Malaysia Enforces Under-16 Social Media Ban With Age Checks

Malaysia began enforcing a ban on social media accounts for children under 16 on June 1, 2026, requiring major platforms to verify user ages or face penalties of up to RM10 million (about $2.5 million). The rules, issued by the Malaysian Communications and Multimedia Commission (MCMC) under the Online Safety Act 2025, apply to licensed platforms with at least 8 million users, including Facebook, Instagram, TikTok and YouTube.

New Accounts Must Be Verified Against Government Records

Under MCMC’s Child Protection Code and Risk Mitigation Code, users must verify their age before registering an account. According to MCMC, verification must be conducted against government-issued records, such as MyKad or a passport, or equivalent records recognised by a competent authority in another jurisdiction. The regulator has not prescribed a single technology, describing its approach as technology-neutral and outcome-based.

One government-backed option is MyDigital ID, Malaysia’s national digital identity platform, which Deputy Communications Minister Teo Nie Ching has cited alongside MyKad and passports; the government says it confirms eligibility against National Registration Department records without requiring platforms to store ID copies or biometric data. The codes also require advertisers to verify their identity against government records, including passports or business registration documents, before publishing sponsored posts.

Age verification for existing users will roll out progressively over six months. MCMC said users identified as under 16 will be given one month to download or transfer their data, including photos and videos, before platforms apply restrictions or suspensions. Parents whose children bypass the rules will not be penalised.

Malaysia Joins a Widening Global Push to Age-Gate Social Media

Malaysia joins a fast-moving global trend. Australia became the first country to enforce an under-16 social media ban on December 10, 2025; by mid-January 2026 the government reported that more than 4.7 million accounts believed to belong to under-16s had been deactivated, removed or restricted. Brazil and Indonesia introduced their own age restrictions in March 2026, and France has proposed identity verification for social media accounts during its 2026 EU presidency. Enforcement remains contested: Meta’s director of public policy for Southeast Asia warned that a blanket under-16 ban could push teenagers toward less-regulated platforms.

Outcome-Based Rules Shift the Compliance Burden to Platforms

MCMC’s technology-neutral framing puts the burden of proof on platforms. Self-declared birthdates, the long-standing default for age gating, will not satisfy a regulator that requires verification against government records. The privacy concerns are equally real: Benjamin Loh, a social science lecturer at Monash University Malaysia, cautioned that platforms could end up storing sensitive personal data without sufficient safeguards. Platforms now face two demands at once: prove a user’s age reliably while minimising the personal data they collect and retain, across millions of existing accounts and every new sign-up.

Layered Age Assurance Meets Outcome-Based Compliance

Meeting these requirements calls for age verification that confirms how old a user is without forcing platforms to warehouse identity documents. That points to a layered approach combining document authentication, biometric facial analysis and database checks in a single flow that works at scale and clears regulatory review.

Shufti’s age verification solution (KJM-certified in Germany and supporting document verification across 230+ countries) pairs document checks with facial biometric age estimation to confirm users in seconds. Platforms navigating Malaysia’s new rules can explore Shufti’s age verification capabilities or request a demo to see how layered checks meet outcome-based standards.