By James Konstantin Galvez ( May 26, 2026, 07:37 GMT | Insight) -- Malaysia will require online platforms to implement age-verification measures ensuring only users aged 16 and above can register for services and access age-appropriate features under new online safety codes taking effect June 1. The Child Protection Code and Risk Mitigation Code imposes broader obligations on licensed service providers, including child-safety safeguards, content moderation systems, advertiser verification and algorithmic-risk controls. The measures mark a significant expansion of Malaysia’s operational oversight of digital platforms, with non-compliance potentially triggering penalties of up to 10 million ringgit ($2.5 million).Malaysia is moving toward one of Southeast Asia’s most interventionist online-safety regimes, with new rules taking effect on June 1 requiring online platforms to implement age-verification measures ensuring that only users aged 16 and above can register for services and access age-appropriate features under the Online Safety Act 2025. The new Child Protection Code and Risk Mitigation Code published by the Malaysian Communications and Multimedia Commission, or MCMC, significantly expand operational obligations for licensed service providers, underscoring the government’s push toward more proactive oversight of harmful online content and stronger protections for children online (see here). At the center of the framework is a requirement for platforms likely to be accessed by child users to implement “effective age verification measures” based on government-issued identity records, including national identity cards, passports and birth certificates, or equivalent foreign records recognized by competent authorities. The Child Protection Code does not prescribe a specific technological method for age verification, giving providers some flexibility in how they implement the requirement. Even so, the obligation could create significant operational and compliance challenges for digital platforms that have historically relied on self-declared user ages. The code also introduces broader “safe design and operation” obligations aimed at how platforms themselves are structured and operated. Licensed service providers must implement measures to prevent child users from accessing harmful content, limit the ability of adults to communicate with child users, restrict features that increase or prolong children’s use of services and prevent adults from viewing children’s personal information available on platforms. Platforms must also ensure privacy and safety settings for child users are set at the highest level by default, while deploying parental-control tools enabling parents to monitor and manage children’s online activities. The safeguards extend into search and recommendation systems as well. Platforms are required to ensure safe-search functions are activated by default for child users and that personalized recommendation systems do not expose children to harmful content. Alongside the child-protection rules, the parallel Risk Mitigation Code imposes broader obligations requiring platforms to conduct annual harmful-content risk assessments, establish internal assurance functions and implement stronger content moderation, advertiser-verification and algorithmic-risk mitigation systems. Taken together, the measures signal Malaysia’s shift toward continuous operational oversight of online platforms, with regulators expecting companies to actively assess, monitor and mitigate harmful-content risks rather than simply remove harmful material after it spreads. The implementation timeline, however, leaves platforms with little time to operationalize compliance systems before the rules take effect on June 1. While reports indicate providers may receive a reasonable grace period to complete age-verification processes for existing accounts, it remains unclear whether enforcement of the under-16 registration restrictions will be delayed beyond the June 1 commencement date. Failure to comply with the Risk Mitigation Code may expose licensed service providers to enforcement action, including financial penalties of up to 10 million ringgit ($2.5 million)....
Prepare for tomorrow’s regulatory change, today
MLex identifies risk to business wherever it emerges, with specialist reporters across the globe providing exclusive news and deep-dive analysis on the proposals, probes, enforcement actions and rulings that matter to your organization and clients, now and in the longer term.
Know what others in the room don’t, with features including:
- Daily newsletters for Antitrust, M&A, Trade, Data Privacy & Security, Technology, AI and more
- Custom alerts on specific filters including geographies, industries, topics and companies to suit your practice needs
- Predictive analysis from expert journalists across North America, the UK and Europe, Latin America and Asia-Pacific
- Curated case files bringing together news, analysis and source documents in a single timeline
Experience MLex today with a 14-day free trial.