On 24 September 2026, Communications Minister Fahmi Fadzil said the Malaysian Communications and Multimedia Commission (MCMC) will keep supporting the Royal Malaysia Police's D11 division, which handles sexual, women and child investigations, with technical and forensic help. He said that anyone who misuses network services can be traced, arrested and prosecuted. In the same remarks he said MCMC is using the Online Safety Act to press platforms to keep their environments safe, especially for women and children, and that those under 16 are not permitted to open social media accounts (The Star).
Those are two different policies, and they deserve different verdicts.
What the operation actually shows
The context was Op Pedo Integrated 3.0. Bukit Aman CID director Datuk M. Kumar announced on 22 September that 53 people had been arrested, eight of them teenagers and the youngest aged 13. The simultaneous raids ran from 14 to 16 September and were based on intelligence from D11 and MCMC. Police said child sexual abuse material (CSAM) videos and animations were being produced, distributed and sold through closed online groups for RM50 to RM60 each (The Vibes).
This is the model that works. The harm is a serious crime, the offenders operate in closed groups that platform-wide filters would not reach, and the response was targeted investigation: a regulator with network expertise lends forensic capacity to a police unit with prosecutorial power. Nothing here required new speech restrictions or blanket surveillance. For a pro-innovation, pro-speech publication, it is the easy case: spend public money on investigators, not on mandates for every user.
Two caveats keep the figure honest. The 53 arrests are an operational outcome announced by police, not a measure of how much abuse exists or of how much the Online Safety Act contributed. And the group included eight teenagers, a reminder that prosecuting minors for sharing material raises its own proportionality questions that diversion and education programmes may handle better than the criminal system.
The strongest case for the under-16 rule
The case for age limits deserves a fair statement. Children are exposed to grooming, sextortion and harmful content on platforms built for adults, and parents struggle to supervise dozens of apps. Self-declared birthdays are trivially falsified, so a rule that merely asks for a date of birth protects nobody. If the state wants an age floor, the argument goes, it has to require real verification, and only a legal duty on platforms will produce it.
MCMC's own guidance reflects that logic. Its Online Safety Act page says the rules took effect on 1 June 2026, that platforms are required to verify user age effectively and appropriately, and that they may use government-issued records or documents where required. MCMC describes itself as technology-neutral, leaving platforms to choose their method (MCMC).
Where the design strains
First, the rule is not quite the flat ban the minister's wording suggests. According to MCMC, children under 16 cannot run their own accounts but may use social media through a parent's or guardian's account, and 16 and 17-year-olds may have accounts with parental controls and highest-privacy defaults. That is a supervised-access model. It is more defensible than a prohibition, but it means the headline claim and the legal text differ, and platforms and families need the text.
Second, verification is the cost centre. Checking everyone's age means checking everyone's identity, or at least a government-backed credential. Every adult who wants to use a platform becomes a data subject in a verification flow. That creates breach risk, chills anonymous speech, and favours large incumbents that can afford compliance engineering over local start-ups and smaller services. A digital economy strategy built around making Malaysia an easy place to launch online services sits uneasily with a regime that front-loads identity infrastructure onto every service with social features.
Third, the evidence on proportionality is thin. The operation the minister cited was won through investigation of closed groups and sales channels. Nothing in the public record from the September announcement shows that account-opening age checks would have prevented those offences, or that they displace the investigative work that did. Policy should be judged on that counterfactual before the cost is imposed on every user.
What a proportionate version looks like
MCMC has also published a Child Protection Code and a Risk Mitigation Code under the Act, each with FAQs, which suggests a risk-based approach is available (MCMC codes release). The better path is to lean into it:
- Fund the enforcement that works. D11's capacity, MCMC's forensic tooling and cross-border cooperation with platforms on closed-group takedowns deliver arrests.
- Keep verification minimal. Prefer privacy-preserving checks that confirm an age band without disclosing identity or retaining documents, and publish retention limits.
- Scale duties to risk. A messaging or video service with open discovery of strangers warrants stronger checks than a recipe forum.
- Publish evidence. MCMC should report how many accounts were blocked, how many appeals succeeded and what verification costs, so Parliament can judge whether the rule earns its burden.
The September remarks bundle a clearly justified enforcement success with a broader mandate whose value is unproven. Malaysia can protect children and keep its platform economy open, but only if it keeps those two things distinct and measures the second against the first.