Indonesia Mulai Mengatur Internet Berdasarkan Risiko, Bukan Sekadar Konten

Selama bertahun-tahun, kalau bicara regulasi internet Indonesia, fokus publik biasanya konten.

Pornografi.

Judi online.

Hoaks.

Fitnah.

Terorisme.

Konten ilegal.

Logikanya: ada konten bermasalah, hapus atau blok.

Pada 2026, ada perubahan yang cukup fundamental.

Pemerintah mulai lebih serius mengatur bukan hanya apa yang ada di internet, tetapi bagaimana sebuah produk digital dirancang dan seberapa besar risikonya terhadap pengguna tertentu.

PP TUNAS adalah salah satu contoh paling jelas.

Aturan pelindungan anak digital tidak berhenti pada daftar konten harmful.

Ia masuk ke: usia pengguna, profil risiko platform, verifikasi usia, desain fitur, gamification, interaction, dan bagaimana produk mungkin menarik anak.

Keputusan Menteri Komdigi 142 Tahun 2026 bahkan menyebut infinite scroll, auto-play, streak, daily reward, serta loot box sebagai indikator desain yang dapat menunjukkan produk mungkin digunakan atau diakses anak.

Ini bukan content regulation klasik.

Ini product risk regulation.

Bedanya besar.

Content-based regulation bertanya: “apa yang diposting?”

Risk-based regulation bertanya: “bagaimana sistem bekerja, siapa yang terdampak, dan apa potensi harm?”

Contoh media sosial.

Kalau hanya content-based: hapus post berbahaya.

Risk-based: kenapa algoritma merekomendasikan berulang?

Apakah akun anak private default?

Apakah stranger bisa DM?

Apakah infinite scroll mendorong excessive use?

Apakah age gate gampang dibypass?

Pertanyaan bergeser.

Dari moderation ke architecture.

PP TUNAS menggunakan self-assessment

Platform harus menilai produk, layanan, dan fitur.

Apakah mungkin digunakan anak?

Tingkat risiko?

Safeguard?

Pemerintah lalu memverifikasi.

Pada Juni 2026, Komdigi melaporkan menerima self-assessment untuk 175 produk, layanan, dan fitur dari 64 PSE.

Ini struktur risk governance.

Bukan tunggu konten viral.

Platform dipaksa melihat risk sebelum incident.

Idealnya.

Implementation tentu tidak sempurna.

Tapi direction penting.

Risk classification juga membuat regulation proportional

Tidak semua platform diperlakukan sama.

High risk lebih ketat.

Low risk berbeda.

Ini lebih masuk akal daripada aturan universal.

E-commerce.

Streaming.

Game.

Social media.

AI assistant.

Semua punya risk profile beda.

Bahkan satu perusahaan bisa punya banyak service.

Komdigi pada Juli 2026 memverifikasi 14 layanan Apple satu per satu, termasuk Siri, iMessage, Safari, Apple Music, dan Apple TV.

Ini ilustrasi bagus.

Regulator tidak hanya bilang: “Apple aman” atau “Apple berbahaya.”

Product-by-product.

Feature-by-feature.

Ini arah modern.

Risk-based regulation melihat behavior, bukan label.

Perusahaan bisa bilang: “kami bukan platform anak.”

But if evidence menunjukkan banyak child users, desain child-oriented, dan marketing ke anak, claim tidak cukup.

Keputusan Menteri 142 memasukkan komposisi pengguna, iklan, desain, serta kemiripan dengan produk yang digunakan anak sebagai indikator.

Real use matters.

Terms tidak bisa sepenuhnya menjadi shield.

Ini principle yang bisa meluas ke AI regulation nanti.

Perusahaan tidak bisa bilang: “AI hanya advisory.”

Kalau realitanya manusia selalu mengikuti, regulator bisa melihat function.

Substance.

Not label.

Indonesia sedang bergerak ke prevention

Content moderation sering reactive.

Post sudah muncul.

User sudah lihat.

Report.

Delete.

