On June 1, 2026, Malaysia’s Child Protection Code (CPC) came into force under the Online Safety Act 2025, making Malaysia one of the first countries in the world — and the second in Asia — to enforce a minimum age for social media accounts. Children under 16 can no longer register accounts on covered platforms, and both new and existing users will be required to verify their age against government-issued records.
If you read our analysis of Australia’s under-16 ban, you might assume Malaysia is running the same playbook. It is not. Australia explicitly prohibits platforms from compelling users to present government ID. Malaysia points platforms directly at MyKad, passports, and MyDigital ID. These are close to opposite architectures for the same policy goal — and if you operate in both markets, you now need a verification stack that can be configured per jurisdiction without maintaining two separate systems.
This post covers what the Child Protection Code actually requires, where the compliance traps are, and what an eKYC-first age verification architecture looks like when it has to coexist with no-ID regimes elsewhere.
What Took Effect on June 1
The Child Protection Code is a regulatory code issued by the Malaysian Communications and Multimedia Commission (MCMC) under the Online Safety Act 2025 (ONSA). It applies to licensed social media service providers with at least eight million users in Malaysia. MCMC’s guidance specifically names Facebook, Instagram, TikTok, and YouTube, and the regulator has said additional platforms can be brought into scope later.
The headline obligation: covered platforms must prevent users under 16 from registering social media accounts, and must introduce age verification measures to determine whether a user is at least 16 before allowing registration or access to certain features.
The enforcement teeth are real. Non-compliance can draw fines of up to RM10 million (roughly USD 2.5 million), and platforms that continue to breach the rules face blocking or suspension of their services in Malaysia. Notably, parents and guardians face no penalties — the entire compliance burden sits with the platform.
Existing users are not grandfathered in. MCMC has said age verification for existing accounts will roll out over the next six months, and users identified as under 16 will get one month to download or transfer their data — photos, videos, message history — before restrictions are applied. We’ll come back to why that six-month window is the hardest engineering problem in the entire regime.
The eKYC-First Model: How Malaysia Differs
Malaysia’s approach is what MCMC calls “technology-neutral” and “outcome-based”: the regulator does not prescribe a single verification method, but it does set the bar for what counts. Platforms may verify users against government-issued records such as:
- MyKad — Malaysia’s national identity card, held by every citizen from age 12
- Passports — Malaysian or foreign
- MyDigital ID — Malaysia’s national digital identity platform
- Other documents recognized by Malaysian or equivalent foreign authorities
This is the critical divergence from Australia. Under Australia’s Social Media Minimum Age regime, a flow that says “upload your ID or you don’t get in” is non-compliant by design — platforms must always offer a no-ID alternative. In Malaysia, verification against government records is the anticipated path. Communications officials have pointed to the country’s existing eKYC infrastructure — already standard in Malaysian e-wallets and fintech onboarding — as the model platforms are expected to follow.
For platform operators, this means the verification flow that would get you fined in Sydney is the one regulators expect in Kuala Lumpur. Any vendor or in-house system that hard-codes a single verification philosophy will fail in one of the two markets.
Data Minimization Is Not Optional
The instinct to read “eKYC-first” as “collect everything” is the second trap. Malaysia’s Deputy Communications Minister Teo Nie Ching was explicit in the Dewan Rakyat: personal information gathered for age verification can be used only for age verification. In her words, after the check is complete, “we will not collect information on who the account user is, who the account owner is, or what their name is — the process is only limited to age verification.”
The CPC requires that platforms:
- Collect only the information necessary for verification
- Use that information exclusively for verification purposes
- Handle it securely, in compliance with Malaysia’s Personal Data Protection Act (PDPA)
- Clearly explain to users what information is needed, how the process works, and how their data will be handled
This is the architecture question that separates compliant systems from liability factories. A naive implementation OCRs the MyKad, stores the document image, the name, the IC number, and the photo — and now holds a database of national identity documents for millions of users. The Discord breach of December 2025, where government-ID photos of 70,000 users were exposed through a third-party verification provider, is the cautionary tale every regulator in the region knows by name.
The correct pattern is verify-then-discard: extract the date of birth, compute the age threshold result (a boolean — over or under 16), confirm the document belongs to the person presenting it via face match and liveness detection, then discard the document data and retain only the threshold attestation. Xident’s age threshold classification works exactly this way — the platform receives “16+: true” and a reusable token, never the identity behind it. That satisfies the CPC’s verification requirement and the PDPA’s minimization requirement simultaneously, and it means a breach of your user database leaks no identity documents because you never stored any.
The Six-Month Re-Verification Wave
New account registration is the easy half of the problem. The genuinely hard half is the existing user base.
