On May 4, 2026, Mediodecci Lustarini, Secretary of the Directorate General for Digital Space Oversight at Indonesia's Ministry of Communication and Digital Affairs (Komdigi), put eight platforms on notice. Companies that already advertise 18- or 21-plus minimums but rely on a self-declared birthday — X, Bigo Live, Threads, Facebook, Instagram, TikTok, YouTube, and Roblox — must, she said, "implement effective verification systems to ensure children cannot access their services." Self-attestation no longer counts as a control. The instruction follows the March 28, 2026 entry into force of Government Regulation No. 17 of 2025 — known as PP Tunas — and its implementing technical rule, Komdigi Regulation No. 9 of 2026.
What PP Tunas actually requires
PP Tunas is structured around two age tiers. Children under 16 cannot hold accounts on platforms Komdigi classifies as high risk; lower-risk services are open from age 13 with parental consent and high-privacy defaults. The rule applies to every Electronic System Operator (PSE) doing business in Indonesia — there is no carve-out for size, sector, or country of incorporation. The eight named platforms are merely the first enforcement wave; Komdigi has set a March 27, 2027 deadline for all PSEs, including e-commerce and gaming, to deploy age-assurance and parental-consent flows. Permen 9/2026 spells out the technical expectations: risk classification, age verification beyond a checkbox, parental controls, default high-privacy settings, and PSE-led education obligations. The official statute text is on the State regulatory portal at peraturan.bpk.go.id, and the Sekretariat Negara has published the ministerial implementing rule.
Steelmanning the regulator
It is worth taking Komdigi's diagnosis seriously before arguing with its remedy. The minimum ages displayed in app stores have been substantively unenforced for two decades; treating them as fictions on which entire product designs rest is not paranoia. Indonesian regulators are responding to a real evidence base — child exposure to sexualised content, algorithmic amplification of disordered-eating and self-harm material, and predatory contact via live-streaming products — that Western enforcers cite in nearly identical terms. Minister Meutya Hafid's framing — that parents "no longer have to fight alone against the algorithm giants" — captures something Indonesian families and civil-society groups have been asking for. A floor under platform behaviour, especially around livestreaming and direct messaging features that have produced documented harms, is a defensible policy objective. And by pairing the rule with a two-year transition window and a derivative technical regulation, Komdigi has avoided the worst version of this policy — a same-day ban with no operational guidance.
Where proportionality starts to matter
The harder question is what "effective verification" will look like in practice. The Electronic Frontier Foundation has catalogued the predictable failure modes: document-upload flows that create centralised honeypots of government IDs and selfies; facial age estimation that performs measurably worse on Southeast Asian faces and on people with facial differences; identity vendors whose breach histories (AU10TIX, Discord) demonstrate that "upload your ID once" too often becomes "your ID is leaked forever." These are not theoretical. Indonesia has already lived through the 2022 BPJS Kesehatan and 2023 Dukcapil leaks; adding a mandatory ID-to-platform pipeline at national scale without a strict data-minimisation rule would compound that exposure rather than fix it.
Australia's parallel experiment offers a usable benchmark. Its Online Safety Amendment (Social Media Minimum Age) Act 2024 went live on December 10, 2025; by mid-January 2026, eSafety Commissioner Julie Inman Grant announced platforms had removed 4.7 million under-16 accounts in roughly five weeks, with Meta alone deactivating about 550,000 in the first day. The headline number sounds decisive, but eSafety's own follow-up guidance pushes a "successive validation" or "waterfall" model — combining behavioural signals, account-history inference, and verification only as a last resort — precisely to avoid blanket ID uploads. By March 2026, Australia's regulator had also opened formal investigations into five platforms for suspected non-compliance, showing that the enforcement curve is steeper than the rule-writing one.
What good implementation looks like
The People of Internet view is that PP Tunas can be a net win for Indonesian children if Komdigi resists the temptation to define "effective verification" as "upload a KTP." Three design choices will decide that.
- Data minimisation by default. Permen 9/2026's technical guidance should bar platforms from retaining identity documents post-verification, require on-device or zero-knowledge proofs where feasible, and limit any third-party assurance vendor to a single verification event with no profile-building.
- Layered assurance, not single-method mandates. Behavioural inference and account-age signals catch most under-16 users at far lower privacy cost than ID checks; ID-grade verification should sit at the bottom of a waterfall, used only when softer signals are inconclusive.
- Proportionate enforcement against the genuinely high-risk surface. Live anonymous interaction with strangers is the surface that has produced most documented child harm; static feed consumption is not. A risk classification that treats Roblox messaging and Bigo livestreams differently from a YouTube cooking video would do more for child safety than a uniform 16-plus wall.
The diagnosis behind PP Tunas is not wrong, and the platforms it names have earned the scrutiny. But Indonesia is now writing, in real time, what an enforceable child-safety regime looks like outside Brussels and Canberra — and what it builds will be copied. Whether that template protects children or merely builds the world's next ID honeypot is a choice still in front of Komdigi.