The Online Safety Act 2025: What Malaysia's New Internet Rules Mean for You
- Gandhi Palanisamy
- 4 days ago
- 9 min read
On 1 June 2026, thousands of Malaysian parents found out about the new social media age rule the same way: from a teenager holding up a phone, mid-complaint. A few months earlier, on 1 January, an even bigger change had arrived with far less drama. For the first time, the biggest platforms on the Malaysian internet became legally answerable, in Malaysia, for the harmful content they host.
That change has a name: the Online Safety Act 2025. If you use Facebook, Instagram, TikTok, WhatsApp, YouTube or Telegram, it changed what those platforms owe you. If you are a parent, it changed what your children can sign up for. If you run a business, it changed what you can do when a scam page wears your company's name.
We handle these cases from our Penang office, and for years the problem was always the same. The law had answers, but the internet was faster. A lie could travel the whole country before anyone could file anything. This Act is the first real attempt to fix that. Here is what it says in plain language, and how to actually use it.
Quick answer:
The Online Safety Act 2025 has been in force since 1 January 2026
It binds the big platforms with at least 8 million Malaysian users: Facebook, Instagram, TikTok, WhatsApp, YouTube, Telegram and others
Platforms must run real report channels and respond within hours, not weeks
Nine categories of content count as "harmful content", and child sexual abuse material and financial scams get the fastest treatment
From 1 June 2026, children under 16 cannot register social media accounts, and age checks use MyKad or passport
Reporting is free. Fines on platforms reach RM10 million. A new tribunal hears appeals
What Is the Online Safety Act 2025?
It is a Malaysian law that makes the big online platforms responsible for protecting you from harmful content. The watchdog enforcing it is MCMC, the Malaysian Communications and Multimedia Commission. It started on 1 January 2026.
Before this Act, reporting something nasty online was mostly a message into the void. The platform might act, or might not, and no Malaysian law forced its hand. The Act changes the structure of that relationship. Platforms now carry legal duties, MCMC carries enforcement powers, and ignoring users now has a price tag.
This is not just words on paper. In the first week alone, MCMC acted on more than 1,500 online posts under the new law.
Who Does the Online Safety Act 2025 Cover in Malaysia?
The Act's duties fall on the service providers, not on you. The main targets are the large social media and messaging platforms: any service with at least 8 million users in Malaysia is treated as licensed and bound by the framework, and from 1 January 2026 that happened automatically, whether or not the platform ever applied for a licence.
In practice that means the platforms Malaysians actually live on: Facebook, Instagram, WhatsApp, TikTok, YouTube, Telegram, WeChat and their peers. Some of these companies had resisted licensing throughout 2025. The 8 million rule ended that conversation. If the users are here, the duties are here.
Just as important is who the Act does not burden. If you run a normal Malaysian business website, an online shop, a blog or a community page, the Act's duties do not fall on you. You meet this law as a user, and for users it mostly hands out rights, not obligations.
The Nine Kinds of "Harmful Content"
The Act lists nine categories of content that platforms must protect users from. In plain terms: child sexual abuse material, financial fraud and scam content, obscene content, indecent content, content that harasses or causes distress, fear or alarm, content inciting violence or terrorism, content that could push a child toward self-harm, content stirring up ill will and hostility in the public, and content promoting dangerous drugs.
Two of those nine get special treatment. Child sexual abuse material and financial scam content are classed as priority harmful content, which platforms must make inaccessible as quickly as possible once identified.
One honest note, because it matters for anyone whose reputation is under attack. Defamation is not one of the nine categories. A lie about you is not, by itself, "harmful content" under this Act, though the same post often also harasses or causes distress, which is covered. The Act gets harmful posts taken down. Clearing your name and claiming compensation still happens in court, and our complete guide to defamation law in Malaysia covers that side.
