Withdraw consent in Indonesiaand there is no plan B

Indonesia shut the escape route that let controllers switch lawful basis after a withdrawal, and added a test that consent itself must pass.

Consent and withdrawal in Indonesia swipe

Practitioner(notes) No. 08 · August 2026

Consent without the escape hatch

2023 draftConsent with an escape hatchDraft Pasal 104(2) let you keep processing after a withdrawal if another lawful basis applied.Rules governed how to ask for consent but never said what made the consent itself valid.A mandatory duty to identify users reached any service directed at or accessible by children.

PP 33/2026Consent that has to holdPasal 92 deletes the exception and adds verification plus a duty to confirm that processing stopped.Pasal 32(2) requires consent to be free conscious specific and unambiguous.Pasal 38(1) drops the child access trigger and ties the duty to your stated purpose.

Read against the draft implementing regulation it replaced.

Consent and withdrawal in Indonesia 2 / 6

Practitioner(notes) No. 08 · August 2026

Concerns and observations

No exit from consent once collectedPick consent and you are committed to it. When a subject withdraws you stop and you confirm to them that you stopped.
Age assurance lost its triggerThe duty survives but nothing triggers it any more on services children reach in practice. It now turns on whatever purpose the controller states for itself.
A valid flow can still failPassing the mechanism rules is no longer enough. Bundled purposes and pre-ticked boxes fail the new quality test on their own.

Consent and withdrawal in Indonesia 3 / 6

Practitioner(notes) No. 08 · August 2026

Europe closed this door first

aligned

EDPB guidance already tells controllers in the EU that they cannot swap out of consent once it is withdrawn, so this change moves toward European practice rather than away from it.

EDPB Guidelines 05/2020 say at paragraphs 122 and 123 that a controller which relied on consent must stop when it is withdrawn and cannot swap to another lawful basis, because the basis must be settled before collection.
GDPR Article 7(3) lets the subject withdraw at any time and makes withdrawal as easy as giving consent. Processing already done on that consent stays lawful, and the controller must stop from then on.
C-61/19 puts the burden on the controller to show the subject consented by active behaviour. C-252/21 adds that the controller must tell the subject the legal basis at collection, so the basis is on the record from the start.

EDPB Guidelines 05/2020C-61/19 Orange RomaniaC-252/21 Meta Platforms and BundeskartellamtEDPB and CJEU, cited from the stored corpus

Consent and withdrawal in Indonesia 4 / 6

Practitioner(notes) No. 08 · August 2026

What to change first

Fix the basis at collectionRecord the lawful basis when you collect and stop planning to switch later. Pasal 92 leaves no route back once consent is withdrawn.

Re-test every consent flowRun each flow against the four qualities in Pasal 32(2) and note which design feature evidences each one. Unbundle the purposes and remove anything pre-ticked.

Keep age assurance anywayPasal 38(1) no longer compels identification on services children can reach but Pasal 38(2) still requires parental consent. Dropping the check leaves you unable to show you met it.

Consent and withdrawal in Indonesia 5 / 6

Practitioner(notes) No. 08 · August 2026

The full tracker carries every article of both instruments, side by side.

Follow for the next issue

Muhammad Deckri Algamar, LL.B, LL.M*, AIGP

Consent and withdrawal in Indonesia 6 / 6