The Online Safety Act 2025 and the under-16 rule — what changes for community pages

This is general information, not legal advice. The Act is new, and the codes and guidance made under it are still developing. For the current position, see the Malaysian Communications and Multimedia Commission at mcmc.gov.my.

Short answer. Malaysia's Online Safety Act 2025 has been in force since 1 January 2026. It binds licensed platforms — in practice the large social media and messaging services — and not page admins. Since 1 June 2026 a Child Protection Code made under it requires those platforms to stop children under 16 from holding accounts. For a page, the practical effects are a younger audience that may disappear, and reports against its posts that are now backed by a legal duty.

Two changes to Malaysian internet regulation took effect in 2026. The Online Safety Act 2025 came into force on 1 January, placing legal duties on large online platforms for the first time. And on 1 June, a Child Protection Code made under the Act began requiring the largest social media services to stop children under 16 from holding accounts.

Neither change is aimed at the admin of a community page. Both alter the environment that page operates in. This guide explains what the law does, who it binds, and what — if anything — you need to do differently.

Who the Act applies to

The Act imposes duties on licensed service providers under the Communications and Multimedia Act 1998 — in practice, mainly the providers of applications services and content applications services. A related licensing change means that social media and internet messaging services with eight million or more users in Malaysia are treated as licensees. That brings in the major platforms.

The Act does not impose these duties on individual users, on page admins, or on small websites that are not licensed providers. If you run a page on Facebook or Instagram, the duties described below are owed by Meta, not by you.

Nothing in the Act removes your own responsibility for what you publish under other laws. Those are summarised in Malaysian law for page admins.

What counts as harmful content

The Act lists categories of harmful content. In summary, they are:

1. child sexual abuse material;
2. financial fraud;
3. obscene content;
4. indecent content;
5. content that may cause harassment, distress, fear or alarm by way of threatening, abusive or insulting words, communication or acts;
6. content that may incite violence or terrorism;
7. content that may induce a child to cause harm to themselves;
8. content that may promote feelings of ill-will or hostility among the public, or disturb public tranquillity;
9. content that promotes the use or sale of dangerous drugs.

Certain categories — child sexual abuse material and financial fraud in particular — are treated as priority harmful content and attract the strictest obligations.

Notice how closely the fifth category follows the wording of the harassment offences added to the Penal Code in 2025. The two were designed to work together: the Penal Code addresses the person who commits the harassment, and the Online Safety Act addresses the platform on which it happens.

What platforms must now do

In outline, a licensed provider must:

• take measures to reduce the risk of users being exposed to harmful content;
• publish clear guidelines describing those measures and its terms of use;
• give users tools and settings to manage their own safety;
• provide a mechanism for reporting harmful content, and respond to reports;
• offer accessible assistance to users on safety concerns;
• take specified measures to protect child users;
• prepare and submit an online safety plan.

Platforms that fail to comply face substantial financial penalties, and the Act provides routes for users to take matters further when a platform does not act on a report.

The under-16 rule

Since 1 June 2026, under the Child Protection Code, large social media platforms have been required to prevent children under 16 from registering or holding accounts, and to verify users' ages. As reported when the rule began:

• it applies to the major licensed platforms — Facebook, Instagram, TikTok and YouTube were among those named;
• both new and existing users may be asked to verify their age;
• verification may be made against government-issued records such as MyKad or a passport, although the framework is described as technology-neutral;
• the obligation, and the penalties for failing to meet it, rest on the platforms — parents and children are not penalised;
• platforms were given a period in which to implement verification.

How strictly and how quickly each platform applies the rule is a matter of implementation, and it is still changing. Look at MCMC's and the platforms' own announcements for the present state of affairs.

What this means if you run a page

Your audience may have changed

If your page serves a university, almost all your followers are over 16 and little changes. If it serves a secondary school, a substantial part of your intended audience — Form 1 to Form 3 students, and some in Form 4 — should no longer hold accounts on the major platforms at all.

That has consequences:

• a page whose content is written for thirteen- to fifteen-year-olds is now aimed at people the platform is obliged to exclude;
• your follower count and reach may fall as accounts are verified or removed;
• submitters may be younger than the readers who are able to see the result.

A school-level confession page should think seriously about whether it still makes sense in its present form. At the least, it should be run on the assumption that both its submitters and its subjects may be children, with everything that implies for what is published.

Reports are now backed by statutory duties

Before 2026, reporting a post to a platform was a request. For licensed platforms, handling reports of harmful content is now a legal duty. This cuts both ways.

