Malaysia Plans Social Media Age Limit of 16 and Identity Checks in 2026

Identity checks will replace declared birth dates

Malaysia plans to prevent residents under 16 from opening social media accounts in 2026, requiring platforms to verify ages through electronic know your customer checks, or eKYC. Users would need official credentials, such as a MyKad national identity card, a passport or MyDigital ID, rather than simply entering a date of birth.

The plan forms part of a broader effort to protect children online alongside the Online Safety Act, which is scheduled to take effect on January 1, 2026. As of November 24, 2025, the Ministry of Communications expects major platforms to prepare their systems for implementation next year while the government studies how to enforce the restriction.

The Cabinet raised the proposed minimum age from 13 to 16 in October. Officials describe the decision as a child protection measure aimed at reducing cyberbullying, sexual exploitation, scams targeting teenagers and patterns of app use that keep young people scrolling for hours.

Communications Minister Fahmi Fadzil, who has led discussions with the industry, explained the Cabinet's decision and the timetable expected of platforms.

That was the Cabinet's decision, to prohibit those under 16 from having social media accounts. We expect platforms to be able to implement this by next year.

The age restriction follows an earlier expansion of oversight. Since January, services with more than 8 million users in Malaysia have been required to hold a licence. That regulation addresses harmful online content, including illegal gambling and posts concerning race, religion and royalty. The planned account restriction adds a specific focus on children to that enforcement effort.

What changes in 2026

Anyone attempting to open a social media account under the new approach would need verified proof that they are at least 16. Platforms would have to connect registration to a process that checks official credentials, replacing reliance on a birth date supplied by the user.

The Ministry of Communications wants platforms to have the necessary systems ready in 2026. The Online Safety Act has a scheduled commencement date of January 1, but the precise implementation date for the account restriction and its detailed technical rules have not been given.

Malaysia is studying how other governments define the services covered, verify ages and enforce restrictions. Those decisions matter because a service may combine public videos, private messages, games and discussion forums within the same app.

The main developments and planned milestones are:

• January 2025: A licensing requirement took effect for services with more than 8 million users in Malaysia.
• October 2025: The Cabinet raised the proposed minimum age for social media accounts from 13 to 16.
• November 24, 2025: The government expects platforms to implement the restriction in 2026 while it examines enforcement models used abroad.
• January 1, 2026: The Online Safety Act is scheduled to take effect.
• During 2026: Platforms are expected to be ready to apply the age restriction using identity verification.

How electronic identity checks work

Electronic know your customer checks are digital processes already used in banking and telecommunications to confirm that someone is who they claim to be. For social media registration, their purpose would be to confirm that the person seeking an account is at least 16.

A typical process can involve scanning an identity document with a phone camera, taking a selfie and completing a short liveness test. A liveness test checks that a real person is presenting the document. Automated systems can examine a document's security features, compare its photograph with the selfie and flag unusual results for a person to review.

The Ministry has identified MyKad, passports and MyDigital ID as credentials that could be used for verification. The exact steps users must follow will depend on the rules and the systems platforms adopt.

A platform does not need to keep a complete scan of an identity document simply to confirm age. The details of how information is handled will depend on regulations and the agreements companies make with verification providers.

The result regulators want is straightforward: confirmation that the person is 16 or older, or a result showing that they do not meet the requirement. A process that returns only that answer could avoid sharing other personal details with the social media service.

What platforms must build

Social media companies have several ways to introduce verification. They could build their own system, connect to an outside provider or use a service backed by the government. Accuracy, cost, speed and privacy will shape those choices.

Companies that already use eKYC for payments or advertising targeting in Malaysia have a starting advantage. Others will need to build or buy a verification process and connect it to registration without making the experience unnecessarily slow or difficult.

Account recovery adds another task. A person who loses access to an account may need to verify their identity again to prevent someone else from taking it over. Companies will need policies for these cases and should account for the additional complexity and costs in their planning for 2025.

Platforms will also need a way to handle mistakes. A false negative occurs when a system rejects someone who actually meets the age requirement. Appeals and support staff will be needed to resolve these cases, along with an expected increase in requests concerning identity checks.

For users aged 16 to 18, companies may also redesign features to reduce risks, strengthen default privacy settings and limit contact from unknown adults. The planned minimum age still leaves older teenagers using services where those protections matter.

Why the government is targeting children's accounts

Cyberbullying, grooming, scams and exposure to explicit content are among the harms driving the proposal. Bullying can spread from teasing into threats or large groups attacking one person, creating stress that follows a child from a screen into classrooms and homes.

Exploitative messages and grooming pose another risk. Grooming involves someone building a child's trust in order to exploit them. Scam networks also target teenagers with fake jobs, investment schemes and phishing links, which try to trick people into giving away personal information or access to accounts.

Officials are concerned about viral challenges that encourage risky behaviour and engagement patterns that keep children using apps for long periods. These concerns extend beyond individual posts to the way services encourage repeated viewing and scrolling.

Local debate has grown after troubling incidents involving students. Videos of bullying have circulated among students and on public feeds, some secondary school students have been found sharing explicit material, and scam attempts aimed at teenagers have become more visible.

Parents and educators are especially concerned about speed. A single post can reach hundreds of classmates and strangers within minutes, making an incident much harder to contain once it spreads.

Social media companies also face lawsuits in the United States alleging that product design has contributed to a youth mental health crisis. Malaysia has a different legal setting, but its policymakers share the concern that companies should make products safe by default and keep younger children away from services that were never intended for them.

What Malaysia is studying abroad

Australia is moving ahead with a national restriction on social media accounts for people under 16 and preparing to deactivate accounts that fail age checks. Malaysia is watching that process as it develops its own approach.

