The Online Safety Act 2025 Explained: What Malaysian Families Need to Know

You're scrolling through dinner, standard evening. Your 14-year-old daughter's phone lights up with a notification. Instagram update: age verification required. She looks at you. "Is this real? Can they do that?"

Yes, they can. And it's not what the WhatsApp forwards claim.

The Online Safety Act 2025 (ONSA) has been law since January. But 1 June 2026 was the date that really mattered — when the Child Protection Code kicked in, forcing social media platforms to verify ages before letting anyone create an account. If your child is under 16, their experience of social media is about to change. Here's what happened, what it means, and exactly what to do about it.

What Actually Changed on 1 June 2026

The law came first. The teeth arrived this month.

When ONSA passed in January, it gave platforms the framework. The Child Protection Code (CPC) and Risk Mitigation Code (RMC) — adopted 22 May and enforced 1 June — those give it force. Now, social media platforms with more than 8 million Malaysian users (TikTok, Instagram, Facebook, YouTube, Telegram) must legally block anyone under 16 from creating new accounts.

Existing under-16 accounts aren't exempt. Platforms have a 6-month progressive rollout to verify every single underage user. The 1-month data transfer window has already opened — your child can download their photos, messages, and memories before the account is restricted or suspended.

Here's the piece most headlines miss: the government isn't punishing your child. The platform gets fined — up to RM10 million for breaching statutory duties. Your child won't be arrested. The platform's license is on the line.

But enforcement is messy. Some platforms have already started rolling out age prompts. Others haven't. The inconsistency means your neighbour's kid might still have full access while yours is locked out — and neither explanation is satisfying.

So, Can My 14-Year-Old Still Use Instagram?

Short answer: yes, but not the same way.

From 1 June 2026, creating a new account requires age verification. Your 14-year-old can hand over their MyKad, passport, or MyDigital ID to prove their age. If they're under 16, the platform can't let them in.

For existing accounts — the ones they've been using for years — the rules are progressive. Platforms have six months to verify everyone. Your child will see a prompt: verify your age or lose access. They'll have a window to download their data first.

But here's what matters practically: the law targets platforms, not children. Your 14-year-old isn't doing anything illegal by logging in. The platform is breaking the law if it lets them. That distinction matters when explaining this to your child.

Seah Lu Sean, a mother of two in KL, told The Edge Malaysia her son says he's "missing out because he cannot communicate with his classmates." Her 14-year-old and 11-year-old had accounts restricted. His grievance isn't unusual — he'd built his social life on that platform. This is the human cost of a necessary intervention.

The platforms also have flexibility. Parent-managed accounts are permitted — the Minister confirmed this in March. But the mechanism for setting one up? Unclear. No standardised process exists yet.

How Age Verification Works (And What It Means for Your Privacy)

Three methods. None perfect.

MyKad upload, passport scan, or MyDigital ID — those are your options. The platform cross-references your details against government-issued records. If you're under 16, blocked. If you're over, admitted.

MCMC has not prescribed a single technology. A regulatory sandbox is ongoing, and AI age estimation (scanning your face to guess your age) is permitted as a complementary method, though not standalone. So you might see a mix: upload your ID on one platform, take a selfie on another.

This is where the honest tension sits. And Digital Ihsan is not in the business of glossing over it.

Prof Dr Selvakumar Manickam of USM put it plainly: "Each platform that stores or processes MyKad or passport data becomes a potential target for data breaches. The risk of mass identity data being harvested, sold or misused is real and not hypothetical." That's not alarmism. It's a computer scientist stating a fact about attack surfaces.

On the other side, 70+ civil society organisations including Article 19 called mandatory age verification "misguided and disproportionate." Their concern: forcing millions of Malaysians to upload national ID credentials to private corporations creates a surveillance infrastructure that privacy law hasn't caught up with.

So where does that leave you?

The same place it leaves every parent: weighing child protection against privacy risk. The law is a necessary step — online sexual exploitation is real, the numbers are staggering — but the implementation is still being built. Your MyKad in Facebook's database is not a comfortable thought. It shouldn't be.

1 in 4 Malaysian children has been exposed to sexual or disturbing content online. Approximately 100,000 may experience online sexual exploitation annually (Dr Sasha Mohan / UNICEF, 2025). That's the number that makes the privacy trade-off real.

What Counts as "Harmful Content" Under This Law?

Two categories. Very different rules.

