The Malaysian Communications and Multimedia Commission (MCMC) has enforced the Online Safety Act 2025 (2025) starting today through the implementation of two rules, which are the Risk Mitigation Code (RMC) and the Child Protection Code (CPC).
The two codes apply to licensed social media and online messaging platforms with more than eight million users across the country. MCMC said the measures were developed through consultations with industry players, civil society groups and relevant stakeholders to address growing concerns surrounding harmful online content, cybercrime and child safety.
What Is the Risk Mitigation Code (RMC)?
The Risk Mitigation Code focuses on how online service providers manage and reduce risks associated with harmful content on their platforms. The code adopts an outcomes-based approach, allowing platforms flexibility in implementing safety measures while ensuring users are better protected online.
What Must Social Media Platforms Do Under the RMC?
Under the Risk Mitigation Code, social media platforms are required to implement measures to reduce online harms and improve user safety. Key requirements include:
- Conducting regular risk assessments to identify potential online harms.
- Strengthening content moderation and governance systems.
- Improving reporting and response mechanisms for harmful content.
- Verifying the identities of advertisers before allowing sponsored advertisements to be published.
- Taking steps to combat online scams, fraudulent investment schemes and online gambling promotions.
- Preventing the misuse of prominent individuals’ identities in advertisements.
- Introducing safeguards against manipulated and AI-generated content, including deepfakes.
What Is the Child Protection Code (CPC)?
The Child Protection Code focuses specifically on protecting children from online harms and creating safer digital environments for younger users. One of its most significant measures is the restriction on social media account registrations for individuals below the age of 16.
What Does the Child Protection Code Require?
The Child Protection Code introduces specific measures aimed at protecting children and teenagers online. Among the key requirements are:
- Preventing individuals under the age of 16 from creating social media accounts.
- Implementing age-verification mechanisms to confirm users’ ages.
- Requiring age verification using official documents such as MyKad or passports where necessary.
- Introducing age-appropriate safety features for younger users.
- Strengthening protections against cyberbullying and online harassment.
- Implementing measures to combat child grooming and sexual exploitation.
- Reducing children’s exposure to harmful or inappropriate content.
- Providing safer online environments designed to protect children’s wellbeing and privacy.
MCMC stressed that the initiative is not intended to prevent children from accessing the internet entirely, but rather to ensure stronger safeguards are in place when young users engage with digital platforms. Parents will not face penalties if their children manage to bypass the restrictions, although platforms are expected to take reasonable steps to detect and remove underage accounts.
Why Are These New Rules Being Introduced?
The implementation of the RMC and CPC comes amid growing concerns over online harms affecting Malaysians, particularly children and teenagers.
According to government data cited by MCMC, Malaysia recorded more than 12,000 cybercrime cases between January and April 2026, involving online fraud, scams, cyber harassment and other digital offences. The figures underscore the need for stronger platform accountability and improved online safety measures.
The government said the new framework is designed to encourage social media companies to take greater responsibility for the safety of their users rather than placing the burden solely on individuals and parents. The move also aligns Malaysia with a growing number of countries introducing stricter online safety regulations and age-based protections for social media users.
What Happens If Platforms Fail To Comply?
Social media companies that fail to comply with the requirements under the Risk Mitigation Code and Child Protection Code may face enforcement action under the Online Safety Act 2025.
Platforms that do not meet their obligations can be subjected to financial penalties of up to RM10 million. MCMC said a reasonable implementation period will be provided for platforms to fulfil their responsibilities, but a high level of compliance is expected moving forward.
With the RMC and CPC now officially in force, Malaysia has introduced one of its most comprehensive online safety frameworks to date.
The government hopes the measures will reduce harmful online activities, improve digital safety standards and provide stronger protection for children while ensuring social media companies play a more active role in safeguarding users. As implementation begins, attention will now turn to how platforms enforce age verification, strengthen content moderation and adapt their systems to comply with Malaysia’s new online safety requirements.