What the Platforms Now Owe You
The platforms now have legal duties. They must build safety features into the service, explain publicly how those work, run a report channel that actually functions, and act on what you report inside a set time. And the time is measured in hours, not weeks. Your report should be acknowledged within about an hour, looked at within about half a day, and harmful content taken down within about a day.
On 1 June 2026 two new sets of rules were added under the Act. A platform that fails its duties can now be fined up to RM10 million, and missing the response deadlines alone can cost it up to RM1 million.
You do not need to memorise any of that. The practical takeaway is simple: when you report something genuinely harmful on a major platform today, a legal clock starts running that did not exist before 2026.
The Under-16 Rule: What Parents Need to Know
From 1 June 2026, children under 16 can no longer register social media accounts in Malaysia. The rule arrived through the Child Protection Code issued under the Act, and MCMC has named Facebook, Instagram, TikTok and YouTube among the platforms it applies to.
Here is how it works in practice. New sign-ups must verify their age using a MyKad, passport or other government-issued document. For accounts that already exist, platforms will roll out age verification progressively over a period of up to six months. A user identified as under 16 gets one month to download or transfer their data, the photos and the videos, before the platform restricts or suspends the account.
If you are a parent of a child under 16, three practical steps. Talk about the change before the platform does it for you, because the account will not survive verification. Help them back up the memories they want to keep while the one-month window is open. And treat any service or seller offering to "fix" a child's age for a fee as exactly what it sounds like.
How to Report Harmful Content (It Is Free)
Start with the platform's own report button, because that is now the report with a legal clock on it. Report the specific posts and the account, choose the category that genuinely fits the harm, and keep your own screenshots before anything gets taken down. If the content involves a fake or anonymous account attacking you, screenshot first and report second, and our guide on unmasking an anonymous account in Malaysia explains that evidence discipline step by step.
You can also report straight to MCMC, free of charge, through its online complaints portal, by WhatsApp on 016-220 6262, or on its hotline 1800-188-030. An MCMC report creates an official record and puts the regulator's own powers behind your complaint. That matters most with scams, anything involving children, and platforms that are simply ignoring you.
If the harmful content is an AI-generated fake of you or someone you know, the playbook has extra steps, and we cover them in our guide on AI deepfake defamation in Malaysia.
If something online is damaging you, your family or your business right now, call us on 04-505 0420 before the evidence disappears. The first thing we do is tell you honestly whether this is a takedown, a court case, or both.
If Nothing Happens: The Online Safety Appeal Tribunal
The Act created something most Malaysians have never heard of: the Online Safety Appeal Tribunal. If MCMC makes a decision about your complaint and you believe it got that decision wrong, you can appeal to this tribunal. That right belongs to ordinary users, not only to the platforms.
It works like a court case. You file a notice of appeal, there is a hearing, and you can either speak for yourself or have a lawyer speak for you. Most people will never need it. But if the harm is serious and the system got it wrong, that is the point to call us before you file anything, because an appeal is far easier to run properly the first time than to repair afterwards.
What the Act Does NOT Do
Know the limits, because they decide what you do next. This Act does not decide whether you were defamed. It does not pay you a single ringgit. And it does not punish the person who posted. It controls platforms, nothing more. The person behind the post is dealt with somewhere else: the police for the criminal side, the courts for compensation.
So if your problem is a takedown, the Act is your tool. If your problem is your reputation, your losses, or making the person responsible answer for it, the Act is only step one, and the court route in our defamation guide is where the remedy lives. The two work best together: report fast under the Act, preserve your evidence, then take advice on whether the harm justifies going further.
What This Means for Malaysian Businesses
For most Malaysian businesses, the honest answer is reassuring: you have no new compliance burden under this Act unless you are running a platform with 8 million users, and you are not. What you gained is leverage you never had.
A fake page impersonating your business to scam customers now sits squarely inside the priority financial-fraud category, the one platforms must act on fastest. A coordinated smear from burner accounts can be reported under the harassment category while you preserve evidence for a defamation claim. Make brand searches a monthly habit, report impersonation the day you find it, and keep screenshots of everything. If the attack is serious enough to threaten the business itself, that is the moment to take legal advice on the court routes, and we tell clients honestly when it is not yet that moment.