That scam message pretending to be from your bank — "Your Maybank account has been frozen" with a dodgy link? That's priority harmful content. The platform must act within an hour of receiving a valid report.

MCMC reported 92% of 638,957 harmful posts were taken down in 2025. That still leaves 58,000+ posts circulating.The system catches most things but not everything.

For parents, this section matters less for legal reasons and more for reporting reasons. If your child encounters something disturbing, you now have clearer timelines for how fast a platform must respond. Report. Follow up. Escalate if they don't act.

What This Law DOESN'T Do

Let me clear up the confusion because WhatsApp University has been busy.

This law does not:

• Ban children from the internet entirely. They can still browse, watch YouTube, use educational platforms, and communicate through private messaging.
• Criminalise individual users — not your child, not you. Penalties hit the platforms.
• Apply to private messaging. WhatsApp chats and Telegram DMs are excluded from the age-verification requirement (RDS Law Partners confirms this).
• Replace your role as a parent. The law is a safety net, not a substitute for raising digitally ethical children.
• Apply to every platform equally. Games without social features, educational tools, and sites below the 8-million-user threshold aren't caught.

91% of Malaysian children aged 13–17 use the internet daily (UNICEF Malaysia, 2023–2026). The law narrows their access to commercial social platforms. It does not unplug them from the digital world.

What Should You Do Right Now?

Three timeframes. One conversation.

This week — Talk to your child. Not at them. Ask if they've seen the age verification prompt. Let them tell you how it feels. Muhammad Miqdad Daniyal, 14, told The Straits Times: "It wasn't just mindless scrolling; it was a huge part of how my friends and I communicated and learnt new things." Dismissing that as screen addiction misses the point.

This month — Review which platforms your under-16 child uses. Go through them together. Decide how to handle the transition: will they verify through your MyDigital ID? Will they use a parent-managed account? Or will you treat this as a natural break to reset their digital habits?

Download their data now. The 1-month window for existing under-16 accounts is already open. Don't wait until they're locked out to save their photos.

This year — Build the digital adab habits. Age verification can block an account. It can't teach your child to recognise grooming, resist scams, or say no to sharing private photos.

That's your job.

Start with simple things: phone-free dinner table, no devices in bedrooms overnight, open conversations about what they see online. The amanah of raising a child in the digital age doesn't end because a law passed. It begins where the law stops.

What Experts Are Saying

The room is split. Both sides have a point.

Child safety advocates call ONSA a "meaningful step forward." The numbers back them: 12,656 CSAM reports from Malaysia in just the first half of 2025 — already 78% of 2024's total. ~900,000 CSAM files seized during Ops Pedo 2.0. These aren't abstract figures.

But digital rights groups warn the cure could create new problems. Article 19 and 70+ CSOs argue that mandatory age verification creates a mass surveillance database before the privacy safeguards are ready. Prof Selvakumar's concern about MyKad data being "harvested, sold or misused" is a technical assessment, not an ideological position.

Shamir Rajadurai of Prevent Crime Now frames it sharply: "Those most exposed include children aged roughly nine to 15 years old, old enough to roam online but too young to navigate complex risks."

Digital Ihsan's position: the law is necessary. It is not sufficient. The amanah of protecting children online sits with parents, educators, and communities — not with a single government code. Both the protections and the privacy risks deserve your attention.

Looking Ahead — What's Next for Online Safety in Malaysia

This is not the final shape of online safety in Malaysia.

MCMC's regulatory sandbox is still running — the technology for age verification hasn't been settled. The threshold of 8 million users could change. The categories of priority harmful content may expand. An Appeal Tribunal is being stood up to handle disputes.

Malaysia is also watching how the UK and Australia evolve their versions of the same law. And the AI Bill — expected to enter the conversation this year or next — will intersect with ONSA around AI-generated harmful content, deepfakes, and automated age estimation.

Digital Ihsan will track it. That's the point.

The Bottom Line

A 14-year-old sat in front of The Straits Times reporter and told him social media wasn't just mindless scrolling — it was how his generation communicated. He's not wrong.

The law is a tool, not a solution. Age verification can stop a 45-year-old predator from creating a fake account posing as a teenage boy. It cannot stop that same predator from finding your child on an unregulated platform, in a private message, or through a friend's compromised account.

Your role hasn't changed. It's just gotten harder.

The amanah of raising digitally ethical children — children who know when to scroll past, when to report, when to switch off — that belongs to you. The law helps. It doesn't replace.

Know another parent who's confused about ONSA? Share this guide with them.