As Indonesia’s children increasingly learn, play, and socialize online, the Government has moved to give the digital space its own set of guardrails. Government Regulation No. 17 of 2025 on Governance of Electronic System Operation in Child Protection (“GR 17/2025“) laid the foundation, and on 6 March 2026, the Minister of Communication and Digital Affairs (“MoCD“) issued Regulation No. 9 of 2026 on the Implementing Regulation of Government Regulation No. 17 of 2025 on Governance of Electronic System Operation in Child Protection (“MoCD Reg. 9/2026“), effective on the same date.

MoCD Reg. 9/2026 is the technical companion to GR 17/2025, setting out detailed and comprehensive rules for putting child protection into practice. Where GR 17/2025 sets out the overarching obligations of Electronic System Operators (“ESOs“) to protect children (“Children” or “Child”, referring to individuals below 18 years of age) who use or access their products, services, and features (“PSF“), MoCD Reg. 9/2026 operationalizes several of those obligations by prescribing detailed procedures for age-appropriate design, self-assessment, risk profiling, age verification, and supervision, pursuant to the mandate under Articles 6, 20(5), 27(2), 29(10), 36, and 47(6) of GR 17/2025.

We set out below the key provisions introduced under MoCD Reg. 9/2026, together with how they interact with the parent framework under GR 17/2025.

 

MoCD Reg. 9/2026 as the Implementing Arm of GR 17/2025

GR 17/2025 requires ESOs, through Articles 19(5) and 22(3)(a), to protect Children’s rights in connection with PSF that are either specifically designed for use by Children or that Children may use or access, and mandates, among others, the provision of minimum age information, age-verification mechanisms, and misuse-reporting mechanisms. Several of these obligations, however, were left to be regulated further by a Peraturan Menteri (Ministerial Regulation).

MoCD Reg. 9/2026 fulfils that mandate. It does not, for the most part, introduce new categories of obligations beyond those already established under GR 17/2025 (although it adds some new operational rules, noted below); rather, it translates the principles-based obligations of GR 17/2025 (in particular, the minimum age and age-range framework, the risk-level assessment framework, and the verification-mechanism obligation) into concrete operational requirements, including self-assessment and reporting requirements, reporting lines to the Directorate General of Digital Space Supervision and Personal Data Protection (“DGoDSPDP“) of MoCD, and detailed supervisory procedures. Where GR 17/2025 sets administrative sanctions and the general supervisory architecture, MoCD Reg. 9/2026 fills in the procedural mechanics for their day-to-day enforcement, including delegating several of the Minister’s supervisory and examination functions to the Director General.

 

Minimum Age and Age-Range Requirements

Consistent with GR 17/2025, Article 2 of MoCD Reg. 9/2026 requires ESOs to provide information on the minimum age for use of their PSF, with such minimum age set at no lower than 3 years old, grouped into five age ranges: (i) 3–5 years; (ii) 6–9 years; (iii) 10–12 years; (iv) 13–15 years; and (v) 16 years up to below 18 years. ESOs may not target their PSF at Children under 3 years old at all. ESOs must also make sure that their PSF fits the stated minimum age and age range, taking into account Children’s developmental stages (Article 2(4) and (5) of MoCD Reg. 9/2026).

Such minimum age information must be presented in easily understandable language and in a format and manner that is accessible to Children and their parents or guardians, and any change to that information must be communicated in advance, within a reasonable period, before the change takes effect. Where an ESO cooperates with another ESO to market, create, or make PSF accessible to Children, both parties bear the obligation to provide and update such information and must retain documentation of the minimum age information (and any changes) for as long as the PSF remains accessible to Children (Article 3 of MoCD Reg. 9/2026). Once a PSF is no longer accessible to Children, the documentation must still be retained in accordance with applicable laws (Article 3(6)).

 

Mandatory Self-Assessment and Child Protection by Design

Article 4 of MoCD Reg. 9/2026 requires ESOs to carry out a self-assessment to confirm that their PSF are suitable for the intended minimum age and age range. The self-assessment must, at minimum, address:

  1. consideration of Children’s needs based on the applicable minimum age and age range;
  2. consideration of the risks associated with the operation of the PSF in meeting those needs; and
  3. involvement of internal and external stakeholders of the ESO’s organization in considering the needs and risks referred to above.

The results of the self-assessment must be documented and formally approved by the ESO before the PSF becomes accessible to Children, and any updates to the assessment (when the assessed needs or risks change) must similarly be documented and retained for as long as the PSF remains accessible to Children (Article 5 of MoCD Reg. 9/2026).

In addition, ESOs must establish and implement a child protection by design framework to ensure that content accessible to Children through their PSF is appropriate to the applicable minimum age and age range and does not contravene applicable laws (Article 6 of MoCD Reg. 9/2026).

The provisions above establish a lifecycle-based approach to child protection. ESOs are expected to identify and assess risks before a PSF becomes accessible to Children, document those risks, and re-assess them when the risk level changes during the PSF’s availability, and to translate the identified risks into protective measures through a child protection by design framework. This goes beyond reactive content moderation: child protection must be built into the governance, development, and ongoing operation of PSF accessible to Children.

