Indonesia’s child-safety rule puts risk filing alongside under-16 deactivation

Indonesia’s child-safety rules are being described largely through one number: under-16 accounts.

But the regulation puts a broader compliance system around that restriction.

What happened

Government Regulation 17/2025, known as PP TUNAS, requires electronic-system operators (Penyelenggara Sistem Elektronik, or PSEs) whose products may be used by children to assess the risks of those products, services and features. Ministerial Regulation 9/2026 (Permen 9) sets out the filing, verification and risk-profile process. For services classified as “network and social-media services”, the regulation adds a specific requirement: deactivate accounts belonging to children under 16.

The first signs of that process are now visible in operator filings and account deactivations.

What a PSE has to do:

• Set and communicate minimum ages. Use the five prescribed age bands, starting at three, and do not target products, services or features at children under three.

• Verify child users. Provide a child-user verification mechanism, using technology developed internally or obtained from a provider. The minister may designate reliable technology.

• Assess and document risk. Assess the product against seven risk aspects: stranger contact, harmful content, consumer exploitation, children's personal data, addiction, psychological harm and physiological harm. A high finding on any one aspect produces a high-risk profile. The assessment must be authorised, dated and retained while children can access the product.

• File the assessment. Submit it to the director-general, name an organisational contact and remain legally responsible for its accuracy.

• Comply with the resulting risk profile. The minister determines whether the product is high- or low-risk. Products that require an account must also have working parental-supervision technology.

If the operator does not comply, PP TUNAS allows a written warning, a fine, temporary suspension or access termination (pemutusan akses). The regulation does not set a fine amount.

What it means

Social-network services are treated as high-risk by default, and operators providing those services must deactivate accounts belonging to children under 16.

Permen 9 defines that category as networked social interaction, user-to-user connection, and/or user-uploaded material. A ministerial decision sets the list of such services. Marketplace, ride-hailing and commerce PSEs sit inside the parent regulation if children may use the product. The under-16 deactivation duty applies to PSEs providing social-network services.

For a regional comparison, Australia has chosen an under-16 social-media ban, while Singapore is taking a standards-or-block approach.

By 8 June 2026, Komdigi said 19 PSEs covering 68 products, services and features had filed self-assessments. The ministry did not publish a scored list of those assessments, so the figure shows who had filed, not who had been judged compliant or low-risk. The minister said the filings included Instagram, Threads, Facebook, Bigo Live, X, YouTube, TikTok and Roblox.

Komdigi said TikTok had deactivated about 1.7 million under-16 accounts in Indonesia since 28 March 2026. TikTok's Indonesia public-policy head also cited the same figure in comments reported by Indonesian newsrooms. The figure is a reported deactivation count, not an audited total.

Together they show the rules moving from regulation into operator workflows. But the public enforcement record remains thin. No access termination or scored risk-profile list has been published under this instrument. On 8 June, the minister said risk-profile reviews would still take several months.

Four dates now sit on the same compliance file.

Permen 9 was promulgated and took effect on 6 March 2026. Komdigi then staged the start of under-16 deactivation from 28 March. The first self-assessment was due on 6 June, three months after promulgation. PP TUNAS, which took effect on 27 March 2025, gives PSEs until 27 March 2027 to adjust to the new governance requirements.

In summary, Indonesia has moved beyond setting an age threshold. It is asking platforms to document the risks associated with products children may use, assess those risks and put the resulting controls into operation. The next phase will show whether that paper trail produces regulatory decisions and enforcement, or remains largely a filing exercise.

What to watch

• Published risk-profile decisions. Whether Komdigi publishes high- and low-risk determinations for the products already filed. The 19-PSE figure currently shows who filed, not who was judged compliant or low-risk. A published determination, including any low-risk exception for a social-network service, would show how Komdigi is applying the framework.

• The first published sanction or access termination. Whether a written warning, fine, suspension or access cut is published under PP TUNAS. A named operator and named measure would move the file from documentation into enforcement. The absence of a published sanction so far is also worth tracking.

• How age assurance works at scale. Whether platforms disclose how they verify age, handle false positives and restore accounts that are wrongly deactivated. The 1.7 million TikTok figure shows the scale of the intervention, but not how accurately age assurance is working.