If your Instagram or TikTok has suddenly popped up a screen asking you to scan your MyKad, you're not being scammed — you're watching Malaysia's biggest internet regulation change in years play out in real time.
Since 1 June 2026, licensed social media platforms in Malaysia have had to verify the age of every user, not just new sign-ups, under the Child Protection Code (CPC) and Risk Mitigation Code (RMC), two subsidiary codes under the Online Safety Act 2025 (ONSA). We're now two months into a rollout that the Malaysian Communications and Multimedia Commission (MCMC) said would take up to six months to reach every existing account — meaning the prompts will only get more common between now and year-end.
What's actually happening right now
The headline rule is simple: nobody under 16 can hold a social media account on a covered platform.
The part catching adults off guard is that verification isn't limited to new sign-ups. Existing accounts, including yours, are being checked progressively as platforms build out their systems — which is why prompts have shown up unevenly, some in June, others only now.
MCMC has stressed this isn't a ban on kids using the internet. It's narrowly about social media account registration and access to certain features, and parents face no penalty if their child's account gets flagged.
Which platforms, and who's covered
The rule applies to any licensed social media service with at least eight million users in Malaysia — a threshold that currently catches Facebook, Instagram, TikTok and YouTube. MCMC has said more platforms could be added later.
Non-compliance is expensive: financial penalties of up to RM10 million, plus a separate stack of ONSA fines for missing statutory response deadlines, some as tight as one hour for the most serious harmful content. That urgency explains why platforms are pushing through the rollout despite it being operationally messy.
How the age check actually works
MCMC hasn't mandated one verification technology. Its approach is "technology-neutral" and "outcome-based" — platforms build their own systems, provided they're accurate, secure and don't overcollect data.
In practice, expect to be asked for one of these:
- MyKad or passport details
- MyDigital ID, increasingly the preferred rail since it's already used for prepaid SIM registration and other government services
- AI-based age estimation, used by some platforms as a supplementary check
If you're verifying via a government ID method, it helps to know which government apps you actually need now that MyDigital ID is mandatory, rather than fumbling through app stores mid-verification.
Officials say the data collected should only be used for age verification, not kept as a profile of who you are. Deputy Communications Minister Teo Nie Ching told Parliament that once your age is confirmed, platforms shouldn't retain your name or identity beyond that check.
The privacy pushback nobody's fully resolved
Not everyone's convinced. In April, ARTICLE 19 and more than 70 Malaysian civil society groups urged the government to withdraw the blanket under-16 approach, arguing that mandatory ID-based verification risks turning every social platform into a repository of identity documents — a juicy target for leaks and misuse.
Critics also question how effective it really is, since determined teenagers can route around it with VPNs, overseas accounts, or an already-verified adult's profile. MCMC has acknowledged the risk and says platforms must monitor for suspicious account behaviour, though what that looks like in practice is still fuzzy.
Malaysia isn't alone. Australia enforced a similar under-16 minimum age from December 2025, and Indonesia rolled out its own restrictions on YouTube, TikTok, Facebook and Instagram in March 2026. Malaysia's version is more prescriptive than Australia's "reasonable steps" model, with hard statutory deadlines and personal liability for directors who fail to comply.
What happens if you (or your kid) don't verify
If a platform identifies an under-16 account, the user gets roughly a month to download or transfer their data — photos, videos, message history — before the account faces restrictions or closure.
Adults who ignore verification prompts risk losing account access, though platforms are expected to give reasonable notice first. There's no single published cutoff date for when every existing user must be checked; it's happening platform by platform within MCMC's six-month window.
If your teenager's account gets flagged, act within that data-export window rather than wait — appeal processes are still being ironed out.
FAQ
When exactly did this rule start?
The Child Protection Code and Risk Mitigation Code took effect on 1 June 2026, but MCMC gave platforms up to six months to verify existing users, so the rollout continues through late 2026.
Do I need to verify even if I'm an adult?
Yes. Verification applies to existing users broadly, not just accounts suspected of belonging to minors, because platforms need a reliable way to confirm nobody under 16 is on the service.
What documents can I use to verify?
MyKad, a passport, or MyDigital ID are the government-recognised options MCMC has referenced. Individual platforms decide how they implement checks, so the process may differ between TikTok and Instagram.
Will my personal data be stored by these platforms?
MCMC says data collected for verification should only be used for that purpose and handled securely under Malaysia's data protection laws, though civil society groups remain sceptical about enforcement.
What if my under-16 child already has an account?
They'll get roughly a month to save their data before restrictions apply. Download photos and message history proactively rather than waiting for the notice.
Whatever you think of the policy, the practical reality is the same: if you haven't been asked to verify your age yet, you probably will be soon. Sorting it out on your own terms beats scrambling when your account locks mid-scroll.
For the legal detail on deadlines and penalties, see MCMC's official explainer, Malay Mail's parent guide, and a compliance breakdown from Mayer Brown.
