When President Prabowo Subianto signed Government Regulation No. 17 of 2025 on Child Protection in the Implementation of Electronic Systems — known as PP Tunas — in late March, Indonesia formally entered the global race to wall children off from large parts of the open internet. With implementing technical regulations still being drafted by the Ministry of Communication and Digital Affairs (Komdigi), officials have repeatedly pointed to Australia's eSafety Commissioner and the Online Safety Amendment (Social Media Minimum Age) Act 2024 as the reference point Jakarta is studying most closely.
That is an understandable instinct. Australia produced the world's first national law setting a hard minimum age of 16 for social media accounts, and it built that regime on top of an unusually muscular regulator that already had years of takedown powers. For a government under domestic pressure over online harms — from gambling apps targeted at teenagers to AI-generated deepfakes circulating on TikTok and X — borrowing a fully formed template is politically convenient. But Indonesia's drafters should look past the headline. Australia is not yet a success story to emulate; it is a live experiment whose hardest problems are exactly the ones Jakarta will inherit if it copies the architecture rather than the principles.
What PP Tunas Actually Requires
PP Tunas, sometimes referred to in English as the Child Protection in Electronic Systems regulation, obliges platforms that operate in Indonesia to classify their services by age suitability, deploy age-assurance measures, and restrict minors' access to content and features the government deems harmful. The text leaves most of the operational detail — what counts as adequate age verification, which services fall in which tier, what penalties apply — to forthcoming ministerial regulations from Komdigi. That delegation is where the real policy will be written.
Komdigi officials have publicly described the Australian model as influential. In Canberra, the obligation sits on platforms (not parents or children) to take "reasonable steps" to prevent under-16s from holding accounts, and the eSafety Commissioner has wide discretion to define what "reasonable" means in guidance, backed by civil penalties of up to AUD 49.5 million per breach.
Why the Australian Template Is the Wrong Lift
Three features of the Australian regime should give Indonesian drafters pause.
1. Age assurance is still an unsolved technical problem
The Australian government's own age-assurance technology trial, run through the eSafety Commissioner and the Department of Infrastructure, has reported that no single method — facial age estimation, ID document upload, parental vouching, or platform inference — is simultaneously accurate, privacy-preserving, and inclusive of users without government ID. In a country like Indonesia, where tens of millions of citizens still lack consistent access to a digital ID and where the leaked 2022 PeduliLindungi and 2023 KPU data exposures left deep public mistrust of centralised identity systems, importing an obligation that effectively forces every social platform to demand ID would be far more regressive than in Australia.
2. A single empowered regulator concentrates speech risk
The eSafety Commissioner is widely respected but has also drawn criticism — including from Australian civil liberties groups — for the breadth of takedown powers it exercises with limited judicial review. Indonesia's prior regulatory history under MR5/2020 and the ITE Law has shown how content powers, once granted, expand. Building a Komdigi-led equivalent with discretionary authority to deem services harmful, order access restrictions, or block non-compliant platforms invites the same drift on a much larger scale.
3. The hardest cases will move, not disappear
Early observation of Australia's rollout suggests that adolescents will simply migrate to services not formally classified as "social media" — encrypted messengers, gaming chats, livestream comment sections, and offshore platforms. Indonesia's youth internet culture, dominated by TikTok, Instagram, YouTube and a long tail of homegrown apps, will respond the same way. An age gate that pushes minors toward less moderated corners of the web is not child safety; it is risk transfer.
A Proportionate Alternative
None of this argues for inaction. Indonesia has real and well-documented problems: online gambling promotion to minors, child sexual abuse material circulating on closed groups, and predatory monetisation in mobile games. But there is a more defensible path than a hard age ban:
- Mandate safety-by-design defaults — private accounts, restricted DMs, no behavioural ads — for accounts likely to belong to minors, rather than excluding them entirely.
- Require auditable transparency reporting on minor-targeted harms, modelled on the EU Digital Services Act's Article 28 obligations, which already apply to most large platforms operating in Indonesia.
- Invest in independent research access, so Komdigi's eventual rules are grounded in Indonesian data rather than imported assumptions.
- Resist a single-regulator model. Distribute oversight between Komdigi, KPAI (the Child Protection Commission) and an independent appeals body to dilute speech-restriction risk.
What Comes Next
The drafting of PP Tunas's implementing regulations over the coming months is the moment that matters. Indonesia can pass the world's most defensible child-safety framework — one that uses Australia's experiment as evidence, not as a blueprint — or it can import Australia's unresolved trade-offs at five times the population and a fraction of the institutional capacity. The choice is still open. The eSafety Commissioner is a model of regulatory ambition; it should not be a model of regulatory imitation.