Malaysia Enforces Under-16 Social Media Ban With Mandatory ID Checks

Malaysia’s social media ban for children under 16 took effect on June 1, and its reach runs well past the empty accounts of teenagers. Every platform with at least eight million Malaysian users, among them Facebook, Instagram, TikTok, YouTube and Roblox, must now check the age of anyone who signs up against government identity records, which pulls adults and advertisers into the same verification net.

Behind the rule sits a national identity check Malaysia has spent years building. The Malaysian Communications and Multimedia Commission (MCMC), the country’s internet and telecoms regulator, wants age proven against a MyKad or the national digital ID app rather than a birthday a user types in. Whether that keeps under-16s offline is a different question, and Australia’s six-month head start suggests the honest answer is only partly.

What the New Rule Requires

The legal backbone is the Online Safety Act 2025 (ONSA), gazetted in May 2025, which lets the MCMC issue binding codes for platforms. Two of those codes carry the age rule: the Child Protection Code and the Risk Mitigation Code. Both took force at the start of June.

Who Must Comply

The trigger is size. Any licensed social media service with at least eight million users in Malaysia falls under the codes, which sweeps in the apps most teenagers actually open. Companies that ignore the rule risk financial penalties of up to RM10 million (US$2.5 million) under the Act, on top of enforcement action the commission has said it will treat as a serious matter. The threshold is high enough that smaller niche apps escape for now, so the burden lands on the biggest names first.

The Windows to Verify

New sign-ups face the check straight away; an under-16 simply cannot open an account. Existing users get more room. Platforms have a six-month transition to run age checks across their current base, and any account found to belong to someone under 16 gets a one-month window to download or move photos, videos and messages before it can be restricted or suspended. Teo Nie Ching, the deputy communications minister, put the case for hard checks plainly: “if age is merely self-declared, any user can simply click and claim that they are above 18 years old.”

The Verification System Doing the Heavy Lifting

The ban is only as strong as the tool that proves age, and Malaysia is leaning on infrastructure it already owns rather than asking each platform to invent its own.

What MyDigital ID Checks

Two documents anchor the system. The MyKad, the smart identity card every Malaysian aged 12 and above carries, supplies the legal date of birth. The government’s digital identity app adds a live facial scan that matches the person signing up to National Registration Department records. Adoption has climbed fast, passing roughly 12 million registered users this year against a population north of 35 million, helped by a push to make the app the login for telco and public services. Malaysians can sign up through the official government digital ID registration portal without visiting a kiosk.

What Platforms Don’t See

The design tries to answer the obvious privacy worry before it lands. According to the National Cyber Security Agency (NACSA), the app passes only an age confirmation to the platform, a yes-or-no on whether the user clears 16, while the name, address and ID number behind it stay off the platform’s servers. That matters because the alternative, uploading a MyKad scan to every app, is exactly the scenario security researchers have warned about for years. The system routes the sensitive check through one government gateway instead of scattering ID copies across a dozen private databases.

Why Malaysia Moved

The numbers behind the policy are grim, and they explain why a government would accept this much friction. Communications Minister Datuk Fahmi Fadzil first signalled the under-16 cutoff in November 2025, after a run of cases involving grooming and abuse imagery.

• 12,656 reports of child sexual abuse material traced to Malaysia in the first half of 2025 alone, per Internet Watch Foundation abuse-content data.
• 100,000 Malaysian children aged 12 to 17 facing online sexual exploitation or abuse each year, in a 2022 study by ECPAT, INTERPOL and UNICEF Innocenti.
• 98% of the 35 million population with internet access, one of the highest penetration rates in the region.
• 31 million Facebook users in the country, the largest captive audience among the apps now covered, per aggregator Napoleon Cat.

Those figures sit under a rare political consensus. Few lawmakers want to defend the status quo when the harm is this visible, which is why the debate has shifted from whether to act to whether this particular fix will hold.