 

Age Verification Mechanisms

Article 7 of MoCD Reg. 9/2026 requires ESOs to provide a mechanism to verify Child users, applying technical and operational measures to verify the age of Children using or accessing the PSF in line with the applicable minimum age and age range. Such technical and operational measures may be implemented through technology that is either developed independently or sourced through cooperation with a third-party technology provider, provided that the technology (and the cooperation arrangement, where applicable) complies with applicable laws and child-protection and reliability requirements. The Minister may designate technologies considered reliable for this purpose.

 

Risk-Level Assessment and Profiling of Products, Services, and Features

 

Building on the risk-assessment concept first introduced under GR 17/2025, MoCD Reg. 9/2026 requires that PSF (whether specifically designed for use by Children or merely accessible to Children) be assessed for their risk level towards Children, whether high or low, based on seven aspects: (i) contact with unknown persons; (ii) exposure to pornographic, violent, life-threatening, or otherwise inappropriate content; (iii) exploitation of Children as consumers; (iv) threats to the security of Children’s personal data; (v) potential for addiction; (vi) psychological health disturbance; and (vii) physiological disturbance (Article 8(3) and (4) of MoCD Reg. 9/2026). A PSF is categorized as having a high-risk profile if it scores high risk on any one of these aspects, and a low-risk profile only if it scores low risk on all seven (Article 8(5) and (6) of MoCD Reg. 9/2026).

Articles 10 to 19 of MoCD Reg. 9/2026 elaborate on each of these seven aspects and set minimum indicators that ESOs must take into account in conducting the mandatory risk-level self-assessment. By way of example, the indicators for the first aspect (contact with unknown persons) under Article 11 are:

  1. a Child’s account can be discovered by unknown persons;
  2. a Child’s content can be discovered by unknown persons;
  3. a Child’s account and/or content is automatically recommended to other users in various forms based on the Child’s profile;
  4. information regarding a Child’s account or profile is displayed in the user profile;
  5. a Child communicates or interacts with unknown persons through the Products, Services, and Features, including communication in various forms;
  6. the Products, Services, and Features can be configured by others to create forums, activities, or similar means enabling Children to communicate, interact, or connect with unknown persons; and
  7. other indicators as determined by the Minister.

Where a PSF allows Children to come into contact with unknown persons, the ESO must also provide parental control technology so that parents or guardians can approve or refuse such contact (Article 10(2) and (3)). The indicators for the other six aspects are set out in Articles 13, 15, 16, 17, 18 and 19, and the Minister will issue technical guidance on the risk assessment (Article 20).

Under Article 21 of MoCD Reg. 9/2026, ESOs must report the results of the risk-level self-assessment, together with supporting evidence, to the Minister through the Director General, and must appoint a designated contact person within their organization for this purpose. The Minister verifies the report and, based on that verification, formally determines the risk profile (high or low) of the relevant PSF; both powers are delegated to the Director General (Articles 23 and 25). If the report is inconsistent with other information submitted, the Director General may request clarification, and an ESO that fails to respond in time is declared not to have met its self-assessment obligation and must redo the assessment (Article 24). Providing false, inaccurate, incomplete, or misleading information in the self-assessment report may be taken into account by the Minister in assessing the ESO’s compliance, in imposing administrative sanctions, and/or in reporting the matter to law enforcement (Article 22 of MoCD Reg. 9/2026).

Where the risk level of a PSF subsequently changes (whether due to the ESO’s own technology or control adjustments, complaints from Children, parents, or the public, or information from government agencies), the ESO must conduct a re-assessment, report the results, identify potentially affected Child users, and notify them accordingly. The previously determined risk profile continues to apply until the Minister issues a new determination (Articles 26 and 27 of MoCD Reg. 9/2026).

 

Child Accounts and Social Media or Networking Services

ESOs requiring registration or account creation to use their PSF must ensure the availability of effective technology and operational measures enabling parents or guardians to supervise their Child’s use of the PSF through the Child’s account, and must observe the following minimum age thresholds for account ownership, consistent with the account-registration framework under GR 17/2025: (i) Children below 13 years old may only hold accounts on PSF specifically designed for Children with a low-risk profile, with parental consent; (ii) Children aged 13 up to below 16 years old may only hold accounts on PSF with a low-risk profile, with parental consent; and (iii) Children aged 16 up to below 18 years old may hold accounts on any PSF, with parental consent (Article 29 of MoCD Reg. 9/2026).

Article 30 of MoCD Reg. 9/2026 introduces a specific and more restrictive rule for social networking and media services. Such services are, by default, categorized as high-risk PSF, unless otherwise determined by the Minister following self-assessment and risk-profile determination. A social networking or media service is one that (i) enables online social interaction between two or more users, (ii) enables a user to connect or interact with some or all other users, and/or (iii) enables users to upload material to the PSF. ESOs operating such services must deactivate the accounts of Child users below 16 years old. The scope of services falling within this category will be further stipulated by way of a Ministerial Decision. In practice, only Child users aged 16 up to below 18 (with parental consent) may keep accounts on such services, unless the Minister determines that a particular service is low-risk.