France, Spain, Italy, Denmark and Greece are testing approaches to secure age verification. Indonesia initially considered a minimum age for social media, then shifted towards rules requiring stronger age checks and content filtering.

Two practical choices stand out across these approaches. Governments must decide whether restrictions cover all social networks and platforms carrying content created by users, or only a specified list of services. They must also decide who verifies age and what information platforms receive.

A central verification service could confirm that a person meets the age requirement without sharing their identity with the platform. Another approach allows different private providers to operate under government standards. Malaysia intends to examine these models before settling its technical rules.

Existing accounts present a harder task than new registrations. Some users may have entered a false birth date years earlier. Australia's planned deactivation of accounts that fail checks offers a possible model, but it also creates appeals and support cases. Malaysia will need a process for existing accounts if it expects platforms to address them.

Fahmi, the communications minister, said Malaysia would assess which enforcement method fits its needs.

Different countries may take different approaches, but we will study which method is most suitable to ensure that those under 16 are prevented from having social media accounts.

Privacy depends on what gets collected and kept

Identity checks create concerns about where personal information is stored, who can access it and what happens after a security breach. Parents and privacy advocates worry that a document submitted to confirm age could leak, be used for another purpose or become linked to browsing history and interests.

Document images, biometric templates and audit logs are particular areas of risk. A biometric template is the information a system uses to compare a person's physical features, such as their face. An audit log records what happened during a check.

Good practice would limit how long raw images are retained, protect biometric templates with strong encryption and keep logs focused on the result needed to enforce the age rule. Clear retention periods and independent audits could reduce the risk of verification information becoming a lasting record of a child's online activity.

Malaysia's personal data rules already set basic requirements for collection, security and retention in commercial transactions involving the private sector. Regulators are likely to issue guidance on what platforms may store, how long they may retain it and whether an outside party must certify compliance with local requirements.

Companies could reduce the amount of data exchanged by using an age attestation, a confirmation that someone meets the age threshold without giving the platform their full identity. The practical value of that approach depends on how the verification process is designed.

Officials have sought to reassure families that the purpose is protection rather than control. Public support will depend on whether checks are designed and monitored carefully enough to keep identity information secure while preventing younger children from entering services with higher risks and harder content controls.

Where enforcement becomes difficult

Young users may try to bypass the restriction by presenting a parent's identification, borrowing an older sibling's account or moving to platforms outside the definition of social media. Overseas services that ignore Malaysian rules present another possible route.

Regulators will need to anticipate these methods and make evasion harder. Verification alone must be supported by rules about which services are covered and how platforms respond when accounts or credentials are shared.

Apps combining video, chat, games and forums are difficult to place in a single category. A narrow definition could push teenagers towards parts of the internet outside the restriction. A broad definition could block tools that parents consider essential. Clear criteria are expected so that companies and families can understand the scope.

App stores and mobile operating systems could contribute by restricting downloads or prompting age checks. Internet service providers could help by blocking access within Malaysia to services that fail to comply. These additional layers would bring costs and complexity that regulators would need to weigh.

Government discussions have also included possible restrictions on smartphone use for people under 16. No device rule has been finalised. The discussion nevertheless shows that officials are considering children's access to devices as well as their access to particular apps and websites.

How families and schools can prepare

Parents of younger teenagers would have a legal age limit to support household decisions about social media. The Communications Ministry has urged families to supervise gadget use and encourage outdoor play while the new rules are developed and tested.

Families can establish expectations before a child reaches 16. The practical steps described in the policy discussion include:

• Set consistent limits on screen time for school nights and weekends.
• Keep devices out of bedrooms at night to reduce late scrolling and disrupted sleep.
• Use parental controls on phones, app stores and home routers.
• Discuss bullying, scams and unwanted messages openly.
• Review privacy settings on services children already use, including games and chat apps.
• Agree on what to do when a stranger requests personal information or money.

Schools can update digital citizenship lessons to reflect the planned restriction. Staff training can help teachers recognise signs of cyberbullying and grooming, while guidance counsellors and parent teacher groups can organise sessions explaining the purpose of the law and how identity checks would work.

The transition gives families time to adjust household rules and schools time to update training. It also changes the conversation about access: reaching 16 would meet the proposed account age requirement, while supervision and protection from harmful contact would remain relevant.

Technical guidance will shape the rollout

Regulators are reviewing international approaches to platform definitions, verification and existing accounts. That work is expected to inform technical guidance for services preparing to implement the restriction in 2026.

Industry consultation is likely to cover verification accuracy, how systems handle errors, limits on data retention and independent audits. Companies will need time for testing and privacy reviews so that checks are reliable, respectful and fast.

The January 1, 2026 commencement of the Online Safety Act is the central scheduled legal milestone. Platforms face engineering work, support preparations and compliance planning alongside that broader safety framework.

Malaysia's child protection goals will depend on practical execution: understandable coverage rules, secure handling of identity information, reliable verification, effective appeals and coordination among families, schools, companies and regulators. Those choices will determine how the planned age limit works in everyday use.

What to Know

• Malaysia plans to prevent residents under 16 from opening social media accounts in 2026.
• The Cabinet raised the proposed minimum age from 13 to 16 in October 2025.
• Age checks would use official credentials such as MyKad, passports or MyDigital ID rather than declared birth dates.
• The Online Safety Act is scheduled to take effect on January 1, 2026.
• Services with more than 8 million Malaysian users have required a licence since January 2025.
• The government is studying enforcement approaches in Australia, Europe and elsewhere.
• Platform coverage, existing accounts, appeals and data handling are central rollout issues.
• Parents are being urged to supervise gadget use and encourage outdoor activities.
• Possible smartphone restrictions have been discussed, but no device rule has been finalised.