Indonesia plans stricter rules for Roblox to protect children

Indonesia’s National Counterterrorism Agency (BNPT) plans to introduce stricter regulations for online platforms, including Roblox, to prevent exposure to violence and extremism among children.

BNPT chief Eddy Hartono said authorities are working with intelligence agencies, the police’s anti-terror squad Densus 88, and related ministries to develop rules for digital oversight.

The planned regulation would require facial verification for users of online games deemed high-risk, such as Roblox, to prevent underage children from creating accounts.

Investigations will also target online algorithms and communities suspected of promoting violent or extremist content to minors.

According to Densus 88, 70 children in Indonesia were exposed to neo-Nazi and white supremacy ideologies from January 2025 to early January 2026, with most cases reported in Jakarta, West Java, and East Java.

Most affected children were between 11 and 18 years old, with age 15 being the most common.

🔗 Source: Bisnis Tekno

🧠 Food for thought

Implications, context, and why it matters.

Facial verification lacks clear legal basis and enforcement

Indonesia’s National Counterterrorism Agency (BNPT) floated a facial check rule that current laws do not require 1. Government Regulation Number 17 of 2025 (PP Tunas) sets platform duties on verification and safety but stops short of mandating biometrics 1.
The Indonesia Game Rating System (IGRS), effective January 2026, covers content ratings not identity checks 2. The government plans to pair digital ID tools with facial recognition, yet no binding rule compels platforms such as Roblox to use it 2.
PP Tunas was passed on March 28, 2025, and officials say rollout often needs at least a year to adjust 1. The gap makes BNPT’s facial verification plan aspirational for now, which leaves platforms unsure about near-term compliance.

Privacy tech vendors face unclear rules in Indonesia’s age checks market

Vendors building age checks for gaming must follow the Personal Data Protection (PDP) Law 3. It classifies biometric data as specific (sensitive) personal data and requires a valid legal basis plus stronger safeguards.
Cross-border transfers need adequacy assessments by the planned PDP Agency, a new data protection regulator targeted to go live in 2026 3. This creates near-term hurdles for global vendors rolling out facial recognition across regions.
SIM card registration trials include ISO 30107 liveness checks, which signals demand for anti-spoofing tech 4. Firms that match this bar for games, while meeting PDP Law safeguards plus transfer rules, can win early share in Southeast Asia’s trust and safety stack.