Indonesia's Personal Data Protection Law requires explicit consent, or another lawful basis, before a website processes personal data, and tracking cookies such as _ga or _fbp process personal data. The law has applied in full since 17 October 2024. Its implementing regulation, Government Regulation No. 33 of 2026, was signed on 16 July 2026 and takes effect on 16 January 2027. The dedicated data protection agency the law creates had still not been formed as of October 2026.
Indonesia's PDP Law and how it applies to cookies
Indonesia enacted Law No. 27 of 2022 on Personal Data Protection (commonly called the PDP Law or UU PDP) on 17 October 2022. The law gave data controllers a two-year transition period that ended on 17 October 2024, so its obligations now apply in full.
The PDP Law does not mention cookies by name. It regulates the processing of personal data in general, and cookies that collect or store personal data fall squarely within its scope. If your website sets tracking cookies such as _ga, _fbp, or similar identifiers on visitors located in Indonesia, you are processing personal data under this law.
The law follows a consent-based model similar to the GDPR, though with some differences in enforcement structure and implementation timelines. Neighbouring Malaysia has its own framework under the PDPA 2010, as do Singapore, Thailand and Vietnam, making Southeast Asia an increasingly regulated region for website operators.
The data protection authority is still taking shape
The PDP Law mandates the creation of a dedicated Personal Data Protection Authority (Lembaga Pelindungan Data Pribadi, or Lembaga PDP). This body will handle policy formulation, supervision, enforcement, and dispute resolution, and Article 57(4) gives it the power to impose administrative sanctions.
As of October 2026, the agency has not been formed. The Presidential Regulation that would create it went through inter-ministry drafting in 2025 and harmonisation from October 2025, and in September 2026 the Ministry of Communication and Digital Affairs (Kementerian Komunikasi dan Digital, or Komdigi) said the draft had been submitted to the President for signature. Until the agency exists, Komdigi handles personal data protection supervision, incident reports and complaints.
The implementing regulation is no longer pending. Government Regulation No. 33 of 2026 on Personal Data Protection was signed by President Prabowo Subianto on 16 July 2026 and takes effect six months after promulgation, on 16 January 2027.
Consent requirements under the PDP Law
Article 20 of the PDP Law lists six lawful bases for processing personal data, closely mirroring Article 6 of the GDPR. These include consent, contractual necessity, legal obligation, vital interests, public interest, and legitimate interest.
When consent is the lawful basis, the requirements are strict. Consent must be:
Explicit - Article 20(2)(a) speaks of "explicit, valid consent" for one or more stated purposes
Informed - accompanied by information about the purpose, type of data, retention period, and data subject rights (Article 21)
Specific - tied to a defined processing purpose
Recorded - the controller must be able to show evidence of the consent given (Article 24)
Written or recorded - electronic or non-electronic, clearly distinguishable from other matters, in an understandable format and in simple, clear language (Article 22)
Pre-ticked boxes do not satisfy these requirements. Scroll-as-consent and other implied consent mechanisms are also insufficient, because consent must be explicit, and Article 22(5) makes consent that misses these conditions void.
Data subjects have the right to withdraw consent at any time. Under Article 40, the data controller must stop processing no later than 3 x 24 hours (72 hours) after it receives the withdrawal.
What this means for cookies on your website
Because tracking and analytics cookies process personal data, you need a valid lawful basis before setting them. For most cookie banner scenarios, that basis is consent.
Strictly necessary cookies - those required for basic website functionality, such as PHPSESSID or cart session cookies - may fall under a different lawful basis (contractual necessity or legitimate interest). The PDP Law does not carve out a specific exemption for these, but their processing purpose is inherently tied to the service the visitor requested.
Analytics cookies like _ga, advertising cookies like _fbp, and any third-party tracking scripts require prior opt-in consent from the visitor before activation. A cookie consent banner that blocks non-essential cookies until the visitor actively agrees is the safest approach.
Granular consent by category
The PDP Law requires consent to be specific to a stated purpose. This means bundling all cookies into a single "accept all" option without offering category-level choices is risky. Providing granular consent options - separating analytics, marketing, and functional cookies - aligns more closely with the law's purpose-limitation principle.
Penalties and enforcement
The PDP Law includes both administrative and criminal penalties, and the criminal ones depend on the offence.
| Penalty type | Maximum sanction | Details |
|---|---|---|
| Administrative fine (Article 57(3)) | 2% of annual revenue or receipts | Imposed by the agency, alongside written warnings, suspension of processing and deletion orders. The procedure is left to a government regulation |
| Unlawfully obtaining or collecting another person's personal data (Article 67(1)) | 5 years' imprisonment and/or IDR 5 billion | Where done for gain and capable of harming the data subject |
| Unlawfully disclosing another person's personal data (Article 67(2)) | 4 years' imprisonment and/or IDR 4 billion | Intentional and unlawful disclosure |
| Unlawfully using another person's personal data (Article 67(3)) | 5 years' imprisonment and/or IDR 5 billion | Intentional and unlawful use |
| Creating or falsifying personal data (Article 68) | 6 years' imprisonment and/or IDR 6 billion | Falsification for gain that can harm others |
| Corporate offences (Article 70) | Fine only, up to 10 times the maximum fine for the offence | Plus possible measures such as suspension or closure of the business |
No administrative fine under the PDP Law has been published, because the agency that imposes them does not yet exist. The absence of a dedicated regulator does not mean the law is unenforced: Komdigi receives complaints and incident reports, and the criminal provisions apply through the courts.
Once the Lembaga PDP is operational and Government Regulation No. 33 of 2026 applies from 16 January 2027, administrative enforcement has the institution and the rules it currently lacks.
How Indonesia's PDP Law compares to the GDPR
The PDP Law borrows heavily from the GDPR, but several differences stand out.
| Aspect | Indonesia PDP Law | EU GDPR |
|---|---|---|
| Lawful bases for processing | Six bases (Article 20), similar to GDPR | Six bases (Article 6) |
| Cookie-specific rules | No cookie-specific provision. General data processing rules apply | ePrivacy Directive provides cookie-specific rules alongside GDPR |
| Consent withdrawal timeline | Processing must stop within 72 hours (Article 40) | No fixed timeline. Must be as easy to withdraw as to give |
| Form of consent | Written or recorded, in simple and clear language (Article 22) | Clear affirmative act, in clear and plain language (Article 7) |
| Supervisory authority | Lembaga PDP (not yet established as of October 2026) | Independent DPAs in each member state |
| Maximum administrative fine | 2% of annual revenue | Up to 4% of global annual turnover or EUR 20 million |
| Criminal penalties | Yes, up to 6 years imprisonment | Left to member states. The GDPR itself has no criminal sanctions |
The 72-hour deadline for acting on consent withdrawal is notably stricter than the GDPR's approach. Language matters too: a consent request in simple, clear language for Indonesian visitors usually means a banner in Bahasa Indonesia.
Checklist for websites with Indonesian visitors
If your website receives visitors from Indonesia, these steps will help you align with the PDP Law.
Audit your cookies - run a cookie scan to identify every cookie your site sets, including those from third-party scripts
Classify cookies by purpose - separate strictly necessary, analytics, functional, and marketing cookies into distinct categories
Add a consent banner - display a banner that blocks non-essential cookies until the visitor gives explicit opt-in consent
Offer granular choices - allow visitors to accept or reject cookies by category rather than forcing an all-or-nothing decision
Write the banner in Bahasa Indonesia - the PDP Law asks for consent requests in simple, clear language, so consider localising your banner for Indonesian visitors using geo-detection
Record consent - maintain logs of when and how each visitor consented, as Article 24 requires evidence of consent
Enable easy withdrawal - visitors must be able to change their cookie preferences at any time, and your site must stop processing within 72 hours of withdrawal
Update your privacy policy - include the information required by Article 21: lawful basis, processing purposes, data types, retention period, and data subject rights
The global compliance hub sets out the rules for the other countries your visitors come from.
Short answers on Indonesian cookie consent
Does Indonesia require cookie consent?
The PDP Law does not mention cookies specifically, but it requires explicit consent, or another lawful basis, before processing personal data. Since tracking and analytics cookies process personal data, opt-in consent is needed before setting them on visitors in Indonesia.
What is the PDP Law in Indonesia?
The PDP Law (Law No. 27 of 2022 on Personal Data Protection, or UU PDP) is Indonesia's comprehensive data protection legislation. It regulates how personal data is collected, stored, processed, and shared, with requirements for consent, transparency, and data subject rights.
What are the fines for violating the PDP Law?
Administrative fines can reach 2% of annual revenue. Criminal penalties depend on the offence: up to 4 or 5 years and IDR 4 or 5 billion for unlawfully collecting, disclosing or using personal data, and up to 6 years and IDR 6 billion for falsifying it. Corporations face fines up to 10 times the maximum.
When does Government Regulation No. 33 of 2026 take effect?
On 16 January 2027. President Prabowo Subianto signed the regulation on 16 July 2026, and it applies six months after promulgation.
Do I need a cookie banner for Indonesian visitors?
Yes, if your website sets non-essential cookies that process personal data. The PDP Law requires explicit, informed consent before processing, making an opt-in cookie banner the most practical mechanism for websites with visitors in Indonesia.
Who enforces the PDP Law in Indonesia?
The Ministry of Communication and Digital Affairs (Komdigi) currently handles data protection supervision. A dedicated authority, the Lembaga PDP, is mandated by the law but had still not been formed as of October 2026.
Prepare your banner before the regulation applies
If you are not sure which cookies your site sets, start with a free scan. Kukie.io detects and categorises cookies, blocks trackers until visitors agree, and applies the region rules you set, so visitors in Indonesia can see a banner in their own language.
