Online safety & content laws in Indonesia (2026)

Indonesia began enforcing GR 17/2025's tiered age limits, barring under-16s from high-risk digital platforms and requiring age verification and parental consent; regulators noted few platforms were fully compliant at the start. It marks Indonesia's first hard rollout of child-specific online access controls.

President Prabowo Subianto signed GR 17/2025, imposing duties on electronic system operators to protect minors via risk-based age tiers (16 for high-risk, 13 for lower-risk services), age verification, abuse reporting, and data-protection safeguards. It is Indonesia's first dedicated online child-safety framework.

The second revision of the 2008 Electronic Information and Transactions Law added child-safety obligations for platforms, localized electronic certification providers, and refined controversial defamation/prohibited-content provisions. It reshaped the core statute governing online speech and electronic systems.

After the Ministry of Trade issued Reg 31/2023 (26 Sept) banning direct transactions on social media platforms, TikTok closed its in-app Shop on 4 October, forcing a split of social media from e-commerce. The move set a precedent for regulating social-commerce and platform conduct.

Indonesia's first comprehensive data-protection statute, modeled on the EU GDPR, established data-subject rights, controller/processor duties, and a two-year compliance window. It underpins privacy enforcement for online platforms handling Indonesian users' data.

After a 20 July deadline under MR5, the Ministry blocked access to seven major unregistered private electronic system operators, triggering public backlash and a temporary PayPal reprieve. It demonstrated the enforcement teeth of Indonesia's platform-registration regime.

MR5 required all private platforms accessible in Indonesia to register, appoint local representatives, and remove 'prohibited' content within 4–24 hours, with government access to systems and data. It became the central content-moderation and platform-control instrument, widely criticized by rights groups.

GR 71 replaced GR 82/2012, classifying public vs private operators, relaxing data localization for private ESOs while mandating it for public ones, and adding registration, content-prohibition and data-erasure rules. It is the foundational implementing regulation for online services.

The Ministry ordered ISPs to block Telegram domains, citing channels promoting radicalism and bomb-making after repeated unanswered takedown requests; the block was lifted once Telegram agreed to filter content and cooperate. It was a landmark assertion of state power over messaging platforms.

The amendment introduced electronic system providers, a 'right to be forgotten,' government powers to terminate access to illegal content, and revised defamation/interception penalties following a Constitutional Court ruling. It expanded the state's content-removal authority over online platforms.

Indonesia's foundational cyber law criminalized defamation, hate speech, indecency and other 'prohibited content' online and recognized electronic information/transactions. It established the legal basis—and the long-running free-expression controversies—for regulating online content.