 

Supervision, Examination, and Sanctions Framework

Article 31 of MoCD Reg. 9/2026 elaborates in detail on the supervisory framework introduced under GR 17/2025, delegating the Minister’s monitoring, examination, and control functions to the Director General. Supervision is carried out through monitoring and tracing (based on publicly accessible information), receipt of reports or complaints, preliminary examination, follow-up examination, and control measures such as the imposition of administrative sanctions.

Articles 36 and 37 of MoCD Reg. 9/2026 introduce quantitative thresholds not present under GR 17/2025 for determining how long the preliminary examination of a report or complaint will take. These look at how difficult the case is to handle (such as the ESO’s domicile, the cross-border nature of the PSF, and the complexity of the PSF) and at the scale of impact, namely the number of Children affected or potentially affected (at least 25 Children) and whether such Children are domiciled across at least 2 provinces. MoCD Reg. 9/2026 also sets out detailed procedural timelines, including a 3 working day period for preliminary examination of a report or complaint, up to three rounds of summons (with each further summons issued no later than 7 working days after the previous scheduled examination date if the ESO fails to appear), and confirms that examinations are conducted on a closed-door basis, physically at the Ministry’s office or, where that is not possible, virtually. If the ESO fails to appear after the third summons, the Director General may impose administrative sanctions based on the evidence available, without examining the ESO (Article 44(4)). The same applies if the ESO does not provide requested information on time (Article 52(3)), and providing inaccurate or misleading information may lead to heavier sanctions (Article 52(4)). An ESO may appoint a representative by written power of attorney, notified to the Directorate General at least 2 working days before the examination (Article 48). Control measures may also include publication of the violation and of the compliance assessment results (Article 54).

Under Articles 55, 56, and 57 of MoCD Reg. 9/2026, ESOs may raise objection to the sanctions of written warning and/or administrative fines before the Director General, and to sanctions of temporary suspension and/or access termination before the Minister, within 21 working days of receiving the sanction decision or of its announcement on the Ministry’s website. The objection must be resolved within 20 working days of its receipt, failing which the objection is deemed accepted. The formal decision on the objection must be issued within 5 (five) working days after the end of that 20 working day period, and delivered to the ESO within 7 (seven) working days after the decision is issued by the Director General or the Minister (Article 58 of MoCD Reg. 9/2026). Filing an objection does not suspend the implementation of the sanction (Article 55(4)). If the ESO does not accept the Minister’s resolution of its objection, it may file a claim with the State Administrative Court (PTUN) to assess whether there was an abuse of authority (Article 60).

 

Implementation and Transitional Period

MoCD Reg. 9/2026 has been in effect since its enactment on 6 March 2026. However, ESOs were given a transitional period of 3 months from the enactment date, being until 6 June 2026, to submit their initial risk level self-assessment report on their PSF to the Minister through the Director General (Article 62). That deadline has now passed, so ESOs that have not yet filed their report may be exposed to supervisory action by the Ministry. Separately, and more broadly, GR 17/2025 itself affords ESOs a 2-year transitional period from its enactment on 27 March 2025 (i.e., until 27 March 2027) to fully align their governance framework with the parent regulation. Whether this longer runway also extends to the operational requirements in MoCD Reg. 9/2026 is not expressly addressed: MoCD Reg. 9/2026 itself took effect immediately (Article 63) and sets only the 3-month deadline for the initial report (Article 62). ESOs should therefore not assume that the 2-year period shields them from the requirements of MoCD Reg. 9/2026.

 

Concluding Remarks

Read together, GR 17/2025 and MoCD Reg. 9/2026 form a two-tier regime for child protection in Indonesia’s digital space: the former lays down the principles-based obligations (the best interests of the child, privacy by default, prohibitions on covert design practices, geolocation collection, and profiling of Children), while the latter equips ESOs with the operational playbook to comply with them, namely, minimum age tiers, mandatory self-assessment documentation, risk-level determination procedures, and account-level restrictions for higher-risk and social media services.

For ESOs operating PSF that are used or may be used by Children in Indonesia, whether social media platforms, gaming services, e-learning platforms, or connected toys and devices, the practical task ahead is to conduct and document the mandatory self-assessment (both the age-suitability and the risk-level assessments), calibrate minimum age settings and default privacy configurations to the prescribed age ranges, and submit the requisite risk-level report to the Director General if they have not already done so (the 3-month window closed on 6 June 2026). The 3-month reporting deadline under MoCD Reg. 9/2026 has already passed, and the 2-year transitional period under GR 17/2025 runs only until 27 March 2027, so ESOs should prioritize this work now, particularly for higher-risk and social-networking services where the consequences of non-compliance, ranging from written warnings to access termination, are most acute.

 

 

Disclaimer: The information herein is of general nature and should not be treated as legal advice, nor shall it be relied upon by any party for any circumstance. Specific legal advice should be sought by interested parties to address their circumstances.