Indonesia Just Made Roblox Scan Children's Faces. No Other Country Has Done This.
What happened
Indonesia's PP TUNAS regulation, effective May 2026, requires all social media and gaming platforms to verify the age of users under 16 using biometric methods including facial recognition. Roblox, which has approximately 23 million child users in Indonesia out of 45 million total, is the first major gaming platform to comply. Children who do not complete facial verification lose access to chat features. Indonesia is the first country in the world to extend mandatory age verification to gaming platforms, not just social media. Roblox announced the compliance measures this week.
Indonesia has solved the child online safety problem the way authoritarian states solve problems: by making children prove their identity to a platform that then holds that biometric data. The safety is real. So is the surveillance infrastructure.
The Hidden Bet
Facial recognition age verification protects children from online harms
The verification proves age; it does not prevent harm. Children who pass verification still encounter the same content and contact risks. The mechanism creates a false sense that the problem is solved while building a biometric database of children that the platform now possesses.
This model will spread to other countries as a best practice
GDPR in Europe prohibits this approach entirely. Australia's under-16 ban, the alternative model, avoids biometrics by simply excluding the age group. The U.S. market has not adopted either approach. Indonesia may be establishing a regulatory norm for Southeast Asian markets specifically, not a global standard.
Roblox is complying because it agrees with the policy
Indonesia's market is too large to exit. Roblox has no choice. The company is also facing the New Mexico trial, which could force structural changes globally. Compliance in Indonesia is a calculated trade-off: accept one country's biometric requirement to avoid losing 45 million users.
The Real Disagreement
The real fork is between two models for protecting children from platform harms. One model is identity-based: verify who users are, restrict access by age, enforce rules on identified individuals. The other model is structural: design platforms so that exploitative features are unavailable regardless of user identity. Indonesia chose the first. Critics of the biometric approach argue that the identity model protects platforms from liability while creating child surveillance infrastructure; the structural model protects children while imposing costs on platforms. The choice of model has different political economy: platforms prefer identity-based approaches because they shift compliance costs to users and governments prefer them because they build state-adjacent data infrastructure.
What No One Is Saying
The facial scans will be processed by a third-party age verification provider whose data practices no Indonesian parent has read. Roblox collects the scan to verify age; whether it retains the biometric data, for how long, and what happens if that provider is acquired or breached is not part of the public compliance announcement. Indonesia has created mandatory biometric enrollment of tens of millions of children into private databases with no clear data retention limit.
Who Pays
Indonesian children aged 13-15
Immediately; as of May 2026
They must provide facial biometric data to a private platform or lose social features of a game they already play. The alternative is exclusion from peer interaction on a platform where millions of their peers socialize.
Families without smartphones capable of facial recognition
Immediate and ongoing
The verification requires a camera-equipped device that can perform the scan. Lower-income families may not have compatible hardware, effectively excluding poorer children while leaving wealthier children enrolled.
Other platforms in Indonesia
Over the next 6-12 months as enforcement extends beyond early movers
PP TUNAS applies to all social media and gaming platforms, not just Roblox. Smaller platforms that lack Roblox's compliance infrastructure must implement the same biometric requirements or exit the market.
Scenarios
Southeast Asian rollout
Malaysia, Thailand, and Vietnam observe Indonesia's compliance without major backlash and adopt similar PP TUNAS-style regulations. Platforms implement regional biometric verification systems. Roblox's Indonesia compliance becomes a reference document for regional regulators.
Signal Another ASEAN government passes a gaming-specific age verification law within 12 months
Data breach or misuse
A child biometric dataset from the Indonesian verification system is compromised or a third-party provider is found selling data. Indonesian Parliament moves to tighten data retention rules but the biometric compliance requirement survives.
Signal Any disclosed security incident at an Indonesian age-verification provider
Platform exit and regulatory rethink
A smaller platform chooses to exit Indonesia rather than implement biometric verification. The exit triggers parliamentary debate about whether the requirement is proportionate. The PP TUNAS requirement is modified to allow alternative verification methods.
Signal A platform with significant Indonesian user share publicly announces it cannot comply with facial scan requirements
What Would Change This
If the Indonesian government published clear data retention and breach notification standards for age verification providers, the surveillance infrastructure concern would be significantly reduced. If the EU or U.S. adopted a similar model, it would signal that biometric age verification is becoming a global norm rather than a Southeast Asian exception.
Related
Norway, Indonesia, and Australia Are Banning Social Media for Under-16s. Meta Is Threatening to Leave States That Try It.
powerTurkey Bans Social Media for Under-15s. The Global Wave Just Got Bigger.
powerThe Kids App Ban That Big Tech Will Actually Win
powerThe Social Media Ban That Already Failed