Advertisers Now Have to Show ID Too

The same codes quietly widened the ID regime well beyond children. Anyone running a sponsored post, an individual influencer or a registered business, now has to verify identity before the ad goes live, using a MyKad, NRIC, passport, work permit or company registration document. The target is scam advertising. “We have seen many sponsored posts using the images of well-known individuals to promote content such as dubious investments, financial scams and online gambling,” Teo Nie Ching said. Platforms can run their own verification or hand it to a third-party provider, as long as the process meets Malaysian privacy law. For ordinary users the change is invisible; for the people selling to them, it closes the door on anonymous paid reach.

How Australia and Indonesia Got Here First

Malaysia is the third government in the Asia-Pacific to push an under-16 cutoff in roughly half a year, and the order of arrival matters because it left a trail of evidence to copy or avoid.

Australia was the first country to fully enforce a teen ban, and its model leaned on age-estimation tools and a soft “reasonable steps” duty rather than a hard document check; the eSafety Commissioner’s age-restriction rules spell out what that standard demands. Indonesia followed in March, ordering high-risk platforms including YouTube, TikTok, Instagram, Facebook, X and Roblox to deactivate under-16 accounts. Malaysia went the strictest route of the three by naming the exact documents an account must clear.

Will Age Gates Keep Teens Out?

Australia’s first months are the cautionary data. By mid-December, platforms had pulled access to 4.7 million under-16 accounts, which the eSafety Commissioner called an early sign the rules had teeth. Then the survey results came in: four months on, only about one in four 14-to-15-year-olds were actually staying off. Teens borrowed older siblings’ logins, rented accounts and switched on VPNs to spoof their location.

The same workarounds are sitting in front of Malaysian teenagers right now, and critics argue the heavier cost lands on everyone else. ARTICLE 19, a free-expression group, joined more than 70 Malaysian civil society organisations in urging the government to drop mandatory verification, warning that pushing people to prove identity to use the internet invites leaks, fraud and surveillance creep. The government’s answer rests on how the gateway is built.

MyDigital ID does not require users to submit or store physical ID copies, nor does it store biometric data such as fingerprints or facial images.

That was Megat Zuhairy Megat Tajuddin, NACSA’s chief executive, defending the design. His reassurance has not closed a separate gap either: the codes leave it unclear whether messaging apps, livestreams and chat-heavy games count as social media at all, which is the kind of ambiguity that decides enforcement.

The real test comes around December, when the six-month grace period for existing accounts runs out and platforms have to start removing the under-16s already on their books. Until then, the ban works mostly as a sign-up gate, and the teenagers already inside have not gone anywhere.

Frequently Asked Questions

Who has to verify their age for social media in Malaysia?

Everyone, not only teenagers. Any new sign-up to a covered platform must clear an age check immediately, and existing users of all ages can be asked to verify within the six-month transition so platforms can identify accounts belonging to under-16s.

What documents prove your age?

A MyKad smart identity card, a passport, or the national digital ID app, which adds a live facial scan matched against National Registration Department records. Self-declared birthdays no longer count under the new codes.

What happens to an existing under-16 account?

It gets a one-month window to download or transfer photos, videos and messages once the platform flags it. After that, the account can be restricted, suspended or subjected to other action under the Risk Mitigation Code.

Which platforms are covered by the ban?

Any licensed social media service with at least eight million Malaysian users. That includes Facebook, Instagram, TikTok and YouTube, and the gaming platform Roblox is explicitly swept in because of its social features.

Does MyDigital ID store your ID or face data?

NACSA says no. The agency states the app holds no physical ID copies or biometric data such as fingerprints or facial images, and passes only an age confirmation to the platform rather than your personal details.

Can a child get around the ban with a VPN?

Technically yes, and many will. Australia’s experience showed roughly three in four 14-to-15-year-olds still finding ways online four months in, using VPNs, borrowed accounts and platforms with weaker checks.