The case for the regulator
The strongest argument for Jakarta's position is simple. Indonesia has one of the largest child populations online anywhere, and platforms have had years to build serious age assurance voluntarily. Many did not. A regulator that asks for numbers and gets none, or gets numbers that are plainly implausible, has reason to reach for a harder tool.
On September 14, 2026, six months after Government Regulation 17/2025 (PP Tunas) took effect, the Communication and Digital Ministry (Komdigi) gave its first scorecard. Katadata's report on the briefing says about 28 million child accounts have been protected across eight platforms the ministry classed as high-risk: YouTube, TikTok, Facebook, Instagram, Threads, X, Bigo Live and Roblox. That is a large number, and it shows the rule is not purely symbolic.
What the audit says about X and TikTok
The ministry's sharpest criticism concerned X. According to Katadata, X locked about 250,000 accounts of under-16 users, while the government estimates roughly 7 million child accounts on the service. That is a gap of nearly 96%, if the estimate is right. The ministry also noted that X has no representative office in Indonesia, which matters because a regulator needs someone to serve notice on, negotiate with and, if necessary, hold liable.
TikTok's problem is different. The Star reports that TikTok disabled 4.1 million child accounts as of May 2026, and that it has since given no updated figure and reported no significant changes to its safety features. A stale number is not proof of non-compliance. It is, however, proof that the regulator cannot see what is happening, and that is the transparency failure the ministry is actually pointing at.
Two caveats apply. The 7 million figure is a government estimate, and the methodology was not published in the coverage we reviewed. Counting children on a platform that does not require real identity is inherently imprecise. A penalty built on a contested denominator will be litigated on the denominator.
The fine design is the real story
The larger policy decision is the penalty. Minister Meutya Hafid said, as RRI reported, that "for large-scale or global digital platforms, the fine we have formulated is six percent of global revenue." Domestic private operators would be fined according to the scale of their business, with RRI listing ceilings of Rp 1 billion for micro, Rp 5 billion for small and Rp 10 billion for medium enterprises. The formula has been through public consultation and has been sent to the Finance Ministry for discussion with other agencies.
There is a defensible logic to revenue-based fines: a flat cap is a rounding error for a company with global revenue in the tens of billions of dollars. But a ceiling pegged to worldwide revenue, applied to a failure that occurs in one national market, raises three problems.
- Proportionality. Global revenue has no relationship to the harm in Indonesia. A company with a small Indonesian user base and a large revenue base faces the same percentage as one with a huge local footprint.
- Predictability. A ceiling is not a standard. Without published criteria on gravity, duration, good-faith effort and technical feasibility, the fine is whatever the regulator decides at the time, and platforms will price that uncertainty into whether they serve Indonesia at all.
- Verification risk. The stricter the penalty for under-16 accounts, the more platforms will lean on intrusive age checks such as ID or face scans. The Electronic Frontier Foundation argues in a related US context that age-verification mandates threaten privacy and anonymity for all users, not only minors, and increase exposure to data breaches. Indonesia's own data-protection regime would have to absorb that collection.
A better enforcement sequence
Indonesia does not need to drop the 6% ceiling to make it workable. It needs to constrain it. Four design choices would keep the deterrent and reduce the collateral damage.
- Publish the counting method. If X is accused of locking 250,000 of 7 million accounts, X and the public should be able to see how the 7 million was derived, and X should have a formal chance to contest it.
- Use the ceiling last. The regulation already contemplates graded sanctions. Warnings, remediation deadlines and local-representative requirements should come first, and a percentage-of-revenue fine should be reserved for repeated, documented failure.
- Tie the fine to Indonesian harm. A penalty scaled to Indonesian revenue or users, with global turnover as a backstop for non-cooperation, is easier to defend and less likely to deter market entry.
- Require a local point of contact. X's lack of an Indonesian office is a fixable problem. A legal-representative duty, enforced first, would do more to improve compliance than any later fine.
Why this matters beyond Indonesia
PP Tunas will be read in other capitals. If Jakarta shows that audit, transparency demands and graduated sanctions produce better age assurance without mass identity collection, it becomes a template. If the first use of the 6% ceiling is a headline fine on a contested estimate, it becomes a template for retaliation, and for companies deciding that a market is not worth the risk.
The ministry has identified real gaps. The right response is to measure them transparently and sanction them proportionately, and that is what the final fine regulation should say in its text.