IndonesiaGovernment Regulation No. 17 of 2025 on Child Protection in Electronic Systems
In force since .
An age-appropriate design code rule binding public and private bodies.
- Enforcement body
- The Minister responsible for overseeing the Regulation's implementation (Article 24(1))
- Audit expectation
- continuous
- Who audits it
- Regulator
- Where the report goes
- Published summary
What it requires
- Applies to every Electronic System operator, public or private, offering a Product, Service or Feature that a child (a person under 18) can use or access.
- Disclose the minimum age and age range able to use your Product, Service or Feature; the regulation sets five age bands: 3 to 5, 6 to 9, 10 to 12, 13 to 15, and 16 up to under 18.no control in the NIST Privacy Framework
- Provide a mechanism that verifies whether a user is a child, and calibrate its level of assurance to the risk your Product, Service or Feature poses to a child's rights.no control in the NIST Privacy Framework
- Let a child under 13 hold an account only on a Product, Service or Feature specifically designed for a child's use, carrying a low risk profile, and only with parental consent.NIST Privacy FrameworkCT.PO-P1
- Process age-verification data only for that purpose and delete it once the purpose is fulfilled, subject to any statutory retention duty; protect the privacy and personal data of users, particularly children.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.DM-P5
- Give users a mechanism to dispute or seek correction of an age determination.NIST Privacy FrameworkCT.PO-P3
- Provide a mechanism for reporting a Product, Service or Feature that violates or risks violating a child's rights.no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P5Data are destroyed according to policy.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it reaches
Age threshold
18
Covered services
Every Electronic System operator, public or private, offering a Product, Service, or Feature that a child can use or access
What it makes you log
Who may demand the log
Regulator
Log retention
Article 22(3)(f). The Regulation states no period for the self-assessment or the impact assessment.
- As of
- Basis
- Purpose bound
- Prohibits retaining
- Data used for age verification once the purpose of verifying the child's age is fulfilled, unless a statutory provision requires it to be kept
Logging duty
Each operator must carry out a self-assessment of the risk its products, services and features pose to children and report the result to the Minister, and must prepare a personal data protection impact assessment; neither can be shown without a record. Article 22 on age verification requires no record of an individual age check.
- Kind
- Implicit
- As of
- Provision
- Government Regulation No. 17 of 2025, Article 5(6) and (7), with Article 7(1)(b)
- Trigger
- all_systems
What this law does
The Regulation applies to every Electronic System operator, distinguishing operators in the public sphere from those in the private sphere, and requires each to disclose the minimum age and age range able to use its Product, Service, or Feature, to provide a mechanism verifying whether a user is a child, and to provide a mechanism for reporting a Product, Service, or Feature that violates or risks violating a child's rights.
Article 20(2) sets five age bands: ages 3 to 5, 6 to 9, 10 to 12, 13 to 15, and 16 up to under 18. Article 21(1)(a) lets a child under 13 hold an account only on a Product, Service, or Feature specifically designed for a child's use, carrying a low risk profile, and only with parental consent.
Article 22 requires an operator performing age verification to protect the privacy and personal data of users, particularly children, to calibrate the verification mechanism's level of assurance to the risk the Product, Service, or Feature poses to a child's rights, to process verification data only for that purpose and delete it once the purpose is fulfilled (subject to any statutory retention duty), and to give users a mechanism to dispute or seek correction of an age determination.
Oversight of compliance sits with the Minister, who may monitor, investigate reports and complaints, and act on the results of an investigation; the specific administrative sanction types are set out later in the Regulation's own text, not described here.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .