Malaysia has taken one of its biggest steps yet to regulate social media. Since 1st June 2026, children below the age of 16 are no longer allowed to register social media accounts in Malaysia.
Under the Child Protection Code (CPC), social media platforms must ensure users meet the minimum age requirement using official records including MyKad, passports and potentially MyDigital ID.
The intention to do so is clear. Children are exposed to various threats including sexual grooming, harmful content and cyberbullying, while social media platforms are designed to keep users engaged for as long as possible. There is a genuine problem here that deserves government intervention, but that doesn’t automatically mean every solution is proportionate or effective.
The question is whether Malaysia can protect children without creating another set of privacy, security and censorship concerns for everyone else. This is because all Malaysians, including adults are affected too, not just teens.
The problem is real but are we regulating the right thing?
Concerns about children and social media aren’t merely a moral panic. The issue has become even more concerning following recent violent incidents involving teenagers at schools in Bandar Utama and Banting. It raised serious concerns over what young Malaysians are being exposed to online and whether social media could play a role in influencing their behaviour.
This does not mean social media should be blamed entirely for these incidents without evidence, but they have added urgency to the wider debate over children’s online safety.
The more important question is whether governments should regulate access to social media or the design and behaviour of the platforms themselves.
Malaysia has largely chosen the former. If you are below 16, you cannot have a social media account, and platforms must establish that users are old enough through an age-verification mechanism backed by official and sensitive government identity records.
This sounds straightforward until you consider what needs to happen for it to work. To stop a 14-year-old from accessing a social media account, the system must also establish that a 21-year-old or 60-year-old is old enough to use it.
While the regulation is aimed at teens, the age-verification requirement potentially affects practically everyone who uses social media, even adults.
Age verification shouldn’t mean giving platforms your identity
Malaysia has described this as age verification rather than age assurance and that distinction is important.
A properly designed system does not need to tell TikTok, Facebook or Instagram your full name, MyKad number, home address, or date of birth. A trusted system could simply estimate that a user is “16 or older” without revealing anything else.
That should be the standard Malaysia aims for. If a platform only needs to know whether I am above 16, why should I provide my government identity information?
This is where the concerns raised by civil society groups become important. Identity and biometric information are fundamentally different from passwords because they cannot simply be changed after a breach.
Malaysia is no stranger to major data leaks, while social media companies themselves have faced numerous incidents involving scraping, exposure and misuse of user information. Even this year alone, in 2026, 4 government platforms, including MOH, have been reportedly hacked.
This does not mean Malaysia’s age-verification system will inevitably suffer a breach. But collecting more sensitive information creates another valuable target for attackers, and Malaysians deserve to know exactly how the system works.
Who gets to see the information? What is retained? Does the platform receive the underlying identity data and who is responsible if something goes wrong? What third-party oversight is put in place to prevent government overreach where regulations are weaponised to censor the population?
There is also the risk that a system introduced for one purpose could eventually be used for something else. Today, age verification is meant to stop a 15-year-old from opening social media but once the infrastructure is in place, the information could potentially be used to improve targeted censorship, restrict other types of online content or meet future regulatory requirements.
Does age verification actually work?
Even if Malaysians accept the privacy trade-off, the system still needs to demonstrate that it is truly effective in blocking young Malaysians in the first place.
The UK’s implementation shows both sides of this argument. Stronger age checks under its Online Safety Act caused significant traffic declines at several adult websites.
However, at the same time, VPN downloads and usage have surged. Proton VPN reported over 1,400% increase in UK sign-ups shortly after the requirements came into effect.
Just a few minutes after the Online Safety Act went into effect last night, Proton VPN signups originating in the UK surged by more than 1,400%.
— Proton VPN (@ProtonVPN) July 25, 2025
Unlike previous surges, this one is sustained, and is significantly higher than when France lost access to adult content. pic.twitter.com/W9R5FQBWKa
While age verification isn’t useless, people will inevitably find ways to circumvent restrictions, and teenagers are unlikely to be an exception.
