What is ONSA (Online Safety Act) & Its Implementation

ONSA (Online Safety Act 2025) is a new legal framework enacted to protect users in the digital space and will come into force from January 2026. To know more about ONSA 2025, please visit MCMC’s official portal at the following link

​In contrast to existing laws, ONSA 2025 places responsibility directly on service providers (such as Facebook, TikTok, Instagram, WhatsApp, etc.).

Platforms must act proactively to detect, block, and take down harmful content without having to wait for reports from users or instructions from authorities.

See full info about ONSA 2025 below.

What is ONSA 2025?

ONSA (Online Safety Act 2025) is an act enacted to protect users from threats and harmful content online by requiring digital platforms to implement stricter security measures.

This Act sets the responsibility for digital platforms such as social media, messaging services, and content providers to ensure that harmful content is not spread, especially related to child exploitation, financial fraud, obscene content, threats and so on.

ONSA 2025 was introduced in response to increasing online threats such as cyber fraud, cyber bullying, sexual exploitation of children, illegal gambling and extreme content.

This law aims to ensure a safer digital ecosystem by placing clearer responsibilities on platform providers and regulators.​​

Refer to the MCMC media release below:

Full Enforcement Date

Starting January 1, 2026, ONSA 2025 will be fully enforced by law.

In addition, on this date also:

• Enforcement of “Deeming Provisions” (Deeming Provisions). Under this provision, major platforms such as TikTok, Facebook, Instagram, WhatsApp, Telegram, and YouTube are automatically considered “licensed” and fully subject to Malaysian law without having to go through a complicated registration process.
• Under 16 Prohibition: Social media companies must ensure that no user under the age of 16 has an account on their platform.

Who’s Involved?

• Government
• Law
• Enforcement Agency
• User/Parent
• Platform

The main objective of ONSA

The main objective of ONSA (Online Safety Act 2025) is to protect users from harmful online content and activities, with particular emphasis on the protection of children and the vulnerable.

This Act sets the responsibility on digital platforms to ensure that content such as child sexual exploitation, financial fraud, cyberbullying, threats, obscene content, and extreme content are not widely disseminated.​​

ONSA 2025 also aims to:

• Ensure digital platforms provide online safety plans, reporting of harmful content, and help channels to users.​​
• Reduce the risk of exposure to harmful content with stricter mechanisms such as age control, content filtering, and recommendation algorithm control.​
• Empower regulatory bodies such as the MCMC to monitor, impose penalties, and ensure digital platforms’ compliance with online security standards.​​

ONSA 2025 focuses on creating a safer and more responsible digital environment, emphasizing the protection of users, especially children, and upholding the accountability of digital platforms.

Platform Responsibilities

Under ONSA 2025, digital platforms are required to:

1. Provide a clear and comprehensive online security plan, including a risk mitigation strategy for harmful content.​​
2. Monitor, detect, and remove content classified as critical (such as child sexual exploitation, financial fraud, pornographic content, threats, etc.) quickly.​
3. Provide a simple and responsive complaint channel for users to report harmful content or activity.​​
4. Report security strategies, complaint statistics, and actions taken to the Malaysian Communications and Multimedia Commission (MCMC) on a regular basis.​​
5. Comply with MCMC instructions and orders related to surveillance, monitoring, and action against harmful content, including imposing penalties for non-compliance.

Implementation

Under ONSA, digital platforms are required to be more transparent about how they manage content reports and recommendation algorithms that could expose users to risk.

The Act also strengthens the role of regulatory bodies (such as MCMC) to issue directives, impose penalties and enforce compliance on local and foreign platforms operating in the country.​​

ONSA places particular emphasis on the protection of children and vulnerable groups who are more vulnerable to online exploitation and harassment.

