MalaysiaOnline Safety Act 2025, Child Protection Code, social-media age verification
Online Safety Act 2025 (Act 866), Child Protection Code s. 3 (Age Verification)
In force since .
A social media and minors rule binding private bodies.
- Enforcement body
- Malaysian Communications and Multimedia Commission
- Age threshold
- 16
- Verification methods
- Gov ID
- Audit expectation
- none
What it requires
- Applies to a licensed applications service provider or licensed content applications service provider offering a social media service likely to be accessed by child users.
- Implement effective age verification measures so that only users whose ages have been identified as sixteen years or above may register for the service or access a feature of the service appropriate for their age.no control in the NIST Privacy Framework
- Verify age against documents issued by the Government of Malaysia (National Registration Identity Card, passport, birth certificate or another government-recognised document), or an equivalent document issued or recognised by a competent authority in another jurisdiction.no control in the NIST Privacy Framework
- Collect only personal data that is adequate, relevant and necessary for age verification, and do not keep it longer than necessary for that process, consistently with the Personal Data Protection Act 2010.NIST Privacy FrameworkGV.PO-P1NIST Privacy FrameworkCT.DM-P5
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalty structure
Administrative financial penalty the Commission may impose on a licensed applications service provider or licensed content applications service provider for non-compliance with any duty under Part III of the Online Safety Act 2025, which includes the section 18 duty this Code implements, recoverable as a civil debt; not a criminal fine.
- Rule
- Fixed only
- As of
- Currency
- MYR
- Fixed cap
- 10,000,000
What it makes you log
Log retention
- As of
- Basis
- Purpose bound
- Prohibits retaining
- Personal data collected and processed for age verification may not be kept longer than necessary for the age verification process.
Logging duty
Section 3 requires age verification against government records and limits the personal data collected and kept for it, but names no record, log or report of the check itself. The Online Safety Plan in section 8 of the Code is not cited by this row and is not borrowed.
- Kind
- None
- As of
What this law does
The Child Protection Code, issued by the Malaysian Communications and Multimedia Commission under section 80 of the Online Safety Act 2025 read with section 18, requires a licensed applications service provider or licensed content applications service provider offering a social media service likely to be accessed by child users to implement effective age verification measures so that only users whose ages have been identified as sixteen years or above may register for the service or access a feature of the service appropriate for their age.
The Code requires verification against records issued by the Government of Malaysia (National Registration Identity Card, passport, birth certificate, or another government-recognised document) or an equivalent record issued or recognised by a competent authority in another jurisdiction, and requires that any personal data collected for age verification be adequate, relevant, and limited to what is necessary, and not kept longer than necessary for that process, consistently with the Personal Data Protection Act 2010. The Code was published on and took effect on .
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .