A Warning Letter With a Track Record
On June 26, 2026, Indonesia's Ministry of Communication and Digital Affairs (Komdigi) sent notification letters to 25 Private Scope Electronic System Operators — 15 foreign, 10 domestic, covering 57 websites and apps — telling them to complete mandatory PSE registration or face administrative sanctions (detik.com). The list included Qatar Airways, Qantas, ANA, Strava, Best Western, Banyan Tree, WorldHotels, and several Indonesian hotel groups. The deadline was July 3, 2026. When most of the list didn't comply, Komdigi issued a second warning to the 22 remaining non-compliant operators, setting July 13, 2026 as the date access-blocking enforcement would begin.
What makes this notable isn't the list itself — airlines and hotel booking sites are a mundane category of non-compliance. It's that this is now a recurring administrative pattern, not an exceptional one. Komdigi's own press office confirms it cut access to three PSEs — KLM Royal Dutch Airlines, eBay, and Bath & Body Works operator PT Dunia Luxindo — in June 2025 for the identical failure (RRI). In February 2026, it restricted Wikimedia's login and account-creation features — leaving articles readable but authentication dead — after the foundation missed a deadline extended twice from November 2025 (Komdigi). The July 2026 list of 25 is simply the next batch moving through the same pipeline.
The Legal Machinery
The requirement traces to Peraturan Menteri Kominfo No. 5/2020 on Private Scope Electronic System Operators, issued November 16, 2020 under the authority of Government Regulation 71/2019 on Electronic System and Transaction Implementation (JDIH Komdigi). Any operator whose electronic system is "used" in Indonesia — a test that sweeps in foreign airlines selling tickets to Indonesian travelers or hotel chains taking Indonesian bookings — must register through the government's Online Single Submission portal, regardless of whether it has a local office. Non-registration is treated as an administrative violation carrying escalating sanctions: written warning, temporary suspension, and ultimately access termination.
The Case for Registration
The government's argument deserves to be taken on its own terms. A platform with no Indonesian legal presence and no registered point of contact is, in practice, unreachable when a consumer dispute, data breach, or law enforcement request arises — registration is what lets regulators know who to serve process on. Komdigi's Director Teguh Arifiyadi framed the July action around exactly this: registration ensures systems operate in compliance with applicable law and "provide better public protection" (per detik.com's reporting of his statement). For 229 million Indonesian internet users transacting with foreign travel and hospitality platforms, having no domestic accountability mechanism is a real gap, and other jurisdictions — the EU's Digital Services Act representative requirement is the closest analogue — solve a similar problem with a similar registration mandate.
Where the Tool Overreaches
The problem isn't the registration requirement in principle; it's the breadth of what PM 5/2020 attaches to it once a platform is inside the regime, and the bluntness of the remedy when it isn't. The regulation's content-related obligations — takedown compliance on tight clocks and government data-access provisions — are the parts digital rights groups in Jakarta have objected to since the rule was first issued, arguing they hand a communications ministry leverage that properly belongs to courts. Cutting off Strava's authentication or KLM's booking flow for a paperwork lapse is a wildly disproportionate remedy for what is, for most of the 25 named operators, a compliance oversight rather than a deliberate evasion — three of the original 25 (Strava, the AYO sports app, and Six Senses) resolved the issue simply by registering once notified, suggesting friction rather than defiance was the real problem for most.
That proportionality gap is the actual policy failure here. A tiered response — throttling non-essential features, as was done to Wikimedia, rather than full access termination, as was done to KLM and eBay — would achieve the same compliance pressure without cutting Indonesian consumers off from services they've already chosen to use. Indonesia doesn't need to abandon PSE registration to fix this; it needs a remedy schedule proportionate to the violation, with blocking reserved for operators that ignore registration entirely rather than those mid-process.
What to Watch
The near-term signal is whether Komdigi actually executes blocking against any of the 22 that missed the July 13 deadline, or whether — as with past rounds — most stragglers register just ahead of enforcement. The larger signal is whether Indonesia narrows PM 5/2020's remedies toward proportionality, or keeps treating full access termination as the default tool against airlines, hotel chains, and nonprofits alike.