Malaysia and Indonesia Agree on Child Online Safety Cooperation, Seek December Talks With Singapore

Bali talks put agencies at the centre of child protection

Malaysia and Indonesia agreed on October 20, 2026, to establish cooperation between their agencies on online child safety, with Malaysian Communications Minister Fahmi Fadzil seeking a meeting with Singapore in December. The agreement, reached during talks with Indonesian Communication and Digital Affairs Minister Meutya Hafid in Bali, focuses on putting policy into practice, including sharing experience in handling complaints about social media.

The initiative brings together governments already taking different steps to protect young internet users. Malaysia began requiring age checks for social media registration on June 1. Indonesia has pursued the removal of accounts belonging to children under 16 from platforms it classifies as presenting high risks. Singapore has introduced requirements for platforms and app stores, alongside powers to remove harmful content.

Fahmi said the proposed December discussion would involve all three countries. He described the plan after his bilateral meeting with Meutya:

We are working towards holding a trilateral meeting involving Malaysia, Indonesia and Singapore, Insha'Allah, in December, if schedules permit.

December remains a target, subject to the ministers' schedules. The announcements gave no confirmed meeting date or detailed operating arrangements for the cooperation between agencies.

What Malaysia and Indonesia agreed to do

Fahmi welcomed Meutya's intention to strengthen cooperation between the Malaysian Communications and Multimedia Commission, known as MCMC, and Indonesia's Communication and Digital Affairs Ministry. He identified MCMC's experience handling public complaints about social media as something Indonesian authorities could use.

Complaint handling is a practical part of online safety: it is how a concern raised by a user reaches the organisation responsible for responding. Sharing experience in this area could help officials compare how complaints are received, assessed and acted upon. Fahmi's announcement placed this everyday regulatory work at the centre of the bilateral effort.

MCMC's deputy managing director for regulation, Datuk Dr Mohamed Sulaiman Sultan Suhaibudden, accompanied Fahmi. The delegation also included Fakhrul Arifin Mohammad Zulkifly, first secretary for economics at the Malaysian embassy in Jakarta. Their participation brought regulatory and diplomatic officials into the discussions alongside the minister.

Fahmi acknowledged that members of the Association of Southeast Asian Nations, or ASEAN, have different laws and ways of applying them. He said cooperation among Malaysia, Indonesia and Singapore could encourage other countries in the region to participate. The immediate approach is to connect national efforts while allowing for those differences.

Singapore joins the conversation at the airport

Singapore's Minister for Digital Development and Information, Josephine Teo, discussed online safety with Fahmi during an unplanned encounter at Ngurah Rai International Airport on Monday, October 19. Fahmi had just arrived in Bali, while Teo was waiting to fly home after attending Bali Tech Week 2026.

Teo said in an official social media post that they exchanged views on telecommunications developments, including online safety for children and young people. She also expressed hope of hosting Fahmi in Singapore in the near future.

Their conversation covered quantum-safe communications as well. This refers to protecting communications against the potential ability of future quantum computers to break some encryption systems used today. It was a separate technology issue discussed alongside child protection.

The airport exchange and the subsequent Malaysia–Indonesia talks show how the proposed three country discussion developed through two encounters during the same Bali visit.

Malaysia links age checks to its safety law

Malaysia began enforcing age verification for social media account registration on June 1, 2026, under the Child Protection Code and Risk Mitigation Code introduced under the Online Safety Act 2025. Under the rules, children below 16 cannot open social media accounts.

MCMC published both codes on May 22, 2026, under section 80 of the Act, and they took effect on June 1. A summary of the codes sets out duties for licensed service providers to reduce exposure to harmful content and protect child users.

Applicants must verify their age using official identification, including MyKad, a passport or MyDigital ID. The practical change is that registration requires evidence of age, rather than simply accepting a date of birth entered by the user.

