In late September 2026 (reported on 28 September), Indonesia's Ministry of Communication and Digital Affairs (Komdigi) warned seven private electronic system operators (PSEs) that had not registered. The warnings followed notification letters sent on 16 September to 25 operators, 23 domestic and two foreign, according to Digital Policy Alert's record of the action. The legal anchor is Ministerial Regulation 5/2020, and the sanction in reserve is the termination of access to the service.
The case for the regulator
The strongest argument for registration is that a state cannot enforce anything against a service it cannot identify. Komdigi's legal database describes Regulation 5/2020 as a package. It sets registration requirements for private-scope operators, rules on governing and moderating electronic content, a duty to take down prohibited information, and a duty to give access to systems and data for supervision and criminal law enforcement. A registry gives a victim of fraud, defamation or a leaked database a named counterparty and a point of contact. Without one, a takedown request goes to an anonymous foreign service that may never answer. Seen this way, a registry is the minimum infrastructure of accountability, and it is cheap to satisfy.
The September numbers support the claim that the process is mostly working. According to Selular.ID's report of Komdigi's statement, of the 25 operators notified, 16 had registered. Two more, PT Pelita Air Service and Shopify Inc., had told the ministry they would register. Seven remained. Notice-then-warning-then-sanction is the sequence a proportionate regime should follow. Komdigi also said it remains open to clarification from firms facing technical obstacles.
What the seven tell us
The seven named operators are not global platforms. They are PT Haryanto Motor Indonesia, PT Indo Transport Abdimas, PT Rosalia Indah Transport, PT Sebastian Citra Indonesia (the Roti'O website), PT Sriwijaya Air, PT Sudiro Tungga Jaya, and Australia's Secret Industries Pty Ltd (FatSecret). Most are bus operators, an airline and a bakery chain that sell tickets and food through a website or app.
That matters for the intermediary-liability logic. The registration regime was justified in part by the need to hold large user-generated-content platforms to takedown and data-access duties. A bus company's booking app hosts no user speech and hosts no content that a court could order removed. The compliance burden here is therefore hard to link to any harm the regulation addresses. The one claim that holds up is administrative: a regulator wants a single list of every digital service available in the country.
The regime was also designed for a narrower purpose. The amending Regulation 10/2021, which took effect on 21 May 2021, aligned the registration deadline with risk-based business licensing through the Online Single Submission (OSS) system. It tied registration to the licensing system, which is a business-permit function, rather than to a content-risk assessment. The hook frames registration as the gateway to safe-harbour-style protection, but the regulation's own structure reads more like a licence to operate than a liability shield. Registering does not give a platform clear immunity for third-party content. It creates the takedown and access obligations that follow.
The precedent that worries speech advocates
The sanction is not hypothetical. On 30 June 2025 Komdigi blocked PT Dunia Luxindo (Bath & Body Works), eBay and KLM. It described the block as an administrative sanction under Article 7 of Regulation 5/2020, and said the three had not started registration despite extended deadlines and earlier warnings. The ministry's Director General for Digital Space Oversight, Alexander Sabar, called it a demonstration of commitment to an "orderly and accountable digital ecosystem."
Nothing in the sources I could verify shows a court or independent body reviewing that decision beforehand. Civil society groups raised this point when the rule was issued. Indonesia's SAFENET, for example, published a position paper on the regulation and, according to Hukumonline's coverage, asked the government to cancel it over freedom-of-expression and human-rights concerns. I could not read the paper's text, so I rely on that reporting for its position. The structural concern is that a registration rule gives a ministry a switch it can throw on any service, including a news site or a messaging tool, for reasons that need not be content-related.
A proportionate path
The record so far is encouraging on process and less so on design. Komdigi gave notice, followed up and left room for dialogue, and most operators complied. Both the 2025 block and the 2026 warnings were applied to registration failures, not to speech. But a regime that works because the penalty is disproportionate is fragile. Three changes would keep the benefits while limiting the risks:
- Match obligations to risk. A bus-ticketing app that hosts no user content should face a light registration step, with takedown and data-access duties reserved for services that carry third-party content.
- Graduate the sanction. Fines or a published compliance notice should come before an access block, and blocking should be reserved for repeated non-response by a service with real user-content risk.
- Add review. An independent body, or at minimum a published reasoned decision and an appeal route, should apply before access is cut.
I could not confirm from the sources available whether any of the seven was blocked after the 1 October deadline. That outcome is the next thing to watch. If Komdigi blocks a bus company's booking app over paperwork, it will show that the instrument is a market-access gate. If it accepts late registrations, it will show that the system can be a workable, proportionate registry.