Digital marketing and SEO agencies in Indonesia: the PDP Law, the 2026 e-commerce ad rules and what to put in the contract

To hire a digital marketing or SEO agency in Indonesia in 2026, check three things before the portfolio. First, that it handles customer data under the Personal Data Protection Law (UU 27/2022), whose two year adjustment period ended in October 2024. Second, that its ads, reviews and AI content meet Trade Minister Regulation 19 of 2026, which replaced the 2023 e-commerce rules on 8 June 2026. Third, that the ad accounts are in your company's name, billed with your NPWP. After that, judge the agency on Google, which handles more than nine in ten searches in Indonesia, and on YouTube, Facebook and Instagram.

Where Indonesian customers search and scroll

StatCounter's figures for September 2026 put Google at 92.26% of search in Indonesia, Bing at 3.05%, DuckDuckGo at 2.21% and Yahoo at 1.74%. An SEO plan for Indonesia is a Google plan first.

For social media, the same month shows YouTube sending 52.81% of the visits that social networks send to websites, Facebook 33.25% and Instagram 10.28%. These count clicks out to websites, so chat apps are not in the list. Many Indonesian sales close on WhatsApp, so ask how the agency will measure enquiries that end in a chat. Our comparison of WhatsApp marketing software explains why bulk senders cannot work inside Meta's rules.

The Personal Data Protection Law and your customer lists

UU 27/2022 on Pelindungan Data Pribadi was enacted on 17 October 2022. Article 74 gave businesses two years to adjust, so the full law has applied since October 2024. We read the text on the BPK legal database. The parts that touch marketing:

• A lawful basis for every use. Article 20 lists the bases, and the first is explicit, valid consent for one or more stated purposes. A customer list collected for deliveries is not automatically a list for promotions.
• Consent can be withdrawn. Article 9 gives people the right to withdraw consent. Article 40 then requires the business to stop processing no later than 3 x 24 hours after it receives the request.
• Breaches must be reported fast. Article 46 requires written notice no later than 3 x 24 hours to the people affected and to the data protection agency.
• Fines are tied to revenue. Article 57 sets administrative fines of up to 2% of annual revenue.

So ask where each audience list came from and whether a consent record sits behind it.

The 2026 e-commerce rules that cover online ads

Trade Minister Regulation (Permendag) 19 of 2026 on running trade through electronic systems was set on 4 June 2026 and took effect on 8 June 2026. It revoked Permendag 31 of 2023, so an agency still quoting the 2023 rules is behind. Article 32 says an electronic ad must not:

• mislead consumers about quality, quantity, materials, use or price, or about when the goods or service will arrive;
• mislead about a guarantee or warranty, or give false or inaccurate information;
• exploit an event or a person without permission.

It must also state the risks of using the product and give a clear close, skip or tutup button. An ad that shows consumer testimonials must name the person, or hold and verify their identity. Invented reviews fail that test.

Article 25 bars social commerce platforms from processing payments inside their own system. Article 47 makes businesses responsible for their use of AI: goods or services generated, displayed, recommended or promoted with AI must be labelled so consumers know, and the information must be accurate. If your agency makes ad copy or images with AI tools, ask how it labels them.

The agency itself carries a duty

Article 17 of the Consumer Protection Law, UU 8/1999, bars a pelaku usaha periklanan, the business that produces the ad, from producing misleading ads or ads that leave out the risks of use, and from keeping such an ad running. A good agency checks your claims before it publishes them.

Electronic system registration and the ITE Law

Kominfo is now Komdigi. Its Regulation 5 of 2020, amended in 2021, requires private electronic system operators, including sites and apps used to trade goods or services, to register, and Article 7 sanctions failure to register with access blocking. If your agency builds you a shop or booking app, ask who checks the PSE registration.

The ITE Law was amended again by UU 1/2024 on 2 January 2024. Comparison ads and review replies that name a person deserve a legal read first.

