Introduction

Indonesia has reinforced its legal framework for online child protection through the enactment of Government Regulation No. 17 of 2025 (PP 17/2025). This regulation introduces clear and enforceable obligations for digital platforms to protect children under the age of 18 in online environments, marking a significant development in Indonesia’s approach to digital governance and child protection.

PP 17/2025 serves as the implementing regulation of Law No. 35 of 2014 on Child Protection and is closely connected to the Personal Data Protection Law (Law No. 27 of 2022). Together, these laws establish Indonesia’s comprehensive framework for safeguarding children in digital spaces while regulating the conduct and responsibilities of digital platforms.

Rationale Behind PP 17/2025

The issuance of PP 17/2025 responds to the growing recognition that existing child protection and data privacy laws were no longer sufficient to address evolving online risks. These risks include exposure to harmful content, unsafe online interactions, and digital design features that may encourage addictive behavior.

By imposing direct and enforceable obligations on digital platforms, PP 17/2025 fills this regulatory gap and represents a major shift in Indonesia’s digital governance, moving toward a more proactive and preventive model of child protection.

Scope of Application

PP 17/2025 applies to all Electronic System Operators (PSE), both domestic and international. This includes social media platforms, online games, applications, and other digital services, insofar as their services are accessible to children within Indonesian jurisdiction.

As a result, foreign-based platforms operating cross-border may also fall within the scope of the regulation if their products or services reach child users in Indonesia.

Key Obligations Under the Regulation

The regulation requires digital platforms to adopt a proactive approach in identifying and mitigating risks to children. In particular, platforms must:

• Assess and mitigate risks related to harmful content, unsafe interactions, and addictive digital design;
• Implement age limits, age verification mechanisms, and parental consent where required;
• Apply high privacy settings by default for child users;
• Prohibit commercial profiling and precise geolocation tracking of children; and
• Provide accessible reporting and complaint mechanisms while avoiding manipulative or deceptive design practices.

These obligations emphasize that child protection must be embedded not only in content moderation, but also in platform architecture, data handling, and user experience design.

Implementation Timeline

PP 17/2025 provides a two-year transition period, running from March 2025 to March 2027. During this period, digital platforms are expected to prepare and adjust their systems, governance frameworks, and internal policies to ensure compliance.

Following the transition period, full administrative enforcement will apply. Importantly, civil and criminal liabilities under other applicable laws remain enforceable even during the transition phase.

Responsibilities of Electronic System Providers

Draft implementing regulations issued by the Ministry of Communication and Digital further elaborate the responsibilities of Electronic System Providers (ESP).

These responsibilities apply throughout the entire lifecycle of digital products and services, from the design stage through actual use by children.

ESPs are required to implement preventive and protective measures, including age restrictions, independent risk assessments, and the application of safety-by-design and privacy-by-design principles. Parental control mechanisms must also be made available.

In addition, ESPs must address substantive risks associated with digital services, such as addiction, exposure to harmful content, exploitation, and physical or psychological health disorders affecting children.

Data Protection Duties

In line with Indonesia’s data protection framework, ESPs are subject to specific obligations concerning children’s personal data. These include obtaining verifiable parental consent, ensuring data security, fulfilling data subject rights, submitting accurate and truthful reports to the Minister, and cooperating fully in regulatory supervision processes.

Sanctions and Enforcement

Non-compliance with PP 17/2025 may result in administrative sanctions, including written warnings, declarations of non-compliance with self-assessment obligations, and service restrictions or termination, depending on the severity of the violation.

In cases involving serious violations or indications of criminal conduct, matters may be referred to law enforcement authorities and may proceed to criminal or civil proceedings.

Why This Regulation Matters

PP 17/2025 reflects a fundamental shift from reactive content control to preventive, risk-based platform governance. Child protection is no longer treated as an optional or secondary concern, but as a core compliance and design responsibility for digital platforms operating in Indonesia.

For digital service providers, early preparation and compliance planning are essential to manage legal, regulatory, and reputational risks under Indonesia’s evolving digital regulatory landscape.

Key Takeaway

PP 17/2025 places child protection at the core of digital platform compliance in Indonesia, requiring safety-by-design, strict data protection, and proactive risk mitigation. Digital service providers must use the transition period to align systems and governance ahead of full enforcement.