• For you as a target of abuse — if your page or its admins are harassed, or someone impersonates your page, reports should receive a more dependable response.
• For you as a publisher — reports made against your posts are more likely to be acted on, and quickly. Content in the listed categories is more likely to be removed and to count against the page. Pages that repeatedly attract valid reports can expect restrictions.

The practical answer is the one this library keeps returning to: do not publish material that identifies and attacks people, moderate your comments, and act on complaints before they reach the platform.

Content involving children needs more care than before

The whole direction of the Act is towards treating harm to children as the first priority. For a page:

• do not publish images of identifiable children without being confident of consent from the child and a parent;
• do not publish submissions that sexualise anyone under 18, in any way;
• treat submissions from apparent children about self-harm, abuse or bullying as needing a response and not an audience — see When a submission mentions self-harm;
• remember that for a school page, the "private individuals" your rules protect are mostly minors.

Your own form is not a social media account — but be straightforward about it

A web form that accepts anonymous text does not require the submitter to have a social media account, so a fifteen-year-old can still type into it. The age rule concerns accounts on licensed platforms. It does not turn a submission form into a prohibited service.

It would nonetheless be a mistake to treat this as a loophole to be advertised. The policy behind the rule is that younger children should be less exposed to social media dynamics — public commentary on their lives, popularity metrics, anonymous remarks about them. A page that publishes anonymous posts by and about under-16s to a public feed is producing exactly what the rule sets out to reduce. If you run such a page, the responsible course is to tighten your rules on identifiability to the point where no pupil can be recognised from any post, or to restrict the page to older students.

If you operate a service of your own

If you run more than a page — an application or website with user accounts, messaging, or public feeds — the questions are different, and you should take advice. Whether a service is a licensed provider depends on what it does and on how large it is. Smaller services that are not themselves licensed are still affected by app-store policies, by the Personal Data Protection Act, and by the general criminal law. Age-appropriate design, a working reporting mechanism and a published safety policy are sensible measures whatever your size.

How to report harmful content

For anyone on the receiving end of harmful content, the routes run as follows:

1. Report it on the platform, using the reporting tool on the post, comment or profile. Take a screenshot first, showing the content, the account and the date.
2. If the platform does not act, a complaint can be made to MCMC through its complaints portal at aduan.mcmc.gov.my.
3. If an offence may have been committed — threats, harassment, doxxing, sexual content involving a child, fraud — make a police report.

Our guide What to do if an anonymous page posts about you takes a person through these steps in more detail.

What has not changed

The Act regulates platforms. It does not give admins a new set of rules to memorise, and it does not replace judgement. A page that already declines to identify private individuals, keeps sexual and hateful material out, watches its comments and removes posts on request was acting within the spirit of the Act before it existed. The main difference now is that the platform beneath you is legally required to care about the same things.

Common questions

Does the Online Safety Act 2025 apply to page admins?

No. Its duties fall on licensed service providers, and social media and internet messaging services with eight million or more users in Malaysia are treated as licensees. If you run a page on Facebook or Instagram, those duties are owed by Meta, not by you. Your own responsibility for what you publish under other laws is unchanged.

Can children under 16 use social media in Malaysia?

Since 1 June 2026, under the Child Protection Code, large social media platforms have been required to prevent children under 16 from registering or holding accounts and to verify users' ages. Facebook, Instagram, TikTok and YouTube were among the platforms named. The obligation and the penalties rest on the platforms; parents and children are not penalised.

What counts as harmful content under the Online Safety Act?

Nine categories: child sexual abuse material; financial fraud; obscene content; indecent content; content that may cause harassment, distress, fear or alarm; content that may incite violence or terrorism; content that may induce a child to harm themselves; content that may promote ill-will or disturb public tranquillity; and content promoting dangerous drugs. Child sexual abuse material and financial fraud are treated as priority harmful content.

Can someone under 16 still submit to an anonymous confession form?

Yes. A web form that accepts anonymous text does not require a social media account, and the age rule concerns accounts on licensed platforms. It is not a loophole to advertise: a page that publishes anonymous posts by and about under-16s should tighten its rules until no pupil can be recognised from any post, or restrict the page to older students.

What does the under-16 rule mean for a school confession page?

A large part of a secondary school page's intended audience — Form 1 to Form 3 students, and some in Form 4 — should no longer hold accounts on the major platforms. Followers and reach may fall, and submitters may be younger than the readers who can see the result. Such a page should be run on the assumption that both its submitters and its subjects may be children.

How do I report harmful content in Malaysia?

Report it on the platform first, after taking a screenshot that shows the content, the account and the date. If the platform does not act, complain to MCMC through aduan.mcmc.gov.my. If an offence may have been committed — threats, harassment, doxxing, sexual content involving a child, fraud — make a police report.