Casual images taken in public spaces are now searchable data, raising new questions about consent and personal rights
Early on Sunday morning, Jalan Jenderal Sudirman in Jakarta is full of runners, cyclists, and families enjoying the city’s weekly car free day. Along the roadside, dozens of photographers with professional cameras quietly capture participants as they pass, often without their notice or any interaction. These are not just hobby photographers. In a single morning, photographers like these can take thousands of images, later uploading them to online platforms, like FotoYu. Individuals might end up with multiple photos of themselves online without ever knowing they were photographed.
Facial recognition technology allows members of the public to search for images of themselves in the platform’s database by uploading a selfie. Photos are displayed as blurred, watermarked or low-resolution previews. To access high resolution versions, users must typically pay between Rp.9000 to Rp.100,000 (A$1-9).
Street photography has long been part of urban life in Indonesia. Roaming photographers have often been staples at popular landmarks like the National Monument, Monas, where they capture everyday moments or offer professional portraits, printing images on the spot for a small fee. New online platforms have created a way for photographers to easily monetise candid images taken in public spaces without even having to interact with their subjects. Some photographers report earning up to Rp.3 million per day from high-traffic events, but this practice sits in uncertain legal and ethical territory.
Legal and ethical considerations
Under Indonesian law, photographs are protected under the 2014 Copyright Law. The law recognises photographs and portraits as protected works (Article 40) and provides the photographer with the right to reproduce, publish, and commercially exploit their work (Article 9). In general, a photograph taken in a public space is protected as the photographer’s work. However, this right is not absolute. The Copyright Law also includes protections for portrait photography. Article 12 prohibits the publication or commercial use of portrait photographs without the written consent of the person depicted, or their heirs if the person has died.
The law defines portraits simply, as ‘a photographic work with a human subject’. In the context of online photo platforms, if identifiable photographs are uploaded and offered for sale without the knowledge of the individuals depicted, the required consent has not been obtained. The use of blurred images before payment by some platforms may be an attempt to skirt this question of consent. However, people can still be recognised, and the images are being used for commercial purposes without the knowledge of the subjects.
The use of facial recognition technology adds a further layer of complexity. Indonesia’s 2022 Personal Data Protection Law describes facial data as ‘biometric personal data’ (Article 4(2)). The collection and processing of such data also requires the consent of the data subject (Article 20(2)). Online platforms that store and analyse facial images may be understood as processing personal data and therefore acting as ‘data controllers’ under the Data Protection Law, which carries certain obligations. The absence of consent therefore raises questions under both copyright and personal data protection law.
The Personal Data Protection Law imposes significant consequences for unlawful data processing. These include the suspension of business activities, fines, and in the most serious cases, imprisonment and fines of up to Rp.6 billion.
Beyond the legal concerns with this practice, there are also ethical concerns related to the lack of transparency in how biometric data is processed. Online photo platforms may also function as repositories for AI training data, where images uploaded by users may be collected through automated web scraping or accessed by programming tools. Without explicit and meaningful consent, such data may be used for machine learning purposes, often leading to ‘function creep,’ where data is used beyond its original purpose.
Do members of the public have any options?
If individuals find their photos online without consent, there are steps they can take. First, platforms usually provide a process for individuals to request that their images be taken down. Beyond calling on the platforms to act, both copyright law and personal data protection law offer a legal basis for individuals to challenge the use of their images without consent.
For example, Articles 43 and 44 of the Personal Data Protection Law recognise the right of data subjects to request the deletion of their personal data if it has been processed unlawfully or when they revoke consent. If such requests are not fulfilled, complaints may be submitted to the Ministry of Communication and Digital Affairs, pending the establishment of an independent personal data protection supervisory authority. Data controllers may face administrative sanctions, including orders to delete data, suspension of activities, and financial penalties.
The complaints mechanism under Indonesia’s data protection framework is being used more actively, but numbers of complaints are still low given the size of the challenge. The Ministry reported receiving 342 personal data protection complaints in 2025, 41 per cent of which involved alleged violations.
The reality is that many people may not be aware of their rights when their visual and biometric data is misused. A 2022 survey by Indikator Politik Indonesia found that around 75 per cent of respondents were not aware of the existence of the Personal Data Protection Law.
As yet, there have been no clear legal cases in Indonesia dealing with street photography without consent. Cases from other jurisdictions highlight how contested these issues can be. For example, Facebook faced legal challenges in the United States over its use of facial recognition technology to scan and identify individuals in photographs without their consent, raising broader concerns regarding biometric privacy and the limits of technological surveillance. At the same time, a well-known US case, Nussenzweig v. DiCorcia, found that a street photograph taken without consent could still be protected as artistic expression.
While attitudes toward photography and personal data in Indonesia have historically been relatively relaxed, not everyone is comfortable having their image captured and made searchable online for commercial purposes.
As facial recognition becomes more common in everyday life, it is important the public is made more aware of their rights, and that regulators give greater scrutiny to the legal and ethical concerns associated with public photography.
Hardiana Clarisa (hardianac@gmail.com) is an Indonesian lawyer specialising in intellectual property law. She is particularly interested in researching and writing about artificial intelligence, technology law, and the legal implications of emerging digital technologies.
