Preparing for Indonesia PP Tunas. Five age bands. Three risk thresholds. One filing.

Indonesia now has a child-protection regime for digital services: age bands, risk tiers, age assurance, parental consent, and a self-assessment you file with the regulator. It's set out in Government Regulation 17 of 2025 (PP Tunas), with Ministerial Regulation 9 of 2026 covering the technical detail.

It applies to electronic system operators, which in practice means almost any consumer product: games, social platforms, AI products, marketplaces, livestreaming, messaging. The test is whether children in Indonesia can reach your service. Not whether you targeted them, and not whether children are your intended audience. That's what catches most teams out.

It sits on top of Indonesia's Personal Data Protection Law rather than replacing it. The PDP Law covers personal data generally; PP Tunas adds the child-specific layer. Complying with one doesn't necessarily satisfy the other.

Enforcement began in 2026, with the full penalty regime phasing in after that.

Quite possibly, and most teams underestimate it. One high-risk feature may be enough to classify your whole service as high-risk, and what counts as a "feature" may be broader than most teams assume.

The usual triggers: text, voice or video chat; user-generated content with profiles and friend discovery; livestreaming; personalised recommendations; in-app purchases; gacha or loot boxes; and addictive design patterns.

You assess yourself, but you don't decide. The assessment is quantitative, a scoring system rather than a judgement call, and you submit it for the regulator to determine your tier. It scores against seven factors:

1. Children interacting with people they don't know
2. Exposure to pornographic or violent content, content that endangers life or safety, or anything else inappropriate for a child
3. Children being exploited as consumers
4. Risks to children's personal data
5. Potential to cause addiction
6. Effects on psychological health
7. Effects on physical health

What matters is the consequence: a high-risk determination sets your minimum age at 16. Separate account-deactivation duties may also apply if the ministry has specifically designated you, so it's worth checking whether that's you.

k-ID has built a tool that runs this scoring against your own product in minutes.

File late rather than not at all.

The obligation hasn't gone away. Every in-scope operator still needs to complete and submit a credible assessment. The rollout moved faster than most companies could respond to, and plenty are still behind.

Two things work in your favour. The regulator has to investigate before it can sanction you, so no penalty lands without a prior investigation or examination. And so far it has accepted written commitments from operators making genuine progress, rather than moving straight to suspension.

From here: complete and file the assessment, ship the product changes that matter most, and build the evidence trail before the full penalty regime takes effect.

PP Tunas sets five age bands (3-5, 6-9, 10-12, 13-15 and 16-18) and prohibits access entirely below age 3.

Your risk tier then sets the minimum age: 16 if you're high risk, 13 if you're low risk but not specifically designed for children, and 3 if you're low risk and designed for children. These are minimum ages for holding an account on services that require registration, not universal access defaults.

Verifiable parental consent applies to under-18s across all three tiers, and the bands and tiers together shape your design obligations feature by feature.

For under-18s, targeted advertising, dark patterns and precise geolocation are expressly prohibited, regardless of parental consent. Profiling and addictive design mechanics such as compulsion loops and retention-engineered systems are also restricted. Children's accounts must default to the highest privacy settings.

Separately, Indonesia's broader content law adds moderation duties covering cyberbullying, hate speech, non-consensual intimate imagery, fraud, and SARA-sensitive content (ethnicity, religion, race, intergroup relations). Those sit alongside PP Tunas rather than under it.

Consent has to be opt-in and in place before the child gets access. It's a gate, not a follow-up. You can't let a child in and collect consent afterwards.

On timing, the express legal obligation is 24 hours from the access request.

The regulator hasn't endorsed specific methods by name. What it requires is an approach that's reliable, privacy-preserving, and proportionate to the risk of the feature, collecting only what the age check needs and nothing more. Credit card verification, government ID checks and facial age estimation are all commonly used. Self-declaration is treated as high-risk and shouldn't be relied on.

You also have to tell both the child and their parents or guardians when the child is being monitored or tracked, including when a parent is the one monitoring.

k-ID provides the infrastructure: age assurance (AgeKit+), feature-level compliance gating (CDK), parental consent flows (Family Connect), and regulatory intelligence (neimo.).

neimo. plugs into the AI development tool your team already uses and answers compliance questions from a knowledge base k-ID's lawyers maintain. For PP Tunas there's a dedicated capability that drafts a structured risk self-assessment for your legal team to work from.

What stays with you: the risk determination and its submission, legal interpretation, product decisions, content moderation policy, and the multidisciplinary sign-off the regulation requires.

We speed up the drafting and run the controls. AgeKit+ handles verification, CDK handles age-appropriate design, Family Connect collects parental consent. The compliance call itself is yours to make, with your counsel.