Frequently Asked Questions
Is the Online Safety Act 2025 already in force?
Yes. The Online Safety Act 2025 (Act 866) came into force on 1 January 2026, and the two regulatory codes issued under it, the Risk Mitigation Code and the Child Protection Code, took effect on 1 June 2026.
What is the social media age limit in Malaysia now?
Sixteen. From 1 June 2026, children under 16 cannot register social media accounts on the major platforms. New sign-ups verify age with a MyKad, passport or other government-issued document, existing accounts face progressive age verification over up to six months, and a user found to be under 16 gets one month to save their data before the account is restricted.
What counts as harmful content under the Act?
Nine categories, including child sexual abuse material, financial fraud and scams, obscene or indecent content, harassment and content causing distress or fear, incitement to violence or terrorism, content pushing children toward self-harm, content stirring public hostility, and content promoting dangerous drugs. Child sexual abuse material and financial scams are priority harmful content, which platforms must act on fastest.
Can I report defamation under the Online Safety Act?
Not as defamation, because it is not one of the nine harmful-content categories. If the same post harasses you or causes distress, report it under that category. Clearing your name and claiming damages remains a court matter under defamation law, and both tracks can run at the same time.
How fast must platforms respond to my report?
In hours, not weeks. Under the Act's framework, reports are to be acknowledged within about an hour, given an initial assessment within about twelve hours, and content assessed as harmful removed within about a day. Platforms that breach the timeframes face fines of up to RM1 million, and broader failures of duty can cost up to RM10 million.
Does the Act apply to my business website or online shop?
No. The Act's duties fall on service providers with at least 8 million users in Malaysia. An ordinary business website, online shop or social media page carries no licensing or compliance duty under it. Your business interacts with the Act as a user, mainly by reporting scam pages and impersonation.
What happens if my report is ignored?
Escalate. Report the same content to MCMC through its complaints portal, WhatsApp line or hotline, which puts the regulator's enforcement powers behind the matter. If MCMC makes a decision you believe is wrong, the Act gives aggrieved persons, including users who made reports, the right to appeal to the Online Safety Appeal Tribunal.
Who enforces the Online Safety Act 2025?
The Malaysian Communications and Multimedia Commission (MCMC). It supervises platform compliance, acts on harmful content, and issued the two codes that took effect on 1 June 2026. MCMC acted on more than 1,500 posts in the Act's first week alone.
The Internet Did Not Get Kinder. You Got Stronger.
People did not get kinder on 1 January 2026. What changed is that the biggest platforms in Malaysia now answer to Malaysian law, on Malaysian deadlines, with Malaysian fines attached. The tools are free and already in your hands: the report button, the MCMC portal, and the age rule protecting your children. Use them early, keep your evidence, and when the damage goes beyond what a takedown can fix, that is when you call a lawyer.
Need Help With an Online Safety or Defamation Matter?
We are a litigation firm in Penang, and we act for people and businesses across Malaysia whose names are being damaged online. That covers the urgent part, getting the content down fast, and the part this Act cannot give you, which is making the person responsible answer for it. Bring it to us early. We will tell you straight whether you have a case worth running, and we will tell you honestly when you do not.
Gandhi Syahida & Associates
No. 5, 1st Floor, Taman Idaman, Jalan Idaman, 14100 Simpang Ampat, Pulau Pinang
Phone: 04-505 0420 | WhatsApp: 017-5190049
Email: admin@gandhisyahida.com.my
This article is for general information only and does not constitute legal advice. The law and procedure described may have changed since publication. For advice on your specific situation, please contact our firm or another qualified lawyer.
By Gandhi Palanisamy, Advocate and Solicitor of the High Court of Malaya. Last updated 25 July 2026.
Comments