On September 16, 2026, Indonesia's Ministry of Communication and Digital Affairs (Komdigi) notified 25 private electronic system operators (PSE) that they have not completed mandatory registration. Twenty-three are domestic and two are foreign, and Shopify is among them. They have until September 22 to register. If they miss it, Komdigi says it will follow with warning letters and administrative sanctions, including access blocking. Press reports name transport brands such as Whoosh, TransJakarta and Lion Air among the services at risk, alongside e-commerce, shipping and property firms.
The strongest case for registration
A registry is not inherently hostile to the open internet. A regulator that knows which companies operate in its market can find a responsible contact, route consumer complaints and coordinate on fraud or security incidents. The rule is also evenhanded on its face: Ministerial Regulation No. 5 of 2020 (text on the ministry's legal database) applies to domestic and foreign operators alike. Komdigi also points to a working channel for firms that hit technical obstacles, which is an email address for formal responses with supporting evidence. Taken alone, a lightweight registration requirement is a proportionate ask.
A pattern of rolling deadlines
This is not a one-off. Komdigi's own portal shows an earlier round in the same year. It notified 25 operators in early July, and three then committed to register. It sent formal warning letters to the remaining 22 on July 8, 2026 and set a new deadline of July 13. Enforcement runs as a ladder of notice, warning and then access termination. For companies acting in good faith, that ladder gives real time to comply. It also means the September notices are the start of a process, not a sudden cliff.
That sequencing is the best feature of the current approach. The concern is what sits at the top of the ladder.
Why blocking is the wrong last rung
The sanction for not registering is not a fine that scales with the harm. It is cutting Indonesians off from a service. In July 2022 the first enforcement wave under the same regulation blocked eight platforms, including Steam, Epic Games, Yahoo and PayPal. The PayPal block locked users out of their own funds. Kominfo then temporarily lifted it so people could withdraw money and migrate. The affected users were consumers who had done nothing wrong, and the penalty fell on them.
The 2026 list includes domestic transport and e-commerce services, so the stakes for ordinary users are higher. A commuter or shipper cannot tell whether a booking app is registered, and should not have to. A proportionate regime would use tools that hit the non-compliant firm rather than its customers: escalating fines, public compliance listings, or restrictions on payment and advertising channels. Blocking should be reserved for services that persistently refuse to comply and pose demonstrable harm.
Registration is bundled with heavier obligations
The sharper concern is what registration triggers. Amnesty International Indonesia's analysis reads the regulation as pairing registration with two further obligations. The first is content removal within 24 hours, or 4 hours for requests deemed "urgent". The second is government access to user data for oversight and law-enforcement purposes. Amnesty argues that the phrase "disturbing public order", which underpins those takedown powers, is undefined. It also argues that the regulation lacks the proportionality tests that international human rights standards require. (Article numbers are as cited by Amnesty.)
That is why registration is not the neutral paperwork it appears to be. Registering is the entry point to a system in which an operator commits to fast takedown timelines and data-access demands, backed by the threat of blocking. A four-hour clock on an ambiguous standard pushes rational platforms toward over-removal, which chills lawful speech. That result is at odds with a pro-speech, pro-innovation position.
The sovereignty framing
Indonesian officials present enforcement as part of building digital sovereignty, and the ministry's own press material uses that language. The Electronic Frontier Foundation recently made a distinction worth applying here. It argued that governments can and should pursue digital sovereignty in ways that centre user autonomy, rather than simply expanding state control over data and communications. Registration that improves accountability to Indonesian users fits that test. Registration that mainly enlarges state leverage over speech and data does not.
What a better design looks like
Four changes would keep the legitimate aims and lower the costs:
- Decouple registration from access to user data. Registration should establish identity and a contact point. Data demands should require judicial authorisation and be tied to specific investigations.
- Define "urgent" and "public order" narrowly. Takedown clocks need statutory definitions and an appeal route, not ministerial discretion.
- Cap sanctions at the operator, not the user. Fines and compliance listings should come before any network-level block, and payment or financial services should never be blocked in a way that traps user funds, as PayPal's block did.
- Publish outcomes. Komdigi already issues notices, so it should also publish who registered, who was blocked and for how long. That would show whether the ladder works.
The next few days will be a useful test. If most of the 25 register, the notice-and-warning model will have worked, and the case against blocking as a routine tool gets stronger. If some are cut off, Indonesian users will bear the cost of a paperwork dispute.