Kebijakan Digital yang Baik Harus Bisa Diuji oleh Publik

Pemerintah bikin aturan digital.

Platform patuh.

Selesai?

Belum.

Pertanyaan paling penting justru datang setelah aturan jalan:

apakah kebijakannya bekerja?

Apakah anak lebih aman setelah PP TUNAS?

Apakah verifikasi usia akurat?

Apakah akun yang ditutup benar milik anak?

Apakah anak pindah ke platform lain?

Apakah dark pattern berkurang?

Apakah startup terbebani tidak proporsional?

Apakah privacy justru memburuk?

Kebijakan digital yang baik harus bisa diuji oleh publik.

Bukan hanya diumumkan.

Indonesia sebenarnya punya tradisi konsultasi publik dalam pembentukan regulasi.

Pada Januari 2026, Komdigi membuka konsultasi publik untuk Rancangan Permen tentang Pendekatan Kota Cerdas.

Pada April 2026, konsultasi publik juga dilakukan untuk rancangan aturan manajemen aset dan layanan SPBE, dengan merujuk pada kewajiban partisipasi masyarakat dalam pembentukan peraturan perundang-undangan.

Ini bagus.

Tapi konsultasi sebelum aturan hanya setengah proses.

Setelah implementasi, publik juga perlu data untuk mengevaluasi.

Policy needs feedback loop.

Pertama: pemerintah harus menjelaskan tujuan

Aturan tidak bisa diuji kalau targetnya vague.

“Melindungi anak.”

Bagus.

Bagaimana mengukur?

Exposure harmful content turun?

Grooming complaint?

Screen time?

Unauthorized purchase?

Account under 16?

Need metric.

Tidak harus satu angka.

Outcome multidimensional.

Tapi tujuan measurable.

Kalau metric hanya: berapa akun ditutup,

kita mengukur action.

Bukan safety.

Policy evaluation starts with outcome.

Kedua: baseline harus ada

Sebelum aturan: berapa anak punya akun?

Berapa complaint?

Berapa exposure?

Kalau tidak tahu baseline, sulit mengatakan improvement.

Maybe after policy complaint naik because reporting easier.

Is that failure?

Not necessarily.

Data interpretation matters.

Government should document baseline assumptions.

If data incomplete, say.

Transparency about limitation.

No fake precision.

Kebijakan kompleks rarely has perfect data.

But we can still learn.

Ketiga: methodology should be public

Pemerintah bilang: “risiko turun 40 persen.”

How?

Survey?

Platform data?

Sample?

Question?

Public needs know.

Otherwise number is PR.

Methodology allows researcher reproduce or critique.

This is normal science.

Policy should aspire.

Especially digital where data abundant.

Publish aggregate.

Protect privacy.

But explain method.

Trust comes from inspectability.

Keempat: platform self-assessment must be challengeable

PP TUNAS uses self-assessment plus government verification.

Good.

But can public know high-level result?

Which service high risk?

Why?

What control?

Not every confidential detail.

But enough.

If platform says safe while parents report problem, there must be channel.

Civil society evidence.

Academic research.

User complaint.

Regulator should revisit.

Self-assessment should not become closed conversation company-government.

Affected user matters.

Kelima: public consultation should be meaningful

Don’t publish draft Friday.

Deadline Monday.

Technically public.

Practically no.

Give time.

Summary.

Key question.

Machine-readable if possible.

Accept feedback online.

Publish response matrix.

Which suggestions accepted?

Rejected?

Why?

This shows participation has consequence.

Otherwise consultation theater.

People stop contributing.

Policy quality suffers.

Keenam: include children when policy affects children

PP TUNAS protects children.

Do children understand implementation?

What feature matters?

Where do they bypass?

What feels unsafe?

Adults can guess.

Often wrong.

Child participation needs ethical design.

Age-appropriate session.

Consent.

Privacy.

No tokenism.

But their experience is data.

International child safety policy increasingly uses child consultation.

Indonesia can too.

A rule about children should not be written only by adults in meeting room.

Ketujuh: researchers need access

Platform owns data.

Government maybe receives.

Academics don’t.

Without independent research, claims hard to verify.

Controlled data access.

Secure environment.

Aggregated API.

Privacy preserved.

Researchers can test: recommendation, age verification, moderation.

Not source code.

Behavior.

This can reveal systematic issues.

Need researcher protection.

Good-faith audit should not be treated hacking automatically.

Policy may need safe framework.

Kedelapan: publish incident data

What went wrong?

Age verification false positive.

Data breach.

Wrong account deletion.

Child bypass.

Dark pattern complaint.

Aggregate.

Incident is learning.

If all incident hidden, policy evolves slowly.

Public database can anonymize.

Severity.

Category.

Resolution.

This is especially valuable for AI and platform governance.

Same mistake not repeated.

Transparency should encourage reporting, not punish every error.

Ninth: regulation should have review date

Not forever.

“Review implementation after 12 months.”

Explicit.

Then government reports.

Need adjustment?

Threshold?

Scope?

Technical method?

This prevents obsolete rule.

Digital policy changes fast.

Mandatory review creates institutional memory.

PP TUNAS could benefit from periodic implementation report.

How many PSE assessed?

What risk?

What improvement?

Outcome?

Tenth: startup impact should be measured

Regulation can protect user but unintentionally hurt innovation.

Measure compliance cost.

Time to approval.

Legal spend.

Feature delay.

Market concentration.

If only Big Tech can comply, maybe rule needs simplified SME route.

Komdigi on 23 July 2026 said regulation should catalyze startup growth.

Test that statement.

Are startups growing?

Are compliance requirements clear?

Policy goal includes economy.

