Indonesia officially barred under-16s from using “high-risk” social media earlier this year. But that hasn’t stopped the son of one Jakarta-based writer from using it. Aged 14, he already had accounts on Instagram and TikTok – among the platforms Jakarta said children would be banned from using – as well as popular video game Minecraft and gaming platform Roblox. To register, he simply lied about his age. “He can access everything,” Inne Abidin said of her son. “His friends use everything too.” Since March, Indonesia has had some of Southeast Asia’s strictest rules governing children’s social media use. Yet like elsewhere in the region, such restrictions are only as effective as the systems Big Tech platforms put in place to identify underage users – and keep them out. From Malaysia to Vietnam, the Philippines and Singapore, governments that once merely urged platforms to protect children are now imposing rules designed to force social media companies to take responsibility. Patchy compliance Indonesia’s child protection regulations have already had an effect on how social media companies operate. In April, Meta Platforms raised the minimum age for a Facebook, Instagram or Threads account from 13 to 16 in Indonesia, with YouTube following suit later that month. Both said they would begin a phased deactivation of accounts belonging to underage users. TikTok, which was the first platform to comply with the new rules, raised its minimum platform age to 16 on March 28. By October, it had deactivated 9 million underage accounts, Indonesia’s digital affairs minister announced on Wednesday. And online gaming platform Roblox now scans Indonesian users’ faces to estimate their age, restricts some communication features for children and has added age-based account limitations. Yet youngsters seemingly still find ways to skirt the rules. To combat this, Indonesia’s government has given tech companies until the end of the year to complete comprehensive self-assessments detailing how their algorithms, age-verification and ad-targeting systems protect children. If the platforms fail to comply, the Communications and Digital Affairs Ministry has finalised a sanctions mechanism that – once codified into law – would allow Indonesia to levy fines of up to 6 per cent of tech firms’ global revenue. Applied to Meta’s reported revenue for 2025, that would amount to roughly US$12 billion. Such a fine would not be without precedent. In August, Meta agreed to pay a coalition of US states up to US$18 billion to settle lawsuits alleging Facebook and Instagram were deliberately designed to make children addicted and caused them harm. The settlement also forced sweeping changes to how teens experience the platforms, including daily usage limits, overnight usage blocks and strengthened age-verification controls. Meta has reportedly migrated some 22.5 million Indonesian platform users across to these “teen accounts”, but for the country’s government this does not go far enough. “While we see this as progress, we still do not consider Instagram and Facebook teen accounts to be low-risk,” Communication and Digital Affairs Minister Meutya Hafid told reporters in Jakarta on Wednesday. “They remain categorised as high-risk.” Child protection is hard to oppose publicly, so resisting it carries a high reputational cost Unggul Sagena, digital rights advocate For Southeast Asia, the unavoidable question now being asked is whether governments can turn the threat of penalties into real change. “In my view, the level of cooperation comes down to a few factors: how valuable the market is, how credible the government’s enforcement is, whether the rule threatens the platform’s global business model, how closely it aligns with obligations they already meet elsewhere and whether it carries legitimacy,” said Unggul Sagena, head of internet access at the Southeast Asia Freedom of Expression Network, an Indonesian digital rights organisation that advocates for internet freedom and user safety. As the region’s largest economy, the sheer size of Indonesia’s consumer market – as well as its risk-based approach to online child protection – lent its arguments and regulations weight that smaller countries lacked, Unggul said. “Global platforms are complying,” he said. “Even if not yet fully.” Part of the reason for the changes is the legal machinery Indonesia already has in place, including a regulation passed in 2020 that obliges platforms to act on government takedown orders within tight deadlines, as short as four hours in urgent cases. “The government has also taken the issue directly to headquarters,” Unggul said, noting that the communications minister met representatives from Meta’s global public policy and safety leadership team in New York last month to push for faster deactivation of underage accounts. “Child protection is hard to oppose publicly, so resisting it carries a high reputational cost,” he added. Still, Indonesia’s proposed fine framework has yet to be legally codified and many question marks remain over how it will ultimately be implemented. Unresolved issues include how to collect fines from companies with no local assets, how to accurately verify global revenue “and what due process exists when the same ministry writes the rules, judges compliance and imposes the sanction”, Unggul said. Blocking sites, meanwhile, “hurts Indonesian users more than the companies”, he said. “And the government can order [content] removals, but it still has little visibility into how the platforms are actually designed.” The threat of high fines could push platforms to invest more in safety-by-design and high-privacy defaults for children, said Indriyatno Banyumurti, executive director of ICT Watch, an Indonesian civil society organisation focused on digital literacy. But he warned that legal clarity and consistent enforcement were key, stressing that child safety “should not depend solely on voluntary corporate commitments”. Indriyatno said much would depend on how violations were defined, how compliance was monitored, how evidence was assessed and whether sanctions could be applied fairly and consistently. Regional rules Indonesia’s social media ban may have been Southeast Asia’s first, but it is far from alone in trying to make Big Tech take responsibility for children’s safety online. In Malaysia, rules in force since June now bar under-16s from opening or maintaining social media accounts and require platforms to verify users’ ages. Companies that fail to comply face fines of up to 10 million ringgit (US$2.5 million), with further penalties for ignoring regulatory directives. Vietnam is considering a draft decree that would limit under-16s to a view-only mode of social media, preventing them from posting content, commenting, sharing or reacting to other posts. Accounts would have to be registered using a parent or guardian’s details under the proposed rules, with platforms compelled to block age-inappropriate material and place caps on children’s online gaming time. The Philippines’ approach has been more piecemeal. It already legally forces internet providers to block child sexual abuse material or face heavy penalties and has used regulatory pressure to squeeze direct concessions from platforms. Lawmakers are also considering introducing age limits and other measures. In August, Meta and Roblox agreed to strengthen age checks, parental controls and content takedowns following talks with Philippine authorities over child safety and online radicalisation. A spate of school shootings this year also spurred officials in Manila to order Reddit and Discord to appoint local representatives to coordinate on online threats. Discord was briefly blocked before agreeing to cooperate. Singapore requires social media giants to shield users, including children, from harmful material under its Online Safety (Miscellaneous Amendments) Act that came into effect in 2023, with non-compliance carrying a financial p