The Child Protection Code requires effective age checks using Malaysian government-issued records, including identity cards, passports or birth certificates, or equivalent records issued by a competent foreign authority. Only users identified as aged 16 or above may register and access age-appropriate features. Verification data must be limited to what is necessary, retained no longer than needed and processed in accordance with the Personal Data Protection Act 2010.

The age-verification requirement covers licensed social media platforms with at least eight million users in Malaysia. MCMC said on June 1 that platforms covered include Facebook, Instagram, TikTok and YouTube, with existing users to be verified progressively over up to six months.

The Child Protection Code also requires systems to detect and remove harmful content, accessible reporting for children and parents, parental controls and age-appropriate privacy settings. Providers must restrict unwanted adult-to-child communications, limit manipulative design features and take proportionate steps to keep safe search on by default and prevent harmful content from appearing in search results and recommendations.

The Risk Mitigation Code requires annual harmful-content risk assessments by qualified teams, including child online safety expertise where children are likely to use a service. Providers must keep written assessment records, implement proportionate moderation and user-safety measures, verify paid advertisers against government-issued or equivalent foreign records, test recommendation systems and prominently label generated or manipulated media that could falsely appear authentic. An internal assurance function must monitor the measures and report regularly to the provider's audit committee or governing body.

Companies that fail to comply with Malaysia's rules face fines of up to 10 million ringgit, with further penalties for ignoring regulatory directives. The framework places responsibility on platforms to check who is using their services.

Providers may adopt more effective alternative measures if they satisfy MCMC. Failure to comply with the codes without MCMC-approved alternatives can result in a financial penalty of up to RM10 million and/or other regulatory action.

The Online Safety (Online Safety Plan) Regulations 2026 took effect on July 1. Licensees must submit their plans by December 28, describing the measures implemented under each code and providing evidence or internal assessments to justify alternatives. They must also appoint one or more Online Safety officers.

Fahmi set out the age restriction during his Bali Tech Week keynote on October 20. He also described Malaysia's efforts to improve internet coverage, speed and affordability while making access safer for children. His argument linked wider internet access with stronger protection for the people using it.

Indonesia tests whether platforms can enforce age limits

Indonesia's experience illustrates the scale of that task. TikTok raised its minimum user age in the country to 16 on March 28. By October 7, 2026, the platform had deactivated 9 million accounts belonging to underage users, according to an announcement by Meutya at the ministry's office in Jakarta.

Meta raised the minimum age for Facebook, Instagram and Threads accounts in Indonesia from 13 to 16 in April. YouTube followed later that month. Both companies said they would remove underage accounts in phases. Roblox has introduced facial age estimation for Indonesian users, restrictions on some communication features for children and limits based on account age categories.

Yet children can still get around checks. Jakarta writer Inne Abidin described how her son, aged 14, had registered for services including Instagram and TikTok by entering a false age. Abidin said:

He can access everything. His friends use everything too.

Meta has reportedly moved about 22.5 million Indonesian users into teen accounts, which apply protections designed for younger users. Indonesia still classifies Instagram and Facebook teen accounts as presenting high risks. The government is seeking changes beyond moving users into a different account category.

In the same October 7 announcement, Meutya said Meta had deactivated 184,000 accounts belonging to children under 16: 85,000 on Instagram and 99,000 on Facebook. She also confirmed the migration of 22.5 million child accounts to teen accounts. Threads had not reported account deactivations or other measures to comply with Indonesia's PP Tunas rules, and she urged Meta to demonstrate its commitment.

Meutya said teen accounts remained high-risk in part because children could communicate with strangers. The government's assessment covers seven risks, including contact with others, content, addiction, consumer safety, physical and physiological conditions, and mental health. She called for restrictions on communication with strangers and for scrolling time to be set to zero or a level that does not foster addiction.

Technology companies have until the end of 2026 to complete comprehensive assessments of how their algorithms, age checks and advertising systems protect children. Indonesia has also finalised a proposed sanctions mechanism that, once written into law, would permit fines of up to 6% of a technology company's global revenue.