Risk regulation mencoba preventive.

Private by default.

Age gate.

DM restriction.

Recommendation safety.

Purchase control.

Prevent harm before.

Ini lebih sulit.

But potentially more effective.

Safety by design.

Digital governance shifts left.

Masuk development.

Bukan hanya enforcement after launch.

Design team menjadi regulatory actor

Ini new.

Dulu lawyer dan moderator yang banyak terkait compliance.

Sekarang product designer.

UX researcher.

Data scientist.

Growth team.

Engineer.

Decision mereka punya legal consequence.

Streak.

Autoplay.

Recommendation.

Default.

Button.

A/B test.

All can affect risk.

Company governance must change.

Legal cannot operate in isolation.

Child safety review enters product process.

This will likely happen in AI too.

Model permission.

Agent action.

Memory.

Risk regulation enters architecture.

Privacy law already shows same shift

UU PDP bukan hanya mengatur konten.

It regulates data processing risk.

Purpose.

Consent.

Security.

High-risk processing.

Automated decision.

Impact assessment.

So risk-based digital regulation is not entirely new.

PP TUNAS extends logic to child experience.

AI governance likely continues.

RPerpres AI Indonesia in 2026 also repeatedly discussed risk mitigation, ethics, safety, and accountability.

Indonesia’s digital policy is becoming more systemic.

From “remove bad thing” to “manage risky system.”

This is maturation.

Risk-based approach avoids banning technology

If product risk can be mitigated, no need ban whole category.

Social platform can build child mode.

Game can restrict chat.

AI can require human review.

High-risk use gets stronger control.

Innovation remains.

This balance useful.

Blanket ban easy politically.

Risk governance harder.

Need evidence.

Technical capacity.

Audit.

But more precise.

Risk regulation also requires regulator to understand technology

This is challenge.

Content moderation can be checked: post exists or not.

Product risk needs deeper expertise.

How recommender works.

Age verification accuracy.

Dark pattern.

Data flow.

Human oversight.

Regulator needs engineer and behavioral expert.

Not only legal staff.

Testing capability.

Otherwise self-assessment becomes paper.

Vendor knows system better.

Regulatory asymmetry.

Indonesia needs capacity building.

Risk changes over time

Platform feature update.

Risk changes.

Game adds public chat.

Streaming adds comments.

AI adds memory.

So assessment must be lifecycle.

Not once.

Material change.

Re-evaluate.

This principle should be in future regulation.

If risk governance becomes annual form only, useless.

Product releases weekly.

Need trigger.

Incident.

Feature.

User composition.

Model update.

Risk-based regulation needs dynamic process.

Public also needs transparency

If government categorizes service high risk, explain.

Criteria.

Scope.

Review.

Companies need predictability.

Parents need clarity.

Not secret blacklist.

High-risk label has consequence.

Due process.

Evidence.

Appeal maybe.

Transparency builds legitimacy.

Risk classification should not become arbitrary discretion.

Framework must be measurable.

But not over-quantified.

Some risk needs judgment.

Children’s rights must remain center

Risk-based regulation can become paternalistic if careless.

Goal not remove children from internet.

Children have rights to information, expression, participation, education.

EU minor protection guideline explicitly recognizes balance between safety and rights.

Indonesia should too.

PP TUNAS’s “Tunggu Anak Siap” framing is delay and age-appropriate access, not anti-technology.

Implementation should preserve opportunity.

Safe internet, not empty internet.

Product safety can be competitive advantage

Platform that demonstrates child-safe design gains parent trust.

Private default.

Strong moderation.

No manipulative monetization.

Age-appropriate experience.

This can become market differentiator.

Compliance not only cost.

Schools and parents prefer safe product.

Enterprise procurement too.

Safety can create value.

Indonesia could even develop local child-tech standard

Imagine certification or standard.

Age assurance.

Privacy.

No dark pattern.

Parental control.

Recommendation safety.

Platform can voluntarily demonstrate.

Regulator sets baseline.

