Kereta Api Indonesia, the state railway operator, says it is tightening how it protects passenger data as more of its ticketing and travel moves onto phones. The company says the measures include clearer data-protection policies, stricter access controls inside its systems, a process for managing cyber incidents, and plainer disclosure of what information it collects and why.

The numbers it gives are substantial. Its Access by KAI application had more than 30 million registered users and about nine million monthly active users as of the end of June 2026, and processed just over 17 million ticket transactions in the first half of the year, more than three-quarters of all sales. In the same period, 5,555,034 long-distance passengers boarded using facial recognition gates, which match a passenger's registered face to a ticket so that no document or boarding pass is needed.

Voluntary, and what that means at a station

The company is careful to say the facial recognition programme is optional. Passengers consent when they register through the application, a station kiosk or a service desk, and those who decline can still board by the ordinary route. Anne Purba, the company's vice president of corporate communication, said consent is fundamental and that alternatives remain open.

That is the correct position to state, and the practical question is what choice looks like at a crowded station at a peak hour, where the fast lane is the one that scans a face. Biometric data is also unlike a password: it cannot be reissued after a leak. The railway says it discloses retention periods in its privacy policy, but the release does not say how long the templates are kept, or what happens to them if a passenger withdraws. Those are the details a reader would need before deciding how voluntary the system really is.