Child Protection in the Age of AI Requires More Than PP TUNAS

Six months into the implementation of Government Regulation No. 17 of 2025 on the Governance of Electronic Systems for Child Protection, known as PP TUNAS, one message is becoming increasingly clear: Indonesia has begun taking steps to limit digital risks to children, but the real work is only just beginning.

Several digital platforms have started deactivating accounts belonging to children under the age of 16 and introducing stricter safety features. The government has reported progress in implementing the policy. However, Communications and Digital Affairs Minister Meutya Hafid has also acknowledged that the rapid development of artificial intelligence (AI) is creating new risks that require child protection measures to evolve.

Indonesia has also joined the Global Coalition for Children's Rights and Protection in the Age of AI, an international initiative aimed at advancing children's rights and safety as artificial intelligence becomes increasingly integrated into everyday life.

These steps deserve recognition. But joining a global coalition and introducing national regulations must not become symbolic gestures. They must translate into meaningful protection that children and families can actually experience.

Success Cannot Be Measured by Deactivated Accounts Alone

Deactivating children's accounts is a concrete step forward. It signals that digital platforms can no longer rely entirely on the argument that using their services is a personal choice or solely a matter of parental responsibility.

Nevertheless, the number of deactivated accounts does not automatically reflect how safe the digital environment has become.

Children may still access services through alternative accounts, misrepresent their ages, or move to platforms with weaker safeguards. Restricting access also does not eliminate harmful content, cyberbullying, online fraud, data exploitation, or application designs that encourage excessive use.

This is where the criteria for evaluating PP TUNAS must become broader. The government and digital platforms should demonstrate whether risks to children are actually declining, whether complaint mechanisms work, whether violations are handled consistently, and whether services have been redesigned with children's safety in mind.

Protection must not exist only in compliance reports. It must be evident in children's actual experiences when using technology.

First, Platforms Must Be Accountable for the Risks They Create

Digital platforms are more than online spaces where users interact. Through recommendation algorithms, personalization systems, interface design, and data processing, platforms influence what children see, how long they remain online, and how they interact with others.

Corporate responsibility therefore cannot be fulfilled merely by adding parental-control features or removing accounts that violate age restrictions.

Platforms must adopt the principle of safety by design, embedding safeguards into services from the earliest stages of development. Risks to children should be assessed before new features are launched, not only after victims emerge or public pressure mounts.

These challenges are becoming more complex in the age of AI. Generative systems can produce misleading information, manipulated images and audio, and synthetic content that may be used to humiliate, threaten, or exploit children. Technologies capable of imitating a person's identity can also expand opportunities for fraud and extortion.

These risks cannot be addressed through age restrictions on social media alone. Effective protection requires accessible reporting mechanisms, rapid responses to harmful content, privacy safeguards, regular system testing, and clear procedures for supporting victims.

Platforms must also be transparent about how they verify users' ages, handle reports, and mitigate risks. At the same time, age verification must not become a justification for collecting excessive amounts of children's personal data.

Technology companies possess far greater financial resources, technical expertise, and access to data than individual families. It is therefore unfair to place the greater burden of protection on parents while companies continue to benefit commercially from user activity.

Innovation must be allowed to advance. But children's safety must never become a cost sacrificed in pursuit of user growth and corporate profits.

Second, Government Oversight Must Move Beyond Administrative Compliance

PP TUNAS provides an important legal foundation for requiring electronic system providers to take responsibility for protecting children. The next challenge is ensuring that these rules are enforced consistently, transparently, and in ways that can be evaluated by the public.

The government should not rely solely on corporate reports detailing the number of restricted accounts or newly introduced safety features. Such reports remain necessary, but they must be supported by verification, appropriate independent oversight, and clear measures of actual impact.

The public has a right to know which platforms have fulfilled their obligations, which areas still require improvement, and what action is taken when requirements are not met. Transparency is essential to ensure that child protection does not depend on companies' own declarations of compliance.

Oversight must also address the seven categories of digital risk identified by the government: contact, content, conduct-related addiction, security, consumer risks, physical and physiological impacts, and mental health. Each category requires measurable indicators and safeguards that can be tested, rather than a checklist of administrative obligations.