MCMC expects platforms to verify existing users over the next six months. For a platform at the eight-million-user threshold, that is a sustained verification load of well over a million checks per month, on top of normal signup flow — users who never expected to be asked for anything, interrupted mid-session and told to present a MyKad.
Three failure modes dominate here:
Drop-off. Every verification prompt is a churn event. If your flow takes ninety seconds and fails on the first attempt for users with worn documents or poor lighting, you will lose legitimate adult users at scale. Client-side liveness and document capture that pre-validates image quality before submission is the difference between a 70% and a 95% first-pass completion rate.
Repeat verification. If a user verifies on mobile and is challenged again on web — or worse, re-challenged every time risk scoring hiccups — completion rates collapse. Token-based verification status (the user verifies once, the platform holds a privacy-preserving token attesting the threshold result) eliminates repeat friction without storing identity.
The gray zone around 16. Document-based verification is binary and accurate, but pushing 100% of users through document checks is expensive and slow. A layered approach — facial age estimation first, with document verification reserved for users whose estimated age falls within the buffer zone around the threshold — cuts cost and friction dramatically while keeping the error rate where the regulator wants it. Malaysia’s outcome-based framing permits exactly this kind of intelligent escalation, as long as the outcome holds.
Beyond the Age Gate: The Rest of the CPC
Age verification is the most visible requirement, but the Child Protection Code is broader. Covered platforms must also implement:
- Highest privacy settings by default for child users
- Restrictions on adult-child communication — direct messaging between child users and unrelated adults must be restricted or prohibited
- Safe recommendation systems — search and recommendation algorithms must not promote harmful content to children, with safe search on by default
- Parental control tools that are user-friendly and easy to access
- Harmful content reporting mechanisms with rapid response to takedown requests from authorities
There is also a subtle obligation that deserves more attention than it gets: MCMC expects platforms to take “reasonable and proportionate measures” to detect children using their parents’ accounts. That means age assurance in Malaysia does not end at the registration gate — platforms need ongoing signals (usage patterns, behavioral indicators) that flag likely account misuse after verification. A one-time check satisfies the letter of the age gate; the CPC’s framing anticipates continuous assurance.
One Architecture, Two Philosophies
Step back and the strategic picture for platform operators is this: the under-16 wave is global, but the implementations are diverging. Australia bans compelling government ID. Malaysia expects government-record verification. Indonesia and Brazil have announced their own variants. Denmark, France, and other EU states are moving under the DSA umbrella. Each regime sets its own age threshold, its own acceptable methods, and its own privacy constraints.
Building a bespoke flow per jurisdiction is how engineering teams drown. The sustainable pattern is a configurable verification waterfall:
- Method configuration per market — document-first (eKYC) in Malaysia, estimation-first with no-ID alternatives in Australia, wallet-based where EUDI credentials are accepted
- Threshold configuration per market — 16 in Malaysia and Australia, 15 or 18 elsewhere
- A single privacy core — verify-then-discard processing, threshold attestations instead of identity records, and reusable tokens so users verify once per device or account lifetime
This is the architecture Xident ships out of the box: age threshold classification at +12, +15, +18, +21, and +25, document OCR with face match and liveness detection for the eKYC path, and token-based returning-user handling so verification status persists without identity storage. The same integration serves the MyKad flow in Malaysia and the no-ID waterfall in Australia — it’s configuration, not a rebuild.
What to Do Now
If Malaysia is a covered or upcoming market for your platform:
- Confirm scope. The CPC currently applies to licensed platforms with 8M+ Malaysian users, but MCMC has signaled the list can grow. If you’re near the threshold or expect to be named, build now — the grace period is for implementation, not for waiting.
- Map your verification flow against PDPA minimization. If your current vendor or in-house system retains document images or extracted identity data after verification, you have a problem that gets bigger as the re-verification wave proceeds.
- Plan the existing-user campaign as a product launch, not a compliance task. Six months, millions of checks, one chance at first impressions. Sequence by cohort, pre-communicate clearly, and instrument drop-off from day one.
- Audit your child-safety surface beyond the gate. Default privacy settings, DM restrictions, recommendation safety, and parental controls are all in the code — the age gate alone is not compliance.
- Choose architecture that travels. Malaysia will not be the last regime you implement this year. Pick a verification stack where jurisdiction differences are configuration parameters.
The under-16 era is no longer coming — between Australia in December and Malaysia this month, it has arrived on two continents in six months, with more jurisdictions queued behind them. The platforms that treat this as an architecture decision rather than a per-country fire drill are the ones that will still be shipping product features next year instead of compliance patches.
Xident provides privacy-first age verification with document OCR, face match, liveness detection, and reusable verification tokens — one integration, configurable per jurisdiction. See how it works or talk to us about Malaysia CPC compliance.