These include stricter filtering requirements, age controls, as well as user-friendly complaint channels for parents and guardians.​​

Critical Content Category

ONSA 2025 focuses on nine categories of content that are considered critical and dangerous, including:

1. Content of child sexual exploitation material
2. Online financial fraud (online financial fraud).
3. Obscene or indecent content
4. Content that causes harassment, threats, or insults (harassment and abusive communications).
5. Content that provokes violence or terrorism (incitement to violence or terrorism).
6. Content that encourages children to commit violence against themselves (material promoting self-harm among children).
7. Content of incitement (hate speech) that can disturb public order
8. Content that promotes public displeasure or hostility
9. Content that promotes the use or sale of dangerous drugs

These categories are identified as “harmful content” that must be addressed by digital platforms and regulators under ONSA 2025 to ensure the safety of online users, especially children and the vulnerable.

​Application Service Provisioning Class License

From 1 January 2026, all social media platforms and internet messaging services that have at least 8 million users in Malaysia are required to have an Application Service Provider Class License.

All these large-scale service providers will automatically be considered registered as ASP(C) license holders under the provisions of Section 46A of the Communications and Multimedia Act 1998.

This move aims to ensure that this giant technology company is subject to Malaysian law and more accountable.

Here is the official media statement issued by MCMC:

The Malaysian government through the Ministry of Communications has announced that children under the age of 16 will be prohibited from having social media accounts starting January 1, 2026.

Unlike now where users only have to “confess” their age, from now on social media platforms must use the eKYC (Electronic Know-Your-Customer) method. Users need to:

• Verify identity using MyKad or MyDigital ID.
• Using a passport (for foreigners).
• Through the process of facial recognition (facial recognition) to ensure that the user’s age is authentic.

Under ONSA 2025, the burden of responsibility is placed on social media companies (such as TikTok, Instagram, Facebook, and X).

• If they allow children under 16 to register, the company can be fined heavily (up to RM10 million).
• Platforms with more than 8 million users in Malaysia are required to be licensed and comply with these regulations.

Coverage for 16–18 Year Olds

For teenagers between the ages of 16 and 18, they are still allowed to use social media, but the platform must ensure:

• The content displayed is age-appropriate.
• Algorithms do not reject harmful or sensitive content to them.
• Stricter parental control (parental tools) are provided.

More Information

For more information and the latest info about ONSA 2025 (Online Security Act), please visit the official portal of the Malaysian Communications and Multimedia Commission (MCMC) at the following link:

Also follow MCMC’s official facebook page to find out current information about the implementation of ONSA 2025, the latest developments related to online security and so on.

ONSA FAQs

What is ONSA 2025?

ONSA 2025 or Online Safety Act 2025 is an act enacted to protect users from harmful online content and activities, especially child sexual exploitation, financial fraud, cyberbullying, and extreme content.

Who is subject to ONSA?

ONSA is subject to all large-scale digital platforms such as social media, Internet messaging services, and application providers that have 8 million or more users in Malaysia.

What categories of content are considered critical under ONSA?

Critical content categories include child sexual exploitation, financial fraud, pornographic content, threats, violence, incitement, and content that promotes drug use.

What are the responsibilities of digital platforms under ONSA?

Platforms need to provide an online security plan, monitor and remove harmful content, provide complaint channels, report to MCMC, as well as comply with regulatory directives.

What are the penalties for failing to comply with ONSA?

If you fail to comply with ONSA (Online Safety Act 2025), the penalty imposed can involve a fine of up to RM10 million and a prison sentence of up to five years, or both. In addition, the platform can also be fined an additional RM1,000 for each day the offense continues after conviction.

How does ONSA protect children and the vulnerable?

ONSA emphasizes the protection of children by establishing stricter censorship, age control, and user-friendly complaint channels.

When does ONSA 2025 come into force?

ONSA 2025 comes into force from 1 January 2026.

What types of platforms need to be licensed under ONSA?

Digital platforms that have 8 million or more users in Malaysia, such as large social media and Internet messaging services, need to be licensed and comply with ONSA regulations.