Delete the data once you've verified the age—that's the rule.
In a quiet but consequential act of governance, Malaysia has drawn a line between childhood and the digital marketplace — placing the burden of proof not on the young, but on the platforms that profit from their attention. Under the Online Safety Act of 2025, social media companies operating in the country must now verify, through official documentation, that any new account holder has reached the age of sixteen. The policy, known as 'Tunggu 16' or 'Wait Until 16,' reflects a growing global reckoning with what it means to allow children unrestricted entry into spaces engineered for engagement — and asks whether a society's duty to protect its youngest members can be encoded into law.
- Malaysia has made self-declaration obsolete — a child cannot simply type a birthdate to access social media; a MyKad, passport, or government-recognized document is now required.
- The regulation targets a familiar catalogue of harms: disturbing content, predatory behavior, and the compulsive architecture of platforms built to hold attention at any cost.
- A sharp privacy safeguard runs alongside the age check — verification data must be deleted immediately after use, leaving platforms no legal ground to retain, profile, or monetize what they collect.
- Non-compliant platforms face financial penalties, transforming what might have been a symbolic gesture into a structural demand backed by consequence.
- The policy reframes responsibility — rather than asking children to protect themselves, it instructs companies to act as gatekeepers, making friction itself a form of child protection.
Malaysia has made it official: social media platforms operating within its borders must verify that new users are at least sixteen years old — and a typed birthdate will not be enough. The requirement, which took effect June 1st under the Online Safety Act of 2025, stems from two codes issued by the Malaysian Communications and Multimedia Commission in late May: the Child Protection Code and the Risk Mitigation Code.
The government calls the initiative 'Tunggu 16' — Wait Until 16 — a name that signals restraint rather than prohibition. When questioned in parliament by a lawmaker from Bangi, the Ministry of Communications was careful to frame the policy as a gate, not a wall. The goal is not to keep children offline permanently, but to delay their entry into these spaces until they are better equipped to navigate them.
The mechanics are deliberate. Platforms must accept official documentation — a MyKad, passport, or birth certificate — before allowing account creation. What they cannot do is hold onto that information. Once verification is complete, the data must be deleted. The law enshrines the principles of data minimisation and purpose limitation: collect only what is necessary, use it only for its stated purpose, then discard it. The logic is protective in both directions — shielding children from platforms, and shielding everyone's data from the platforms themselves.
Non-compliance carries financial penalties, giving the regulation teeth. What the policy ultimately proposes is a redistribution of responsibility: rather than expecting children to resist systems designed by engineers to capture their attention, it places the obligation on the companies themselves. Whether enforcement will match ambition remains the open question — but Malaysia's intent is clear. It is willing to constrain the business model of social media in service of protecting the young.
Malaysia's government has moved to lock social media accounts away from anyone under sixteen. Starting June 1st, under the newly enforced Online Safety Act of 2025, every platform operating in the country must verify a user's age before allowing them to create an account—and they cannot simply take a user's word for it.
The requirement comes from two codes issued by the Malaysian Communications and Multimedia Commission on May 22nd: the Child Protection Code and the Risk Mitigation Code. When a lawmaker from Bangi, Syahredzan Johan, asked about the measure in parliament, the Ministry of Communications explained that the rule exists to shield children from the known harms of social media—exposure to disturbing content, predatory behavior, and the compulsive pull of platforms designed to capture attention.
The government calls this initiative "Tunggu 16," or "Wait Until 16." The name itself signals the intent: this is not a permanent ban. Rather, it is a gate. The ministry was careful to clarify that the goal is not to keep children offline forever, but to delay their entry into these spaces until they reach an age when they might navigate them more safely and responsibly.
The mechanics are specific. Licensed social media providers must perform age verification—not identity verification, a distinction that matters. They can use official documents: a MyKad, a passport, a birth certificate, or any government-recognized credential. Self-declaration alone will not suffice. A user cannot simply type in a birthdate and proceed. There must be documentation, a paper trail that confirms what they claim.
But here is where the regulation tightens further. Once the verification is complete, the data must be deleted. Platforms cannot warehouse this information. They cannot build profiles from it. They cannot use it for any purpose beyond confirming age. The law calls this "data minimisation" and "purpose limitation"—collect only what you need, use it only for what you said you would, then discard it. The principle is straightforward: the less information companies hold onto, the less they can misuse or lose to a breach.
To enforce compliance, the government has armed itself with penalties. Licensed providers that ignore these requirements face financial consequences. The threat is real, and it is meant to be.
What emerges from this policy is a particular vision of childhood online. The government is saying that sixteen is the threshold where judgment solidifies enough, where a young person has developed sufficient critical distance from persuasion and harm. Before that, the platforms themselves become the gatekeepers. The responsibility shifts from the child to the company. It is a regulatory bet that friction—the requirement to produce documents, the delay, the friction itself—will reduce harm by reducing access.
Whether the measure will work as intended remains to be seen. Enforcement will be the test. But the signal is unmistakable: Malaysia is willing to constrain the business model of social media companies in service of protecting minors, and it is willing to do so by making data deletion, not retention, the default.
Citas Notables
The initiative is aimed at protecting children from online harms including exposure to harmful content, exploitation and excessive use of digital platforms.— Ministry of Communications
The measure is not intended to permanently prevent children from using social media but to delay account ownership until they reach an age considered more suitable for safe and responsible usage.— Ministry of Communications
La Conversación del Hearth Otra perspectiva de la historia
Why sixteen specifically? What makes that age the line?
The government didn't explain the reasoning in detail, but sixteen appears to be the age they believe young people develop enough judgment to handle the risks—exploitation, harmful content, compulsive use. It's a threshold, not a science.
So a fifteen-year-old can never use social media in Malaysia?
Not never. They're blocked from opening their own accounts. But the regulation doesn't prevent them from using someone else's account or accessing platforms through other means. It's about formal ownership and responsibility.
The data deletion part—how does that actually work? Don't companies need records for compliance?
They need to prove they verified the age, but they don't need to keep the personal documents themselves. They can store a verification token or timestamp without storing the MyKad number or passport details. The principle is: keep the minimum.
What happens if a platform just ignores this?
Financial penalties. The government made that clear. But enforcement depends on the MCMC actually catching violations and following through. That's where the real test lies.
Does this apply to foreign platforms or just Malaysian companies?
Any platform operating in Malaysia—so yes, the big international ones. That's where the teeth is. If Meta or TikTok want Malaysian users, they have to comply with Malaysian law.
Is this unique to Malaysia?
Several countries have moved toward age verification for minors online, but Malaysia's approach is notable for the strict data deletion requirement. Most regulations focus on access; this one also focuses on what companies do with the information they collect.