Meta, Google and TikTok have each sued California's Attorney General to block a new law that limits what social media can show users under 16. In Malaysia, a different rule has applied since 1 June 2026: under-16s may not register on licensed social media services, which the deputy communications minister has described as platforms with more than eight million users in Malaysia.
Quick facts
Contents
- Malaysia's Child Protection Code, issued by MCMC under the Online Safety Act 2025, took effect on 1 June 2026 for new sign-ups; MCMC said existing accounts would be age-checked progressively over a period of up to six months
- It requires age checks against MyKad, passport, birth certificate or another recognised record
- A licensed provider that fails its duties under Part III of the Act can face an MCMC financial penalty of up to RM10 million (Section 39)
- California's AB 1709 sets a civil penalty of up to US$50,000 per affected under-16 user for a knowing violation, or up to US$25,000 if negligent
What Meta, Google and TikTok are fighting in California
California's AB 1709 (Chapter 183, Statutes of 2026, full chaptered text) was chaptered on 10 September 2026. It bars a covered platform from offering an "addictive feature" to a user under 16. TechCrunch reports that this covers autoplay videos and personalised feeds, and that the law is due to take effect at the start of 2027. The bill text requires a covered platform to delete an under-16 user's account, except where the platform keeps that account free of addictive features.
According to TechCrunch, the companies argue the law breaches the First Amendment, and a TikTok spokesperson called it "a blatantly unconstitutional restriction on free expression". A representative for California's Attorney General told TechCrunch the office was reviewing the filings.
The two penalties are counted differently. California's US$50,000 is a cap per affected under-16 user, so it scales with the number of children involved. Malaysia's RM10 million is a cap on a single financial penalty against a provider. The two figures cannot be compared directly.
What Malaysia's under-16 rule already requires
MCMC's Child Protection Code, published on 22 May 2026, says only users identified as 16 and above may register for a licensed social media service likely to be accessed by children. Age must be checked against Malaysian government records such as MyKad, a passport or a birth certificate, or an equivalent foreign record, and the data collected must be kept to what the check needs.
The code also asks platforms to limit features that "increase, sustain or extend" a child's use, and to give children and parents options to manage personalised recommendations. Those duties overlap with part of what California's law targets, though the two rules define the features, the services covered and the penalties differently.
Deputy Communications Minister Teo Nie Ching told Bernama in May that the rule covers platforms with more than eight million users in Malaysia, naming TikTok, Facebook and Instagram among the platforms MCMC had engaged. She said then that a timeframe for verifying existing accounts was still being discussed with the platforms. In a statement on 1 June 2026, as reported by Bernama and Free Malaysia Today, MCMC set that timeframe: platforms will verify existing users progressively over a period of up to six months, and an existing user found to be under 16 gets one month to download or transfer their data, including photos and videos, before any restriction or suspension.
How Malaysia is enforcing it
In a written parliamentary reply reported by Bernama on 4 August, the Ministry of Communications said MCMC had issued written notices under Subsection 30(2) of the Online Safety Act to social media providers, requiring them to explain instances of non-compliance.
Communications Minister Fahmi Fadzil told the Dewan Rakyat on 24 June that platforms failing the age-verification requirements could face penalties of up to RM10 million. As reported by Bernama, he said a licensed provider that fails its obligations under Part III of the Act may face a financial penalty of up to RM10 million under Section 39. He also said Section 30 lets MCMC issue written directives on compliance, and that failing to comply with such a directive is an offence carrying a fine of up to RM1 million on conviction, plus up to RM100,000 for each day it continues.
The platforms have also built their own age tools here. Google announced age assurance for Malaysia, which estimates whether an account belongs to someone under 18 (our report), and it is making Gemini opt-in for K-12 student accounts, per its education update.
Neither the ministry nor MCMC has published a count of Malaysian accounts verified or closed, and the 4 August 2026 parliamentary reply describes notices to platforms, not penalties. MCMC's own period for checking existing accounts was set at up to six months from 1 June 2026, so the next update on how many accounts have been checked is the one to watch.
