PETALING JAYA: Online service providers will be required to install stronger safeguards for children and stricter measures to tackle harmful content with two new codes under the Online Safety Act 2025 (Onsa).
The Malaysian Communications and Multimedia Commission (MCMC) said this follows the implementation of the Child Protection Code (CPC) and Risk Mitigation Code (RMC), which will both take effect on June 1.
“The CPC and RMC constitute an important step in strengthening Malaysia’s approach to online safety.
“The implementation of these key obligations under Onsa also forms part of the government’s ongoing efforts to ensure a safer digital experience for children and families,” it said in a statement on Friday (May 22).
The regulator said the codes were published on Friday following engagements with industry players, civil society organisations and relevant stakeholders, including a public consultation exercise held between Feb 12 and March 31.
It added that the codes set clear expectations for service providers to take greater responsibility in addressing online harms within their services, particularly in safeguarding children and vulnerable users.
“The implementation approach under the codes remains outcome-based, allowing service providers the flexibility to adopt appropriate solutions that meet safety, privacy and legal requirements,” it said.
MCMC said the CPC focuses on ensuring a safer and more age-appropriate online experience for children by requiring service providers to embed child safety-by-design principles into their services.
This includes safeguards to limit account registration and ownership by users under the age of 16.
“The measures under CPC provide age-appropriate protections and restrictions on high-risk features, while helping to reduce exposure to exploitative interactions and harmful content,” it said.
Meanwhile, MCMC said the RMC requires service providers to implement proactive and systemic measures to mitigate harmful content risks.
This includes risk assessments, stronger content governance, effective reporting and response mechanisms, advertiser verification measures and the labelling of manipulated content where appropriate.
“The CPC and RMC will take effect from June 1, 2026,” it said.
It added that a reasonable grace period would be provided for service providers to complete the verification process effectively.
