Peraturan Pemerintah 17/2025 (Peraturan Pemerintah Nomor 17 Tahun 2025 tentang Tata Kelola Penyelenggaraan Sistem Elektronik dalam Pelindungan Anak) is an Indonesian government regulation on the governance of electronic systems for the protection of children. It sets the duties of operators of electronic systems whose products, services and features are designed for, or are likely to be used by, children under 18, and the supervisory and sanctioning powers of the minister responsible for communications and information. It was signed by President Prabowo Subianto and promulgated on 27 March 2025, as Lembaran Negara 2025 No. 36 and Tambahan Lembaran Negara No. 7105.^[1][2] It is one of the instruments of data governance in Indonesia.

The regulation was issued to implement the child-protection provisions added to the law on electronic information and transactions by Undang-Undang 1/2024.^[3] It requires operators to assess each product's risk to children, obtain parental consent, apply high privacy settings by default, verify users' ages and provide reporting channels. It prohibits them from profiling children, collecting their precise location by default, and using concealed design practices that push children to disclose data or weaken their protection.^[4][5]

It fixes minimum ages and age bands for account ownership, linked to a product's risk profile, and gives the minister powers of monitoring, investigation and control, with administrative sanctions ranging from written warnings to termination of access.^[6][7][8] Operators were given two years from promulgation to comply.^[9] CRPG's regulatory tracker published an analysis of the regulation in March 2026.^[10]

¶ Background

The preamble states that the regulation implements Pasal 16A ayat (5) and Pasal 16B ayat (3) of Law 11/2008 on Electronic Information and Transactions, as last amended by Undang-Undang 1/2024, which is also its only statutory basis besides the Constitution.^[3:1] Its general elucidation observes that children have become a large share of the users of products, services and features offered by electronic system operators, that they may not yet have the capacity to understand the risks to their rights, and that the misuse or sale of children's data, economic exploitation and sexual abuse are among the negative effects of such use.^[11]

Pasal 1 defines a child (Anak) as a person under 18 years of age and the minister as the minister responsible for communications and information. It also defines a personal data protection impact assessment (Penilaian Dampak Pelindungan Data Pribadi) for the processing of children's data.^[12]

¶ Scope and risk assessment

Pasal 2 requires every electronic system operator to protect children who use or access its system, to apply technology and operational measures from development through operation, and to provide information on the minimum age for its products, a mechanism to verify child users, and a mechanism to report products that infringe children's rights. The duty applies to public-scope and private-scope operators whose products, services and features are designed specifically for children or are likely to be used by them.^[4:1] Pasal 4 lists the indicators of likely use by children, among them the operator's own terms and internal documents, strong evidence that children use the product regularly, advertising aimed at children, and design elements that appeal to them.^[4:2]

Under Pasal 5, each product is assessed as high or low risk against seven aspects: contact with strangers; exposure to pornographic, violent, dangerous or otherwise unsuitable content; exploitation of children as consumers; threats to the security of children's personal data; addiction; and harm to psychological and physiological health. A high rating on any one aspect makes the whole product high risk. Operators must carry out a self-assessment and report it to the minister, who verifies it and determines the product's risk profile.^[4:3] Pasal 8 requires operators to consider the best interests of the child and to give priority to children's rights and protection over their commercial interests.^[4:4]

¶ Obligations and prohibitions

Pasal 7 lists the operator's obligations: parental or guardian consent; a data protection impact assessment; high privacy settings by default; complete, accurate and non-misleading information; digital education and ecosystem empowerment; visible signals when a child's activity is monitored or location tracked; functions suited to the child's age and capacity; a clearly responsible party for internet- connected toys and devices; the compliance of partners; and a data protection officer.^[5:1] Under Pasal 9, consent must be obtained before a child uses a product; for children aged at least 17, the operator may ask the child for consent but must notify the parent or guardian for confirmation, and where the parent refuses, the child's consent is void and the child's personal data must be deleted. ^[5:2]

Pasal 17 to Pasal 19 set out the prohibitions. Operators may not use concealed or non-transparent techniques that encourage children to disclose more data than needed, give up privacy protection or take actions harmful to their health or welfare. They may not collect precise geolocation by default, except where strictly necessary for a service the child requested and then only for a limited time, or without a clear signal to the child. Profiling of children is prohibited unless the operator can show strong reasons that it serves the child's best interests or it is a core feature actively and knowingly requested by the child.^[5:3]

¶ Age limits and verification

Pasal 20 sets a minimum age of three and five age bands: 3 to 5, 6 to 9, 10 to 12, 13 to 15, and 16 to under 18. Pasal 21 governs accounts: children under 13 may hold accounts only on products designed for children with a low risk profile and with parental consent; children aged 13 to under 16 only on low-risk products with parental consent; and children aged 16 to under 18 on any product with parental consent. Operators must provide effective tools for parents to supervise use through the child's account.^[6:1]

Pasal 22 requires age verification proportionate to the risk to children's rights, and requires the operator to protect users' privacy, use verification data only for that purpose and delete it once the purpose is served, and provide a way to contest a wrong age determination. Where it cannot verify ages to that standard, the operator must extend the protections owed to children to all users. Pasal 23 requires reporting and complaint tools that children and parents can use easily.^[6:2]

¶ Supervision and sanctions

Supervision rests with the minister under Pasal 24, through monitoring and tracing, reports and complaints, examination and control. Pasal 28 to Pasal 36 set a procedure of preliminary examination, begun within three working days of a report, and further examination, in which the ministry may summon operators up to three times, inspect systems and premises and obtain access to data, and report suspected crimes to law enforcement. Control under Pasal 37 includes sanctions, orders, compliance assessments and publication of violations.^[7:1]

Pasal 38 lists the provisions whose breach attracts administrative sanctions: written warning, administrative fine, temporary suspension of a product, service or feature, and termination of access, which may be combined and publicly announced. Pasal 40 to Pasal 44 grade the sanctions by the gravity of the breach (its duration, the number of children affected and its impact), the operator's cooperation and other aggravating or mitigating factors; fines are calculated under the rules on non-tax state revenue. Sanctions do not remove criminal or civil liability, and an operator may object to the minister and then sue in the administrative court.^[8:1] Breaches of the data protection impact assessment and data protection officer duties are sanctioned under the personal data protection legislation, whose principal statute is Undang-Undang 27/2022.^[8:2]

¶ Participation and transition

Pasal 48 assigns roles to ministries and agencies in raising awareness and supervising child protection, to parents and guardians in choosing suitable products, assessing them before giving consent, monitoring use and educating children, and to the public in education and in reporting suspected violations.^[13] Pasal 49 requires operators and related parties to adjust to the regulation within two years of its promulgation, that is by 27 March 2027.^[9:1][2:1]

¶ See also

• Public administration in Indonesia

¶ External links

• PP No. 17 Tahun 2025 (JDIH BPK)
• CRPG: Child Protection in Indonesia's Digital Ecosystem: PP 17/2025 (crpg.id, 31 March 2026) (free sign-in required on crpg.id)

¶ References