new online safety codes, published May 22 and taking effect June 1, follow that pattern.

The good news is that this is not Australia's approach. Australia banned social media for under-16s outright. Malaysia's framework is outcome-based and technology-neutral, closer to the UK model, acknowledging that different platforms carry different risks. The problems start when you look at what implementation actually requires.

Your Passport Is Now a Platform Requirement

Under the Child Protection Code, social media platforms with eight million or more users in Malaysia must prevent anyone under 16 from registering an account, using verification against government-issued records as the mechanism. Malaysia's national ID card, a passport, or an equivalent official document. Self-declaration is no longer accepted.

The official FAQ frames this as limited and proportionate: platforms must collect only what is necessary for verification and comply with Malaysian data protection law. What that framing cannot guarantee is that the infrastructure built today will not be extended tomorrow or hold up when a platform gets breached. Platforms that fail to comply face fines of up to RM10 million.

When "Harmful Content" Can Mean Almost Anything

The Risk Mitigation Code's proactive moderation requirement is the quieter problem. Platforms must assess harmful content risks before users encounter them, adapt algorithmic systems to reduce exposure, and respond promptly to removal requests from MCMC or any other enforcement agency. That last clause is doing a lot of work.

The definition of harmful content under the codes covers child sexual abuse material, financial fraud, obscene content, harassment, incitement to violence, and content that promotes ill-will or hostility amongst the public. Most of those categories are defensible. Some are not. "Ill-will or hostility" and "harassment or distress" are broad enough to cover political speech, satire, and journalism depending on who is interpreting them. During the public consultation, stakeholders warned that definitions may be too broad and that pre-publication assessments could amount to censorship. The consultation happened, yet the broad definitions remained.

ARTICLE 19 warned when the bill passed that the framework would result in lawful content being removed and open the door for government to exploit platforms' moderation systems. Amnesty International Malaysia added that the failure to establish clear parameters enables arbitrary applications of the law to illegitimately criminalize non-harmful content. 

The UK's experience with its own online safety framework, where proactive moderation pressure produced consistent over-removal of legal content, is a working preview of where this lands.

The Infrastructure Outlasts the Intent

Age verification via government ID is identity verification. Keeping under-16s off social media requires knowing a user's age, not their name or national ID number. The MCMC FAQ says data must be limited to what is necessary for verification. What it cannot guarantee is that this infrastructure will stay limited once it exists or once a future government finds a broader use case.

If the goal is genuinely child safety and not regulatory leverage, Malaysia should define harmful content with the precision that ARTICLE 19 and Amnesty International asked for, require age verification methods that do not route government ID through platform databases, and establish independent oversight of MCMC's enforcement decisions. None of those things are in these codes.

Governments building identity verification infrastructure into platform access is not a Malaysia-specific problem. It is a direction of travel, and Malaysia is one more country moving along it. If you want your browsing to stay yours regardless of what platforms are legally required to collect and hand over, Mysterium VPN (now with 82% off) is a practical place to start.