Independent evaluator.

This could help parents navigate.

But avoid label theater.

Certification needs audit.

Not logo for sale.

Risk-based policy can expand beyond child protection

AI.

Fintech.

Platform.

Online marketplace.

Identity.

The same questions repeat.

Who affected?

How severe?

How likely?

What control?

What remedy?

This is more sophisticated than binary legal-illegal content model.

Content law remains necessary.

Illegal content still illegal.

But not enough.

A platform can host legal content and still produce harmful systemic behavior through design.

That is the insight.

Example: all videos individually legal.

Algorithm keeps pushing one extreme category to a child.

No single post violates law.

Systemic outcome still concerning.

Content moderation alone cannot solve.

Need distribution governance.

Same with dark pattern.

Button text legal.

But architecture manipulates.

Need product governance.

Indonesia Mulai Mengatur Internet Berdasarkan Risiko, Bukan Sekadar Konten because digital harm increasingly comes from systems.

Feed.

Ranking.

Default.

Data.

Age.

Design.

Permission.

The regulatory object is moving upward.

From individual post to product architecture.

This is harder to regulate.

But probably necessary.

The internet of 2026 is not a bulletin board where people upload isolated content.

It is an adaptive system that predicts, recommends, nudges, profiles, and personalizes.

If regulation only sees content, it misses half the machine.

PP TUNAS is one early sign Indonesia is starting to see the other half.

The next challenge is making sure risk-based regulation remains measurable, proportional, transparent, and technically competent.

Otherwise “risk” can become vague justification for anything.

Done well, it gives Indonesia a much better language for governing the next wave of digital products.

Perubahan ini juga punya implikasi besar untuk cara perusahaan membangun compliance. Dulu banyak tim legal bekerja setelah produk jadi. Mereka membaca content policy dan membuat mekanisme takedown. Dalam model risk-based, compliance harus hadir sebelum launch.

Product requirement perlu mencatat target usia.

Data yang dipakai.

Interaction.

Recommendation.

Monetization.

Potential harm.

Sebuah fitur bisa legal secara konten tetapi tetap tidak lolos risk review karena desainnya mendorong perilaku berlebihan atau membuka kontak dengan orang asing.

Ini mengubah organisasi.

Trust and safety tidak lagi hanya moderation team.

Ia masuk product governance.

Risk-based regulation juga memungkinkan pemerintah memakai intervention yang lebih granular. Tidak selalu blokir seluruh platform.

Bisa: matikan fitur tertentu untuk age band.

Ubah default.

Wajibkan verification.

Batasi recommendation.

Tambah parental control.

Minta audit.

Ini lebih presisi.

Dan biasanya lebih sustainable daripada ban total.

Namun granularity menuntut regulator lebih kompeten secara teknis. Kalau pemerintah tidak memahami architecture, intervensi granular bisa salah sasaran.

Karena itu transparency dari platform dan kemampuan testing regulator harus berkembang bersama.

Ada pula risiko regulatory creep. Kata “risiko” sangat fleksibel. Kalau tidak ada kriteria, pemerintah bisa menggunakannya untuk membatasi produk tanpa evidence kuat.

Maka risk-based regulation harus punya safeguards.

Definisi.

Indikator.

Proses verifikasi.

Alasan tertulis.

Review.

Proportionality.

Kepmen 142/2026 menarik karena mencoba membuat indikator terukur. Ini arah yang perlu dipertahankan.

Semakin besar konsekuensi suatu klasifikasi, semakin jelas evidence yang dibutuhkan.

Di masa depan, pendekatan serupa bisa dipakai pada AI. Bukan melarang semua AI, tetapi melihat use case, autonomy, data, dan dampak.

Dalam arti itu, PP TUNAS mungkin menjadi laboratorium kebijakan yang lebih besar daripada isu anak saja.

Ia mengajari regulator bagaimana berpindah dari moderasi konten ke governance sistem.

Not: “technology bad.”

But: “which part creates risk, for whom, and what control actually reduces it?”