Algorithms and police findings add urgency

Fahmi told the Bali forum that governments have limited understanding of how social media algorithms work and influence users. Algorithms are the automated systems that select and rank the posts, videos and other material people see. Their choices help shape a child's experience after an account has been created.

Age checks and content selection therefore address different parts of the same problem. One determines who can enter a service; the other helps determine what appears on the screen. Indonesia's demand for assessments covering algorithms, age verification and advertising reflects this wider focus on how platforms operate.

Fahmi also cited a recent Malaysian police case involving the arrest of 53 people suspected of paedophilia and the seizure of more than 500,000 files suspected of containing child sexual abuse material. The figures refer to suspects and files seized during the investigation.

His keynote placed those findings alongside the need to preserve the internet's benefits. Fahmi, speaking as Malaysia's communications minister, said:

The internet is good. The internet can be put to good use. But do children know how to use it well?

Fahmi also said governments should consider how their policies shape people's choices while preserving individuals' freedom to make informed decisions.

Different national rules, a shared regional market

Singapore's approach combines duties for online services with mechanisms for responding to harm. Its Online Safety (Miscellaneous Amendments) Act, which took effect in 2023, requires major social media services to protect users, including children, from harmful material. Failure to comply can carry a financial penalty of up to S$1 million.

Since April 2026, app stores in Singapore have also been legally required to verify the ages of users seeking to download material restricted by age. An Online Safety Commission launched in June has powers to order the immediate removal of harmful content and restrict offending accounts.

Elsewhere, Vietnam is considering rules that would limit children under 16 to viewing social media, preventing them from posting, commenting, sharing or reacting. The Philippines already requires internet providers to block child sexual abuse material and has pressed platforms to strengthen age checks, parental controls and content removal.

Unggul Sagena, head of internet access at the Southeast Asia Freedom of Expression Network, said cooperation could increase the pressure countries can apply together:

A regional coalition can push Big Tech to create child-friendly ecosystems in ways no single country can.

Paco Pangalangan, a technology and human rights fellow at Harvard Kennedy School, pointed to ASEAN's more than 400 million social media users as a source of negotiating strength. For the proposed partnership, the opportunity is to turn a shared concern into coordinated dealings with platforms that operate across national borders.

Dates shaping the next stage

Bali Tech Week ran from October 19 to 23 at the Bali Beach Convention Centre in Sanur, bringing together policymakers, technology leaders, innovators and investors. Meutya invited Fahmi to deliver his keynote during his working visit to Indonesia.

The sequence of measures and meetings shows how the proposed cooperation fits into changes already under way:

• June 1, 2026: Malaysia began enforcing age verification for social media registration.
• October 19: Fahmi and Teo discussed child online safety and telecommunications during their airport encounter in Bali.
• October 20: Fahmi met Meutya and delivered his Bali Tech Week keynote. He was scheduled to travel to Jakarta that evening.
• December: Malaysia is seeking talks with Indonesia and Singapore, subject to schedules.
• December 28: Malaysia's licensees must submit online safety plans.
• End of 2026: Indonesia's deadline for technology companies to complete child protection assessments.

The next stage centres on connecting agencies that already have national responsibilities. Malaysia brings experience with complaints and age verification; Indonesia is pressing platforms over account removals and service design; Singapore has mechanisms for restricting harmful content and accounts.

Key Points

• Malaysia and Indonesia agreed on October 20 to establish practical cooperation between agencies on online child safety.
• Fahmi is seeking a December meeting with Indonesia and Singapore, subject to schedules.
• MCMC's experience handling social media complaints is an identified area for sharing with Indonesia.
• Malaysia requires age verification and bars children under 16 from opening social media accounts; non-compliance with its safety codes can carry penalties of up to RM10 million and/or other regulatory action.
• Meutya said on October 7 that TikTok had deactivated 9 million underage accounts.
• The countries are pursuing cooperation while retaining different national laws and enforcement approaches.