On 14 October 2026, Malaysia's Communications Minister Fahmi Fadzil said the government's push for creative content on platforms such as YouTube must be matched by child online-safety measures. As reported, his priority is stopping children from communicating with adults who may groom or exploit them, not stopping them from watching content. We could not retrieve the original report, which returned an access error, so we rely on his on-record statements elsewhere. On 2 July 2026 he told the Dewan Rakyat that the under-16 rules aim to block adult contact with children and that "we are not banning them from watching" (Newswav, citing The Sun).
That is the right diagnosis. The question is whether the regulatory tool matches it.
What the code actually requires
The Child Protection Code was published by the Malaysian Communications and Multimedia Commission (MCMC) on 22 May 2026 under the Online Safety Act 2025 (ONSA), and the Act and codes took effect on 1 June 2026 (Allen & Gledhill). Its age-verification duty applies to social media platforms with at least eight million users in Malaysia. Those platforms must use checks based on government-issued records, such as MyKad or passports, or equivalent overseas records, so that only users aged 16 and over can register. Non-compliance can bring a fine of up to RM10 million and other regulatory action (same source).
MCMC's own under-16 guidance goes further. Under-16s cannot create or manage their own accounts, though they may use a parent's or guardian's account under supervision. Users aged 16 to 17 get parental controls and the highest default privacy settings (MCMC). The same page describes MCMC's approach as technology-neutral.
The strongest case for the rule
The case for a hard age floor is serious. Platforms have had years to police age through self-declaration, and it has not worked. A bright-line rule is easy to explain to parents and easy to enforce against a company. Official-document checks are also harder to fake than a typed birth year. The code is not purely a ban either: it is outcome-based and lets providers propose alternative measures that MCMC accepts as more effective, and it covers more than age. It requires limits on direct contact between unrelated adults and children, safe search by default, and tools for parents (Allen & Gledhill). A regulator choosing a clear rule over a vague "duty of care" is defensible.
Where the design and the stated goal diverge
The trouble is the fit between the minister's goal and the lead mechanism. If the harm is grooming, the relevant control is who can message, follow, or be recommended to a child. Whether a child holds an account in their own name matters much less. An under-16 who is shut out of registering does not stop being online. They watch logged-out, borrow a parent's account, or move to services below the eight-million-user line. The sensible reading of Fahmi's July statement, that children may keep watching and parents may open accounts with controls, concedes this. But it means the headline ID check polices registration while the actual risk sits in contact settings.
Document-based verification also has costs the code only partly addresses. It makes platforms collect or validate sensitive identity data for every user, not just children. The code says the data must be handled under Malaysia's Personal Data Protection Act, but that is a compliance label rather than a design constraint. The Electronic Frontier Foundation makes the parallel argument about California's AB 1709, a functional under-16 social media ban, saying it "still threatens the privacy and First Amendment rights" of everyone and that the state should prioritise education over bans (EFF). The legal settings differ, but the trade-off, identity collection at population scale in return for uncertain child-safety gains, is the same.
There is also a creator-economy cost. Fahmi has said the government wants more creative content on platforms like YouTube. Verification friction and the risk of account loss fall hardest on young creators, educators, and small channels that depend on those platforms, while the largest services absorb compliance costs easily.
What proportionate implementation looks like
Malaysia has left itself room. Because the code is outcome-based and technology-neutral, MCMC can lean on that flexibility rather than treating document checks as the only route. Four steps would keep the regime aimed at the harm Fahmi named:
- Measure contact outcomes. Ask platforms to report how many child accounts receive unsolicited messages from unrelated adults, and how quickly such accounts are removed. Judge compliance on those numbers, not only on verification rates.
- Default-off adult-to-child contact. Make non-contact the default for any account verified or estimated as a minor, whoever owns it.
- Minimise identity data. Allow privacy-preserving attestations, where a trusted party confirms an age band without handing the platform a document, and require deletion of raw ID data after checking.
- Publish evidence. MCMC should disclose how it will evaluate whether the rule reduced grooming or exploitation, not just how many accounts were verified.
The minister has framed the problem correctly: the danger is the adult on the other end of the chat, not the video. The regime will be judged on whether the next report shows fewer children being approached by strangers, rather than more Malaysians showing their MyKad to a social network.