New Child Protection Rules for Digital Platforms in Indonesia

What the Regulation Covers

Indonesia's Government Regulation on Child Protection in the Digital Space (PP No. 17/2026, issued March 2026) establishes new obligations for digital platform operators — including social media platforms, messaging applications, online marketplaces, gaming services, and content streaming platforms — that have users under the age of 18 in Indonesia.

The regulation introduces a tiered obligation framework based on whether a platform is classified as a General Electronic System Provider or a Private Electronic System Provider under the existing Electronic Information and Transactions framework. Foreign platforms serving Indonesian users are explicitly included.

Core Obligations for Platform Operators

Platforms are required to implement age verification mechanisms that reasonably distinguish between minor and adult users before granting access to age-restricted content or collecting personal data. The regulation does not prescribe a single technical method, but the mechanism must be proportionate to the risk level of the platform's content and services.

For users identified as under 18, platforms must obtain verifiable parental or guardian consent before collecting personal data. Consent obtained from the child directly is not considered valid under the regulation for this purpose. Platforms must have a documented consent management process and be able to demonstrate it on request.

Behavioral profiling of minor users — building profiles based on usage patterns, preferences, or inferred characteristics for advertising or content personalization purposes — is prohibited. This restriction applies regardless of whether the data was originally collected with consent.

Precise geolocation data may not be collected from users classified as minors without parental consent, and even where consent is obtained, such data must not be used for real-time location tracking or shared with third parties.

Content Restrictions and Reporting Requirements

Platforms must maintain and enforce a content policy that prevents minors from accessing content classified as adult, violent, gambling-related, or otherwise harmful to children under Indonesian law. The regulation strengthens existing content moderation obligations and makes platform operators liable for inadequate enforcement — not just for hosting prohibited content.

Where a platform becomes aware of content involving the sexual exploitation of children, there is a mandatory reporting obligation to Indonesia's National Child Protection Commission (KPAI) within a specified timeframe. Failure to report is treated as a separate violation from the underlying content.

Compliance Timeline and Sanctions

Platforms have a two-year adjustment period running until March 2028. However, the regulation also establishes that platforms may be required to demonstrate compliance readiness to KOMINFO before the deadline on request — meaning the adjustment period is not a license to delay preparation indefinitely.

Non-compliance sanctions range from administrative warnings and temporary service suspension to permanent access blocking for platforms operating in Indonesia. The Ministry of Communication and Digital Affairs retains the authority to block non-compliant foreign platforms regardless of where they are incorporated.

What Platforms Should Prioritize Now

The highest-priority compliance actions are a gap analysis of current age verification capabilities, a review of data collection flows that may capture minor users, an audit of behavioral advertising and profiling systems, and a review of parental consent mechanisms. Platforms that already operate in jurisdictions with similar rules — such as the UK Age Appropriate Design Code or the US COPPA framework — will have a shorter path to compliance, but the Indonesian requirements have distinct technical specifications that require separate assessment.