Paying for Google Ads from Indonesia

Google's tax help page says invoices for accounts with an Indonesian billing address are issued by PT Google Indonesia as a reseller, and that Ads sales in Indonesia carry 11% VAT. A customer that withholds 2% tax must send Google the withholding slip, the Bukti Potong, before the payment deadline. Organisation accounts need the 16 digit NPWP, which changed from 15 digits in January 2025, and individual accounts need a NIK, or Google cannot issue a valid Faktur Pajak. So when an agency quotes a media budget, ask whether VAT is included and whose NPWP is on the account. It should be yours.

SEO in Indonesia: English or Bahasa Indonesia?

Business buyers often search for agencies in English, while their own customers usually search in Bahasa Indonesia. A good SEO expert checks both in Keyword Planner, with the location set to your province, and writes each page in its audience's language.

For local search, Google says results are mainly based on relevance, distance and popularity, and that there is no way to request or pay for a better local ranking. Our guide to local SEO from the Business Profile to the map pack sets out that method.

PR, influencer and content agencies

A public relations agency sells media relations and crisis handling, while a digital agency sells ads and content. Our page on the three businesses that sell under the name PR agency helps you tell them apart. For influencer and social media work, the Permendag 19 testimonial rule and the PDP Law both apply: ask how each sponsored post is marked as paid, who verifies the claims a creator makes, and who keeps the records.

Five checks before you sign with an Indonesian agency

1. Ask for the contract first. It should name the services, the people, the reports, account ownership, the data rules and exit terms.
2. Keep the accounts in your name. Domain, hosting, Search Console, Analytics, Business Profile, Meta pages and Google Ads should belong to your company, with access granted to the agency.
3. Give read access only during an audit. Google's "Do you need an SEO?" page tells owners to grant only read access to Search Console at the audit stage.
4. Ask which 2026 rules it works to. If it cannot name Permendag 19 of 2026 or the PDP Law, keep looking.
5. Walk away from ranking promises. Google's same page says that if someone guarantees their changes will give you first place in search results, you should find someone else.

Whether the agency sits in Surabaya, Semarang, Bekasi, Yogyakarta or Manado, the checks are the same. Three cities add local rules of their own: Jakarta taxes billboards but not online ads, as our page on digital marketing and SEO in Jakarta explains; Bali caps online travel agent commission for accommodation, covered in SEO and digital marketing in Bali; and Bandung bans billboards on named streets, set out in our guide to agencies in Bandung.

How agencies in Indonesia price their work

Expect a retainer, a fixed project, a fee per influencer post or a percentage of ad spend. Compare quotes on one brief: hours, named people, line items and whether the 11% VAT on media is included.

Questions about hiring a marketing agency in Indonesia

Do we need consent to retarget website visitors in Indonesia?

The PDP Law asks for a lawful basis for every purpose, and explicit consent is the first one it lists. Show visitors what you collect and why, record the consent, and stop within 3 x 24 hours when someone withdraws it.

Are customer reviews in ads still allowed?

Yes, if they are real. Permendag 19 of 2026 requires an ad that shows consumer testimonials to name the person, or to hold and verify their identity.

Should our website be in English or Bahasa Indonesia?

Write for the person who buys. Most local customers search in Bahasa Indonesia, so local pages should be in Indonesian. English pages earn their place when you sell abroad or to visitors.

When can we judge whether the agency is doing well?

Judge it on what can be measured: the agreed work delivered, impressions and positions in Search Console, cost per enquiry in the ad accounts, and calls from the Business Profile. Google's SEO Starter Guide says "Some changes might take effect in a few hours, others could take several months," and suggests waiting a few weeks to assess the effect. The outcome depends on competition, your offer and your budget.

When an Indonesian buyer asks an assistant for an agency

A marketing manager in Jakarta can now type "agensi digital marketing yang bagus untuk brand skincare" into ChatGPT or Gemini and get three names back, with no search results page in between. The names come from the pages, directories and news the assistant can read, and the Indonesian answer can differ from the English one. AI Knows Us asks buyer questions like these on ChatGPT, Gemini, Perplexity, Claude and Google AI Overviews, and shows an agency, or a brand choosing one, who gets named and which sources the answer rests on.