In the context of AI, the government must ensure that its regulatory framework can keep pace with technological change. This includes addressing synthetic content, identity misuse, manipulation targeting children, and the use of children's data to train or operate AI systems.

Indonesia's participation in the global coalition must translate into practical cooperation, including knowledge-sharing, the development of safety standards, stronger regulatory capacity, and cross-border responses to emerging threats.

Digital platforms can operate from one country, process data in another, and reach Indonesian children without regard to geographical boundaries. Without international coordination, enforcement risks falling behind the pace of technological development.

Strong oversight, however, does not mean indiscriminately restricting all uses of technology. The internet and AI can expand access to education, creativity, and knowledge. Effective policy must distinguish risks according to age, service type, and the characteristics of individual features, while keeping the best interests of children at its core.

The state must be firm in addressing risks while remaining proportionate in regulating technology.

Third, Digital Literacy and Parental Guidance Remain Essential

Protecting children will not succeed if responsibility rests solely with the government and technology companies. Homes and schools remain critical environments in which children learn to navigate the digital world.

Parents need to understand not only how much time their children spend on devices, but also what they access, who interacts with them, how content recommendations work, and what steps to take when children encounter online threats.

In the age of AI, digital literacy must evolve into AI literacy. Children need to understand that convincing answers are not necessarily accurate, images and videos that appear authentic may be fabricated, and AI systems cannot always distinguish reliable information from falsehoods.

Children must also learn not to share personal data, sensitive photographs, passwords, or family information with untrusted parties. They should feel safe reporting cyberbullying, threats, or digital manipulation without fearing immediate punishment or the loss of all internet access.

This is why parental guidance should prioritize dialogue rather than relying exclusively on punitive monitoring.

Access restrictions can be one instrument of protection, but they cannot replace education in responsibility, privacy, ethics, and the ability to recognize danger.

The government must support families through practical, accessible digital literacy programs. Schools, civil society organizations, the media, technology communities, and child protection institutions should also be involved. Education cannot be limited to occasional campaigns; it must be continuous and responsive to technological change.

At the same time, parental responsibility must not become a means of blaming families when children are victimized. Not every household has the same knowledge, time, devices, or resources to address digital threats.

Family guidance must therefore complement the obligations of platforms and the oversight of the state, not serve as a substitute for either.

Children Are Rights Holders, Not Merely Users

One principle must guide every aspect of this policy: children are not simply consumers of digital services who need to be restricted. They are individuals entitled to safety, privacy, education, development, and participation.

Every policy must therefore consider the best interests of the child. Restrictions should be accompanied by clear explanations, safe complaint mechanisms, and opportunities for children and adolescents to share their experiences.

Children's voices matter. Policies designed without understanding their behavior and needs risk producing rules that look effective on paper but are easily circumvented in practice.

The media also has a responsibility to scrutinize implementation. Journalism must go beyond reporting the number of deactivated accounts or repeating official statements. News organizations should investigate what has actually changed, test claims of success, identify gaps in protection, and give space to the perspectives of children, parents, educators, and experts.

Such public scrutiny is not opposition to government policy. Fact-based criticism is an essential part of ensuring that policies achieve their intended objectives.

From Regulation to a Safer Digital Ecosystem

Six months into the implementation of PP TUNAS, it is too early to conclude that the challenges of protecting children online have been resolved.

The government has established a policy direction. Platforms have begun taking action. Indonesia has also joined an international forum focused on child protection in the age of AI. These developments deserve recognition as progress.

But progress must be accompanied by transparent evaluation, consistent enforcement, and continuous improvement. Success must not be measured solely by how many accounts have been closed or how many companies claim to comply. The central question is how effectively the risks facing children have been reduced.

Ultimately, three responsibilities must remain inseparable: platforms must build safer services, the government must oversee compliance and enforce the rules, and parents and society must strengthen digital literacy and guidance.

None can replace the role of the others.

The AI era demands that we move beyond a reactive approach that responds only after harm has occurred. Protection must begin when technology is designed, be reinforced through effective oversight, and be sustained through education.

PP TUNAS is a foundation, not a finish line. The next challenge is to ensure that regulation can keep pace with technological change without compromising children's right to grow, learn, and develop safely.

Because the true measure of a nation's digital progress is not simply how advanced its technology has become, but how seriously it protects the generation that will inherit its future.

— Editorial Board, Stupa News