Measure.

Eleventh: public dashboard can help

Imagine dashboard.

Products assessed.

High-risk categories.

Accounts underage disabled.

Appeals.

Age verification accuracy ranges.

Child safety incident.

No personal data.

Updated quarterly.

Public sees progress.

Journalist analyzes.

Researchers ask.

Government gets accountability.

Dashboard not substitute report.

But improves visibility.

Indonesia already builds digital government infrastructure.

Policy transparency should also be digital.

Twelfth: raw data isn’t enough

Dump CSV 5GB.

“Transparent.”

No.

Need context.

Definition.

Method.

Limitation.

Version.

Data dictionary.

Otherwise only specialist can use.

Public-friendly summary plus machine-readable dataset ideal.

Two layers.

Citizen and researcher.

Transparency designed.

Thirteenth: independent oversight matters

Government evaluates own policy.

Potential bias.

Maybe BPK, Ombudsman, DPR, academic panel, data protection authority, or other relevant institutions depending issue.

External review.

Not every policy needs new agency.

Use existing oversight.

The point: someone outside implementing team can challenge.

Digital policy concentrates power.

Independent scrutiny valuable.

Fourteenth: appeals data reveals design failures

If 30 percent age-verification appeals succeed, system bad.

If appeal takes 40 days, due process weak.

Publish aggregate.

This tells public more than enforcement count.

Regulator should require platform track.

Same with content moderation.

How many removal overturned?

AI false positive?

Appeal rate is quality metric.

Fifteenth: policy should allow controlled experiment

Maybe one mechanism works in city A.

Another B.

Compare.

Age assurance method.

Public service design.

Regulatory sandbox.

Evidence.

Scale what works.

Digital policy can be iterative.

Government doesn’t need pretend knows perfect answer.

Testing is strength.

Not weakness.

Sixteenth: publish negative result

This is culture change.

Pilot fails.

Say.

“Method X caused too many false positives.”

Good.

Saves everyone.

Government often afraid admit.

But tech policy requires learning.

Failure hidden leads repeated failure.

Public may trust more when limitation acknowledged.

Scientific mindset.

Seventeenth: don’t confuse public testing with referendum for every technical choice

Not every API parameter needs vote.

Experts decide technical detail.

But public should be able to inspect goals, evidence, rights impact, and outcome.

Consultation not direct democracy.

It’s accountability.

Government retains responsibility.

Need speed too.

Balance.

Eighteenth: privacy can coexist with transparency

Common excuse: “data cannot be public due privacy.”

Some true.

But aggregate possible.

Anonymized.

Differential privacy.

Statistic.

Method.

No need expose child identity.

Transparency design like product design.

Ask: what minimum data lets public evaluate?

Publish that.

Not all or nothing.

Nineteenth: procurement should be visible when policy depends vendor

Government uses age verification vendor.

AI vendor.

Content monitoring.

Public should know contract basics.

Scope.

Cost.

Performance metric.

Not trade secrets.

But enough to evaluate public spending.

If vendor system fails, accountability.

Public procurement transparency.

Technology doesn’t change.

Twentieth: policy language should include falsifiability

This is simple.

What evidence would make government change its mind?

If age restriction doesn’t reduce harm after two years, adjust?

If privacy incident rises, redesign?

State criteria.

A policy that cannot be disproven becomes ideology.

Digital policy should be empirical.

Kebijakan Digital yang Baik Harus Bisa Diuji oleh Publik because technology policy works on systems people cannot see.

Algorithm.

Verification.

Data exchange.

Moderation.

If government and platform are the only ones who know how it works, trust fragile.

Public testing doesn’t mean opening every source code.

It means outcome and evidence can be challenged.

A regulation should be able to answer:

What problem are you solving?

What data shows it exists?

What metric shows improvement?

What harm did the rule create?

When will you review?

Who can challenge?

If those questions have answers, policy can learn.

If not, regulation risks becoming permanent because nobody knows whether it worked.

Ada satu mekanisme sederhana yang jarang dipakai maksimal: public changelog regulasi. Ketika guidance, klasifikasi risiko, atau metode verifikasi berubah, pemerintah sebaiknya mencatat apa yang berubah dan kenapa.

Ini membantu bisnis.

Juga membantu publik.

Kita bisa melihat apakah policy belajar dari evidence atau hanya berubah karena pressure politik.

Changelog menciptakan institutional memory.

Peneliti bisa membandingkan versi.

Perusahaan tahu kapan obligation berubah.

Media tidak salah mengutip dokumen lama.

Digital policy perlu version control seperti software.

Selain itu, complaint channel publik seharusnya menghasilkan insight agregat. Bukan hanya tiket selesai. Kalau ribuan orang melaporkan hal sama, pemerintah perlu menunjukkan bahwa pattern dianalisis.

“Masalah ini ditemukan dari 3.000 laporan, control diubah.”

Itu membuat partisipasi terasa nyata.

Policy evaluation juga sebaiknya memasukkan distributional impact. Apakah rule membantu anak urban tapi menyulitkan anak rural? Apakah startup kecil lebih terdampak daripada Big Tech? Apakah pengguna disabilitas kesulitan verification?

Average can hide inequality.

Public testing harus melihat siapa yang mendapat benefit dan siapa yang menanggung cost.

Terakhir, pemerintah perlu menerima bahwa kebijakan bisa sebagian benar dan sebagian salah. Tidak harus dipertahankan utuh demi gengsi institusi.

Update rule berdasarkan evidence adalah tanda governance bekerja.

Bukan tanda pemerintah gagal.

In digital governance, transparency is not decoration.

It is the feedback mechanism that keeps rules from getting stupid.