Malaysia

Online Safety Act 2025 (Act 866), Child Protection Code ss. 2, 4-7 (Child Safety by Design)

Effective 2026-06-01 · Applies to private

Section 18 of the Online Safety Act 2025 requires a licensed applications service provider or licensed content applications service provider to implement measures, specified in a code issued by the Commission, to ensure the safe use of its services by a child user, defined as a person under the age of eighteen years; subsection 18(3) requires that, for a service that is, in the provider's opinion, likely to be accessed by child users, those measures include safe design and operation to prevent a child's access to suspected harmful content, limit an identified adult's ability to communicate with an identified child, limit features that increase or sustain a child's use of the service, prevent an identified adult from viewing an identified child's personal information, and control personalised recommendation systems suitable for child users.

The Child Protection Code, issued by the Commission under section 80 read with section 18 and taking effect 1 June 2026, applies these duties to any applications service enabling communication between users and any content applications service, and adds content-moderation duties (detecting and removing harmful content, accessible reporting channels for child users, steps against repeated exposure to reported or removed content), a duty to make available parental control features, a duty to set privacy and safety settings to the highest level by default for child users and limit an unconnected adult's direct communication with a child user, and duties over search and recommendation systems.

Those duties include activating safe search by default. Separately, algorithmic recommendation does not display or promote harmful content to child users.

Source: Full text of law

Online Safety Act 2025 (Act 866), Child Protection Code s. 3 (Age Verification)

Effective 2026-06-01 · Applies to private

The Child Protection Code, issued by the Malaysian Communications and Multimedia Commission under section 80 of the Online Safety Act 2025 read with section 18, requires a licensed applications service provider or licensed content applications service provider offering a social media service likely to be accessed by child users to implement effective age verification measures so that only users whose ages have been identified as sixteen years or above may register for the service or access a feature of the service appropriate for their age.

The Code requires verification against records issued by the Government of Malaysia (National Registration Identity Card, passport, birth certificate, or another government-recognised document) or an equivalent record issued or recognised by a competent authority in another jurisdiction, and requires that any personal data collected for age verification be adequate, relevant, and limited to what is necessary, and not kept longer than necessary for that process, consistently with the Personal Data Protection Act 2010. The Code was published on 22 May 2026 and took effect on 1 June 2026.

Source: Full text of law