Indonesia's communications ministry, Komdigi, says it handled 4.1 million online-gambling content items between 20 October 2024 and 28 September 2026. About 3.6 million of those were websites and IP addresses that could be cut off, according to the ministry's own InfoPublik portal. Minister Meutya Hafid called the figure "not an achievement" but "a progress report," and asked the obvious question: "We block access and it reappears. What does that mean?"
The honest answer is that blocking at the destination has a ceiling. The next question is whether Indonesia will respond by going after the tools people use to get around blocks. No such rule has been confirmed, but the groundwork has been visible for more than two years.
The case for tougher action
Start with the strongest argument for the government. Online gambling in Indonesia is illegal, and the harms are real. In August 2025, Padjadjaran University law professor Sinta Dewi Rosadi told local media that online gamblers are disproportionately low earners, with many making under Rp 5 million a month, and that children may reach betting sites. Hafid said most identified IP addresses sit outside Indonesia, and called gambling "transnational organized crime," per Antara's report of her remarks on 1 October 2026. If operators can re-register a domain faster than a ministry can list it, the argument runs, the only durable lever is the user's route to the site.
What is actually on the record about VPNs
The record on VPNs is thin, and it is worth being exact about it.
- On 31 July 2024, then-Kominfo announced a decision to limit access to free VPNs as an anti-gambling measure, per Press Release No. 463/HM/KOMINFO/07/2024, as logged by Digital Policy Alert. The tracker lists it as "under deliberation" and gives no legal instrument or effective date.
- In August 2025, CasinoBeats reported that the Coordinating Ministry for Political, Legal, and Security Affairs (Kemenko Polkam) wanted to regulate VPNs. Official Syaiful Garyadi called the sector "completely unregulated" and described Komdigi staff as "firefighters who put out fires but cannot extinguish their source." The ministry invited outside experts to propose ideas, and the report said the shape of any restriction was unclear.
- In July 2026, CasinoBeats reported that a Financial Services Authority (OJK) official, Dian Ediana Rae, suggested AI tools could help detect gamblers using VPNs and encrypted apps.
I found no published VPN regulation, and the InfoPublik and Antara accounts of the 4.1 million figure do not mention VPNs. So the claim that Indonesia is about to restrict circumvention tools is a forecast, not a policy. The pressure that makes it plausible is real, though.
Why a VPN crackdown would be the wrong move
Indonesia already has a lever that does not require touching VPNs. Ministerial Regulation 5 of 2020 (Permenkominfo 5/2020) obliges every private electronic system operator to register (Article 2). Article 7 lets the minister impose "access termination," defined as blocking access, closing accounts and/or deleting content, on those who do not. Article 14 sets takedown deadlines for gambling and pornography content: 1x24 hours, or four hours when urgent. A VPN licensing scheme would extend that logic from content to infrastructure.
That extension has three problems.
It misses the target. A VPN is a general-purpose privacy and security tool. Journalists, businesses, remote workers and ordinary users rely on it. CasinoBeats cited Hootsuite's 2022 data that about 39% of Indonesian internet users aged 16 to 64 use a VPN, and national studies suggesting roughly 30% of VPN users use them for banned content. By the government's own reasoning, most VPN users are not gamblers.
It is likely to fail on its own terms. Hafid's remarks show the cycle: block, reappear, block. Moving the block one layer down repeats the cycle with tools. Free VPNs can be blocked by name, as Kominfo signalled in 2024, but paid and self-hosted tunnels are harder to find, and enforcement against them pushes users toward unvetted services that carry more security risk.
It gives up the better option. The data the ministry has shows where the leverage sits. In July 2026, Hafid described "cutting the throat of the online gambling ecosystem; namely the associated bank accounts," and CasinoBeats reported that OJK had blocked over 36,000 gambling-linked bank accounts. A gambling operation needs payment rails more than it needs a domain. Money-flow enforcement, prosecution of the "kingpins and syndicates" Hafid herself named, and cooperation with platforms on comment-section promotion all attack the supply side without making every Indonesian's encrypted connection a regulatory object.
A proportionate path
Proportionate regulation here has four parts:
- Keep targeting operators and payments. Publish account-blocking and prosecution results alongside the content-block counts, so the public can judge effectiveness. A 4.1 million count says how much work was done, not how much gambling was stopped.
- Rule out a general VPN licensing regime, or if the government wants one, publish the draft for public consultation with civil society and the technology sector before anything takes effect.
- Define harm narrowly. If rules ever touch VPN providers, they should address advertising and marketing of gambling access, not the use of encryption.
- Report errors. Blocking at this scale will catch lawful sites. Indonesia should publish an appeals and over-blocking rate.
The numbers show a government working hard at a task that its own minister says is not yet succeeding. That is a reason to change tactics toward money and operators. It is not a reason to widen the net to everyone's connection.