The same problem applies in Malaysia. A teenager unable to create a local social media account could potentially use a VPN, an account created by an adult or move to other platforms outside the scope of the regulation.
This raises an important unintended consequence: If teens leave mainstream regulated platforms, where do they go next?
Civil societies and human rights activists have long argued that blanket restrictions could push younger users towards less regulated corners of the internet.
Australia’s experience is also relevant because its under-16 restriction has been operating since December 2025. Early reports suggest account ownership among younger users has fallen, but social media usage hasn’t disappeared.
Blocking an account and stopping someone from using social media are not necessarily the same thing.
Social Media platforms need to be regulated effectively, not just the users
Perhaps the bigger question is why are we putting bulk of the burden on users.
If cyberbullying is the concern, children’s accounts could be made private by default. If sexual grooming is the problem, there should be stronger pedophilia laws and collaboration to capture pedophiles rather than treating the symptoms.
If recommendation algorithms repeatedly expose children to harmful material, regulators could impose more precise definition on what constitutes harmful content rather than subjective phrases such as “offensive” or “obscene” which can be weaponised or abused for censorship.
Screen time limits can be regulated without banning a 15-year-old from social media altogether or requiring sensitive government ID verification that creates privacy and surveillance risks.
Instead of only asking users to prove that they are allowed to participate online, regulators should also require platforms to do more to ensure their services are safe for younger users.
Malaysia has already spent more than a year introducing licensing requirements, new online safety laws and tougher rules, yet harmful content continues to appear while complaints of high-handed censorship has become more prominent.
Communications Minister Fahmi Fadzil recently singled out Facebook, saying it was the platform that “commits the most sins” against Malaysians when it comes to online gambling and scams.
Between 1 January and 17 August 2026, MCMC requested the removal of 470,593 pieces of harmful content, of which 27% were related to scams and 64% involved online gambling. Facebook alone accounted for 78% of the online gambling content identified for removal.
If social media platforms continue to serve scam and gambling content despite more than a year of tougher regulation, it raises another question: are we putting enough pressure on the platforms themselves? Are we mandating these platforms to establish content moderation teams in Malaysia to tackle scam ads with clear turnaround time?
There is also the digital-literacy concern that comes with delaying access. A person who turns 16 suddenly becomes eligible for social media, but they still need to know how to identify scams and misinformation, manage their privacy, deal with cyberbullying and recognise online manipulation.
Keeping teens away from social media does not automatically prepare them for the real world.
There are less intrusive tools to protect teens
Government-mandated age verification isn’t the only way to protect children online.
Apple, for example, has expanded its child-safety features and introduced a Declared Age Range system that allows apps to receive a child’s age range without necessarily receiving their exact date of birth. It is an interesting example of the principle Malaysia should pursue: give a service the minimum information it actually needs.
Malaysia also has a network-level example. Tune Talk’s Epik+ Family Safe applies parental controls through the mobile network.
This allows parents to restrict categories of websites and services without relying entirely on settings installed on a child’s smartphone or tablet.
Neither of these approaches replace regulation. Not every parent will configure parental controls, subscribe to a specialised plan or actively monitor their child’s online activity, which is why government intervention still has a role.
But these solutions on the device and network level demonstrate that protecting children doesn’t necessarily require every adult to expose more personal information than necessary.
So, does the benefit outweigh the privacy cost?
It is still too early to tell whether the under-16 ban has significantly reduced cyberbullying, grooming, scams or exposure to harmful content.
What we can ask now is whether the mechanism is proportionate. If age verification can be performed without exposing more information to social media platforms, such as age assurance alternatives, that should be the standard. If verification information does not need to be retained, it should be deleted. And if a platform only needs to know that I am above 16, it shouldn’t need my full identity to establish that.
Instead, Malaysia should be pushing for stronger platform obligations, safer defaults for teens, privacy-preserving age assurance rather than age verification, better parental controls and greater digital literacy.
Protecting teens online is a legitimate goal. Malaysia now needs to demonstrate that it can achieve it proportionately without asking everyone else to sacrifice more privacy and freedom of expression than necessary.
