Online safety & content laws in Indonesia (2026)

Indonesia began enforcing GR 17/2025's tiered age limits, barring under-16s from high-risk digital platforms and requiring age verification and parental consent; regulators noted few platforms were fully compliant at the start. It marks Indonesia's first hard rollout of child-specific online access controls.

President Prabowo Subianto signed GR 17/2025, imposing duties on electronic system operators to protect minors via risk-based age tiers (16 for high-risk, 13 for lower-risk services), age verification, abuse reporting, and data-protection safeguards. It is Indonesia's first dedicated online child-safety framework.

The second revision of the 2008 Electronic Information and Transactions Law added child-safety obligations for platforms, localized electronic certification providers, and refined controversial defamation/prohibited-content provisions. It reshaped the core statute governing online speech and electronic systems.

After the Ministry of Trade issued Reg 31/2023 (26 Sept) banning direct transactions on social media platforms, TikTok closed its in-app Shop on 4 October, forcing a split of social media from e-commerce. The move set a precedent for regulating social-commerce and platform conduct.

Indonesia's first comprehensive data-protection statute, modeled on the EU GDPR, established data-subject rights, controller/processor duties, and a two-year compliance window. It underpins privacy enforcement for online platforms handling Indonesian users' data.

After a 20 July deadline under MR5, the Ministry blocked access to seven major unregistered private electronic system operators, triggering public backlash and a temporary PayPal reprieve. It demonstrated the enforcement teeth of Indonesia's platform-registration regime.

MR5 required all private platforms accessible in Indonesia to register, appoint local representatives, and remove 'prohibited' content within 4-24 hours, with government access to systems and data. It became the central content-moderation and platform-control instrument, widely criticized by rights groups.

GR 71 replaced GR 82/2012, classifying public vs private operators, relaxing data localization for private ESOs while mandating it for public ones, and adding registration, content-prohibition and data-erasure rules. It is the foundational implementing regulation for online services.

The Ministry ordered ISPs to block Telegram domains, citing channels promoting radicalism and bomb-making after repeated unanswered takedown requests; the block was lifted once Telegram agreed to filter content and cooperate. It was a landmark assertion of state power over messaging platforms.

The amendment introduced electronic system providers, a 'right to be forgotten,' government powers to terminate access to illegal content, and revised defamation/interception penalties following a Constitutional Court ruling. It expanded the state's content-removal authority over online platforms.

Indonesia's foundational cyber law criminalized defamation, hate speech, indecency and other 'prohibited content' online and recognized electronic information/transactions. It established the legal basis, and the long-running free-expression controversies, for regulating online content.