MalaysiaOnline Safety Act 2025, Child Protection Code, safe design and operation duty for services likely accessed by children
Online Safety Act 2025 (Act 866), Child Protection Code ss. 2, 4-7 (Child Safety by Design)
In force since .
An age-appropriate design code rule binding private bodies.
- Enforcement body
- Malaysian Communications and Multimedia Commission
- Age threshold
- 18
- Audit expectation
- none
What it requires
- Applies to a licensed applications service provider or licensed content applications service provider; the Code covers any applications service enabling communication between users and any content applications service, and a child user is a person under 18.
- If your service is, in your opinion, likely to be accessed by child users, design and operate it to prevent a child's access to suspected harmful content and to limit features that increase or sustain a child's use of the service.no control in the NIST Privacy Framework
- Limit an identified adult's ability to communicate with an identified child, and prevent an identified adult from viewing an identified child's personal information.NIST Privacy FrameworkCT.PO-P1
- Set privacy and safety settings to the highest level by default for child users, and limit an unconnected adult's direct communication with a child user.NIST Privacy FrameworkGV.PO-P2
- Make parental control features available.no control in the NIST Privacy Framework
- Moderate content: detect and remove harmful content, provide accessible reporting channels for child users, and take steps against repeated exposure to reported or removed content.no control in the NIST Privacy Framework
- Control personalised recommendation systems so that they are suitable for child users and do not display or promote harmful content to them.no control in the NIST Privacy Framework
- Activate safe search by default.no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalty structure
Administrative financial penalty the Commission may impose on a licensed applications service provider or licensed content applications service provider for non-compliance with any duty under Part III of the Online Safety Act 2025, which includes this section 18 duty, recoverable as a civil debt; not a criminal fine.
- Rule
- Fixed only
- As of
- Currency
- MYR
- Fixed cap
- 10,000,000
What it makes you log
Logging duty
Sections 2 and 4 to 7 of the Code set design, moderation, reporting, parental-control, default-settings and recommender duties and name no log, record or retention rule. Section 8, which requires an Online Safety Plan demonstrating compliance, is not cited by this row and is not borrowed.
- Kind
- None
- As of
What this law does
Section 18 of the Online Safety Act 2025 requires a licensed applications service provider or licensed content applications service provider to implement measures, specified in a code issued by the Commission, to ensure the safe use of its services by a child user, defined as a person under the age of eighteen years; subsection 18(3) requires that, for a service that is, in the provider's opinion, likely to be accessed by child users, those measures include safe design and operation to prevent a child's access to suspected harmful content, limit an identified adult's ability to communicate with an identified child, limit features that increase or sustain a child's use of the service, prevent an identified adult from viewing an identified child's personal information, and control personalised recommendation systems suitable for child users.
The Child Protection Code, issued by the Commission under section 80 read with section 18 and taking effect , applies these duties to any applications service enabling communication between users and any content applications service, and adds content-moderation duties (detecting and removing harmful content, accessible reporting channels for child users, steps against repeated exposure to reported or removed content), a duty to make available parental control features, a duty to set privacy and safety settings to the highest level by default for child users and limit an unconnected adult's direct communication with a child user, and duties over search and recommendation systems.
Those duties include activating safe search by default. Separately, algorithmic recommendation does not display or promote harmful content to child users.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .