Southeast Asia Streaming: Risk
Landscape for Investors

Indonesia's Ministry of Communications and Digital Affairs (Komdigi) signed PP Tunas — Government Regulation No. 17/2025 — in March 2025, with full legal force from 1 April 2025.[PS Engage] The regulation applies to all Electronic System Providers, a category that includes streaming services, and requires mandatory age verification for users under 18, parental controls, and active content moderation. Enforcement escalated immediately: by 28 March 2026, Komdigi began deactivating accounts for users under 16 on eight designated 'high-risk platforms,' with explicit signals that additional platforms could be brought into scope.[Jakarta Post] This is not pending legislation — it is operational enforcement.

Two further instruments extend the risk materially. The Omnibus Law on Culture, currently in legislative development, would require streaming platforms including Netflix, YouTube, Amazon Prime Video, Disney+ Hotstar, and HBO Max to submit content for review by the Film Censorship Board (LSF) before release — a process currently mandatory for cinema and television but explicitly excluded for OTT under Indonesia's existing Film Law (Law No. 33 of 2009).[Marketing Interactive] If passed, the compliance burden would include region-specific content edits and delayed release windows, directly affecting the simultaneity of global releases that platforms use to suppress piracy. A separately leaked Broadcasting Bill draft from March 2024 signals additional intent to consolidate digital platforms and creator content under broadcasting-style state oversight.[Repro Uncensored]

The direction is unambiguous: Indonesia is moving toward requiring streaming platforms to operate under the same content rules as broadcasters. For investors, the signal to watch is the Omnibus Law on Culture's legislative calendar. If it reaches a second reading in the DPR before Q4 2026, the compliance and content release cost implications become a near-term financial question, not a theoretical one.

Available research does not contain named legislation, enforcement actions, or pending bills for streaming platforms in Malaysia, Singapore, Thailand, or the Philippines as of 2025–2026. Each of these markets has an active regulator with clear jurisdiction over digital media: Malaysia's Malaysian Communications and Multimedia Commission (MCMC), Singapore's Infocomm Media Development Authority (IMDA), and equivalent bodies in Thailand and the Philippines. The absence of documented actions in the sources available for this report should be treated as a research gap — not as confirmation that these regulators are inactive.

Singapore's IMDA has historically maintained content classification requirements for OTT services through its licensing framework, but no enforcement actions or framework revisions from 2025–2026 appear in the research available. Malaysia's MCMC has content codes that nominally apply to digital platforms, but enforcement against streaming services is not documented here. Investors treating these four markets as unregulated relative to Indonesia may be under-estimating the latent regulatory risk — particularly as Indonesia's approach becomes a regional model.

The signal to monitor: if Malaysia or Singapore move to formalise OTT licensing requirements in line with their existing broadcast frameworks in H2 2026, the compliance burden across the region becomes multiplicative rather than single-market. No named source currently documents this as imminent — but the Indonesian precedent makes it structurally plausible within the investment horizon.

Southeast Asia's premium streaming market added 1.5 million subscribers in Q2 2025 alone — nearly double the Q1 gain — reaching over 61 million paid subscriptions across five markets.[AVIA] Netflix held 12.8 million of those, making it the clear market leader. Beyond those two figures, the publicly available picture goes dark. No major platform — Netflix, Disney+, Viu, Vidio, WeTV, or iQIYI — publishes ARPU, churn rate, or country-level subscriber counts for any of the five SEA markets covered here.

This opacity matters most for the platforms competing below Netflix. Viu and iQIYI are identified as 'strong regional competitors' in AVIA's research, but without disclosed subscriber numbers or revenue per user, the gap between 'close behind Netflix' and 'loss-making at scale' is unquantifiable from public data.[AVIA] Disney+'s decision to distribute through Telkomsel in Indonesia rather than direct-to-consumer suggests pressure on standalone subscriber acquisition economics — but Disney+ does not break out Southeast Asia from its broader international segment in public filings.

For investors, this creates a structural due diligence problem. The regional growth story is real — 19% year-on-year is not a rounding error. But in a market where ARPU is not disclosed, currency is weakening, and regulatory compliance costs are rising, growth in subscriber count is a necessary but insufficient indicator of value. The metric to demand from any platform seeking investment in this region is not subscriber count — it is ARPU trajectory by country alongside disclosed content cost as a share of revenue.

Southeast Asia's digital economy reached $300 billion in gross merchandise value by 2025, according to the Google/Temasek/Bain e-Conomy SEA report.[e-Conomy SEA] TikTok Shop alone captured 25–30% of e-commerce GMV by 2026, demonstrating the speed at which well-capitalised platforms with existing user relationships can capture share in adjacent categories.[SellerCraft] Video is the next adjacency — and the regional super-app ecosystem is better positioned to monetise it than pure-play streamers in markets where subscription fatigue is already visible.

The structural advantage held by telcos and super-apps is distribution without acquisition cost. A Telkomsel subscriber in Indonesia who adds Disney+ through their telco bill has not made a conscious streaming decision — they have extended an existing relationship. For Disney+, this solves the churn and acquisition cost problem but surrenders pricing power and customer data to the distribution partner. For pure-play streamers without telco partnerships, the implication is that subscriber acquisition costs in Indonesia and the Philippines — the two largest untapped growth markets — are rising as the easy wins have been taken.

Netflix is responding with an ad-supported tier in price-sensitive SEA markets, which signals that its standard subscription price is not clearing the market without subsidy.[AVIA] Ad-tier expansion raises revenue per user only if advertising markets are deep enough — and in Indonesia, where advertiser spending is constrained by the same macro headwinds compressing the rupiah, the ad-tier thesis depends on conditions that are currently moving in the wrong direction.

Data breach costs across ASEAN rose to an average of $3.67 million per incident in 2025, driven by attacks exploiting limited visibility in cloud environments and third-party supply chains.[Seclore] Streaming platforms are exposed across multiple vectors: content delivery relies on cloud infrastructure, payment processing runs through third-party providers, and licensing pipelines involve multiple intermediary systems. A breach at any one of these points cascades across the platform's operations.

The geopolitical dimension is active. China-nexus threat groups — including Earth Lamia and Jackpot Panda — have been documented actively exploiting web vulnerabilities in Southeast Asia's logistics, retail, and IT sectors in 2025.[Seclore] Supply chain attacks on GitHub Actions surged in 2025, with documented cases of trusted developer workflows being weaponised for backdoor deployment — a vector directly relevant to the software update mechanisms that streaming platforms push to connected TV devices and mobile apps across the region.

The operational risk for streaming platforms is not primarily a content theft risk — it is a service disruption and subscriber trust risk. A breach that disrupts content delivery during a major live sports event or premium release window causes immediate subscriber churn. A breach that exposes payment data triggers regulatory scrutiny under existing data protection frameworks across multiple SEA jurisdictions. No streaming platform has publicly disclosed a material cyber incident in SEA in 2025–2026, but the threat environment documented here is not hypothetical — it is the live attack surface for the sector.

Southeast Asia leads AI adoption by volume of new AI-focused startups and investor activity, per the Google/Temasek/Bain e-Conomy SEA 2025 report.[e-Conomy SEA] Within streaming, AI's near-term disruption is to content production economics — lower-cost local language content produced using AI tools could either help platforms meet regulatory local content requirements more cheaply, or flood the market with low-quality content that degrades platform brand value. No SEA government has yet published AI-generated content labelling requirements specific to streaming, but the absence of rules is a temporary condition, not a permanent one.

Data localisation is the second emerging pressure. Indonesia's regulatory trajectory — visible across PP Tunas, the proposed Omnibus Law, and the Broadcasting Bill — consistently points toward greater state control over digital platforms operating in-country. Data localisation requirements (mandating that user data be stored on servers within Indonesian territory) have been discussed in the context of Indonesia's broader digital sovereignty agenda, though no finalised streaming-specific mandate has been confirmed in available research. The cost implication of data localisation — duplicated infrastructure, reduced ability to centralise content delivery optimisation — is material for platforms operating regional rather than country-by-country architectures.

The APAC media streaming market is projected to reach $36.47 billion by 2033, growing at 10.07% per year from a 2025 base — a trajectory that assumes the current regulatory and competitive environment does not materially worsen.[Market Data Forecast] The risks documented in this report represent the conditions under which that projection does not hold.