On 7 October 2026, Indonesia's Communications and Digital Minister Meutya Hafid said that deactivating under-16 accounts is not enough. Platforms must also change the features that expose children to risk. Komdigi will assess those features against seven categories: contact, content, addiction, security, consumer, physical and physiological condition, and mental health. Suara.com's report of the press conference quotes her framing the question as what platforms are doing about the features children use, not how many accounts have been blocked. The reframing is right. The open question is whether it can hold recommendation and engagement design accountable when the rulebook has no algorithm audit or disclosure duty.
The case for the government's approach
The strongest argument for Jakarta is that children's harms come from design, and a state with limited technical capacity cannot inspect every ranking model. A rule that classifies each product, service or feature as high or low risk, and escalates from there, is administrable. It also avoids the censorship problems of content-level mandates.
The legal structure supports this. Article 5 of Government Regulation 17/2025 (PP Tunas) requires each product, service and feature to be rated high or low risk for children. The OCR text on Pasal.id says one high-risk aspect is enough for a high-risk profile. Providers self-assess, the minister verifies, and the minister then sets the risk profile. The regulation is listed as in force on the BPK legal database. Sanctions escalate from written warnings to fines, temporary suspension and access termination (Article 38).
The process is producing results. As of 6 September, RRI reported that 94 providers had completed self-assessments covering 252 products, services and features. Komdigi had verified 60 of them, rating 38 low-risk and 22 high-risk. The deadline for self-assessments is 31 December 2026. By 7 October, per the Banda Aceh city government's account, TikTok's deactivations of under-16 accounts had risen from over 4 million to about 9 million. Meta had blocked about 85,000 Instagram and 99,000 Facebook accounts. Instagram and Facebook are not yet considered low-risk despite Teen Accounts.
Why account counts were a weak metric
A deactivation total measures enforcement effort, not child safety. A platform can remove millions of accounts and leave its design untouched, while the remaining 16- and 17-year-olds, and any children who evade age checks, face the same engagement loops. Hafid's own position, that the numbers are not the sole indicator of success, concedes this. Moving the yardstick to features is the proportionate choice. It pushes the burden onto design decisions and away from blanket exclusion.
The accountability gap
The trouble is what a feature-level test can see. The categories named in the announcement, such as contact and addiction, are things a regulator can observe on the surface: whether strangers can message minors, or whether autoplay and notification loops exist. The harm in recommendation systems comes from how ranking behaves for a given user over time, and a checklist review of features does not capture that.
The PP Tunas text appears to leave that gap open. The OCR text on Pasal.id contains no mention of "algorithm" or "recommendation." The nearest provision is Article 19's ban on profiling children, which concerns personal-data processing. Neither the announcement nor the Banda Aceh summary mentions algorithm audits or disclosure either. The article text there is machine-read and unreviewed, so the official gazette should be checked, but the pattern is consistent with the public statements.
In practice, a self-assessment is only as reliable as the provider's description of its own product. Komdigi verified 60 of 252 submissions, about one in four. Without a duty to disclose how recommendations are optimised, or to give a regulator or accredited researcher structured access, the verifier is checking claims it cannot test. A platform could rate "autoplay" low-risk while the model deciding what plays next is tuned for watch time.
What proportionate accountability would look like
This does not call for heavy-handed audit mandates, which carry real costs: trade-secret exposure, compliance burdens that favour incumbents, and a regulator inspecting speech-ranking logic. A narrower design would fit the framework Indonesia has already built:
- Outcome-based disclosure: require high-risk providers to report aggregate metrics, such as median daily minutes and night-time use among 16- and 17-year-olds, so addiction claims can be tested against behaviour.
- Confidential verification: let Komdigi or an accredited third party test a sample of features under non-disclosure terms, instead of publishing models.
- Published indicators: Hafid said Komdigi and experts will detail indicators for each category. Those indicators should state which evidence a provider must submit for engagement and recommendation features.
- Reasoned designations: publish short explanations for high- and low-risk ratings, so providers and researchers can see what the test captures.
These steps keep the regulator out of the business of dictating ranking logic. They would also give the seven-category test a way to see the thing it is meant to govern.
What to watch
The next milestones are the detailed indicators and the 31 December self-assessment deadline. If the indicators treat recommendation and engagement design as evidence-bearing features, PP Tunas could become a workable model for proportionate child-safety regulation in a large emerging market. If they stay at the level of visible controls, Indonesia will have swapped one proxy, account counts, for another, feature checklists, while the systems that shape what children see go unexamined.