Indonesia's Communication and Digital Ministry (Komdigi) gave seven private electronic system operators (PSE) until October 1, 2026 to register or face administrative enforcement, which includes cutting access to their systems. The ministry told the operators about the deadline in warning letters dated September 22, according to RCTI+. The seven are PO Haryanto, PO Handoyo, Rosalia Indah Transport, Roti O, Sriwijaya Air's website and mobile app, Sudiro Tungga Jaya and the Australian calorie-tracking app FatSecret. Sixteen of the 25 operators the ministry called on have registered. Pelita Air and Shopify have said they will register.
The list is the news. The seven are mostly Indonesian bus companies, an airline app and a bakery chain, not Silicon Valley platforms. Indonesia's registration regime has become a general licensing-style obligation for any digital service used in the country.
The case for registration
The strongest argument for the regime is that regulators cannot enforce consumer protection, data protection or lawful-request rules against operators they cannot identify. Komdigi's legal basis is Ministerial Regulation No. 5 of 2020 on Private-Scope Electronic System Operators. It requires every operator, domestic or foreign, whose service is available in Indonesia to register, and Komdigi frames registration as a minimal administrative step. Director General of Digital Space Oversight Alexander Sabar told Investortrust that the process is simple. He also described a graduated sequence in which a first written warning is followed by a second, and only then by temporary suspension. The ministry also says it is open to resolving technical obstacles to registration.
Sabar's argument for equal application is also fair. When Komdigi restricted login features on Wikimedia's authentication domain on February 25, 2026, Sabar said the rule applies regardless of legal structure, business model or nonprofit status. If rules exempted favoured firms, that would be a worse outcome than uniform rules.
Where proportionality breaks down
Three problems remain even for a regime that applies uniformly.
First, the sanction is far larger than the offence. Failing to file a form is a paperwork lapse. The penalty is cutting users off from a service. Users of a bus-ticketing app or a calorie counter lose access because of a filing dispute they did not cause. Indonesian law already has proportionate tools for paperwork lapses, namely warnings and fines, and Komdigi's own 2022 description of the sanction ladder listed an administrative fine as the second step before temporary blocking. Fines against a domestic operator are enforceable, whereas an access block mostly harms users.
Second, there is no materiality threshold. An Australian calorie-tracker and a regional bakery's website are held to the same obligation as a platform with tens of millions of Indonesian users. The compliance cost is small for a large firm and is a real barrier for a small one. A foreign developer with a modest Indonesian audience may find geo-blocking Indonesia cheaper than registering. In that case the regime reduces choice for Indonesian consumers without any matching gain in protection.
Third, access termination has a record that should give pause. The same regulation was used in 2022 to block services including Steam, Epic Games Store, Yahoo and PayPal after a July 27 extended deadline. As Game World Observer reported, millions of users lost access to gaming and payment services, VPN use rose and the #BlokirKominfo hashtag trended. Freelancers who relied on PayPal were among those affected. The blocks were reversible once operators registered. That was cold comfort during the outage, and it showed that the registration rule's enforcement tool is blunt.
The speech dimension
Registration looks neutral, but a registered-operator regime also gives a government a ready lever over online communication. The ministry cut access to the messaging app Zangi on October 21, 2025 for failing to register. The Wikimedia action in February 2026 limited account login while leaving content readable. That was a narrower step, but it still removed the ability to contribute. The EFF's September 2026 analysis of digital sovereignty warns that some states pursue sovereignty as a way of cutting off or splintering access. Indonesia is not Iran or Russia, and nothing in the seven-operator case suggests content motives. But a regime that can switch off any service on administrative grounds depends heavily on the discretion of whoever runs the ministry.
What a better design looks like
Indonesia can keep its enforcement goals and fix the design.
- Tier the obligations. Apply the full registration and sanction ladder to services above a user or revenue threshold. Offer a simplified, notice-only filing for small operators.
- Fines before blocks. Reserve access termination for operators that ignore fines and have a material user base, so that users are not the first casualties.
- Publish the process. Publish the sanction timetable, the appeal route and the criteria for lifting a block. Komdigi's graduated process is described in press statements, but operators and users benefit from a fixed, citable rule.
- Protect users in transit. Where a block is unavoidable, give users advance notice so they can retrieve their data and payment balances.
Sixteen of 25 operators registered, which suggests that most can comply once notified, and that is evidence the notification approach works. The seven holdouts are small enough that enforcement through fines would have been practical. Using the ultimate sanction on a bus operator or a calorie counter would show that Indonesia treats registration as an end in itself, when its stated goal is accountability. Komdigi has said it will hear technical objections, and the better course is to use that discretion to apply the lightest sanction that gets operators registered.