Malaysia’s Online Safety Act 2025 aims to protect children and online users from harmful content such as cyberbullying, exploitation, and digital threats, the Malaysian Communications and Multimedia Commission (MCMC) said [1, 2].
On May 22, the MCMC announced two regulatory codes mandated by the Act: the Child Protection Code (CPC) and the Risk Mitigation Code (RMC) [1, 2]. These frameworks set out rules for online platforms and social media operating in Malaysia.
The CPC requires platforms to implement “child safety-by-design” measures. This includes limiting account registration and ownership for users under 16 years old to reduce children's exposure to digital risks [1, 2].
The RMC, which took effect June 1, mandates licensed platforms to conduct risk assessments of harmful content and improve governance, reporting, and response systems [3]. Platforms must verify advertisers and label manipulated or synthetic media such as deepfakes. Harmful content covered includes child sexual abuse material, financial fraud, harassment, terrorism-related content, and materials promoting self-harm among children [3].
Platforms are required to keep written records of their risk assessments and review them at least annually to ensure compliance [3]. The MCMC said the codes will be implemented on an outcome-based approach, giving platforms flexibility in meeting safety, privacy, and legal requirements [1, 2].
A reasonable grace period will be given to platforms to comply with new verification and safety rules under these codes [1, 2].
Public consultations on the regulatory codes took place from February 12 to March 31, involving industry players, civil society groups, and other stakeholders [1, 2]. The Communications and Multimedia Content Forum of Malaysia welcomed the safeguards. CEO Mediha Mahmood said, “The safeguards sent an important policy signal to parents and guardians on the risks children may face in digital spaces.” [1]
The enforcement of these codes marks a concrete step in Malaysia’s efforts to enhance online safety, particularly for children. Licensed platforms must comply with the Risk Mitigation Code requirements starting from June 1.
