From 1 November 2026, a social network provider may not offer its service in Türkiye to children under fifteen. Article 22 of Law No. 7578, published in the Official Gazette of 1 May 2026, rewrites Additional Article 4 of Law No. 5651. Providers must take measures including age verification, offer a differentiated service to children aged fifteen and over, ship parental controls and act against deceptive advertising; the largest platforms also get a one-hour clock for urgent decisions. The text draws no size line for the core child rules, so community, creator, dating, chat and edtech products should check now whether they fall inside.
Who is a “social network provider”?
The definition has been in Law No. 5651 since 2020. Under Article 2(1)(s), a social network provider is any natural or legal person that enables users to create, view or share content such as text, images, sound or location on the internet for the purpose of social interaction (in Turkish: “Sosyal etkileşim amacıyla kullanıcıların internet ortamında metin, görüntü, ses, konum gibi içerikleri oluşturmalarına, görüntülemelerine veya paylaşmalarına imkân sağlayan gerçek veya tüzel kişileri”).
Three elements do the work: user content, the purpose of social interaction, and the “internet environment”, which Art. 2(1)(g) defines as the public internet outside communication (haberleşme) and personal or corporate computer systems. In practice:
- Public feeds, profiles, comments, forums, creator pages and community spaces fit the definition comfortably.
- Dating and edtech products with profiles or peer interaction are likely in scope.
- Games with chat, guilds or user content may be caught both here and under the separate gaming platform regime (see our Law No. 5651 gaming guide and gaming platform compliance page).
- Purely private one-to-one messaging can argue the communication exclusion; that is an argument, not a safe harbour, and groups, channels or public profiles weaken it.
All providers, or only the big ones?
The drafting points to an answer. Additional Article 4 opens with a threshold: paragraph 1 applies to a “Türkiye’den günlük erişimi bir milyondan fazla olan yurt dışı kaynaklı sosyal ağ sağlayıcı” (a foreign social network provider with more than one million daily accesses from Türkiye) and triggers the local representative regime. Several other paragraphs repeat their own thresholds. The new child provisions do not. Paragraph 7 begins simply “Sosyal ağ sağlayıcı, onbeş yaşını doldurmamış çocuklara hizmet sunamaz”, and paragraphs 20 and 21 also start with “Sosyal ağ sağlayıcı” and no qualifier.
| Paragraph of Add. Art. 4 (from 1 Nov 2026) | Who it addresses | Subject |
|---|---|---|
| 1 | Foreign providers, more than 1 million daily accesses from Türkiye | Local representative |
| 3, 4, 6 | Domestic or foreign providers, more than 1 million daily accesses | 48-hour responses, transparency reports, data localisation measures |
| 7 | Every social network provider | No service to under-15s, age verification, differentiated service for 15+ |
| 20, 21 | Every social network provider | Parental controls; deceptive advertising measures |
| 22, 23 | Providers with more than 10 million daily accesses from Türkiye | One-hour rule; preventing re-publication of removed content |
On the wording, therefore, the under-15 ban, age verification, the differentiated service, parental controls and the deceptive advertising duty apply to every social network provider, domestic or foreign, regardless of traffic. Only the one-hour rule and the re-publication duty are reserved for the largest services. On this reading, a start-up with a few thousand users is not outside the child rules merely because it is small.
One caveat. The existing procedures on social network providers (ICTA Board decision published in the Official Gazette of 2 October 2020), which continue to apply until the Presidency issues its own rules, limit their scope to providers with more than one million daily accesses (Art. 2(1)) and exclude platforms where social interaction is only a secondary or ancillary service, such as e-commerce and news sites (Art. 2(4)). Those procedures predate the new child rules and cannot narrow the statute, but they show that administrative practice has so far focused on the larger tier, and the implementing rules for paragraph 7 may draw lines of their own.
The new obligations, one by one
No service to under-fifteens (para. 7). The provider “may not offer services to children who have not completed fifteen years of age” and must take the necessary measures to that end, “including age verification” (yaş doğrulama dâhil gerekli tedbirler). No method is named; a bare self-declared birth date will be hard to present as verification.
Differentiated service for 15+ (para. 7). The provider “takes the necessary measures to offer a differentiated service specific to children who have completed fifteen years of age”. Turkish law generally treats under-18s as children (for example, Child Protection Law No. 5395, Art. 3), so in practice this is the 15 to 17 cohort. The text does not list what must differ; defaults, contact by strangers, recommendations and ads are the natural places to look.
Publication (para. 7). The measures taken under paragraph 7 must be published on the provider’s own website.
Parental control tools (para. 20). Tools must be clear, understandable and usable, and must include mechanisms for (a) controlling account settings, (b) making paid transactions such as purchases, rentals and paid memberships subject to parental permission or approval, and (c) monitoring and limiting usage time. The gaming platform rule in new Additional Article 5 contains (a) and (b) but not (c); social networks carry the extra screen-time duty.
Deceptive advertising (para. 21). The provider “is obliged to take measures to block deceptive advertisements”. Law No. 5651 defines neither the term nor the measures, so document ad review, advertiser checks and reporting flows.
The one-hour rule (para. 22). A provider with more than ten million daily accesses from Türkiye must implement decisions issued under Article 8/A “in cases where delay is prejudicial” immediately and within one hour at the latest. Article 8/A decisions protect life, security of persons and property, national security, public order, crime prevention or public health; their general deadline remains four hours. Paragraph 23 adds, for the same tier, a duty to take every necessary measure so that content subject to removal or blocking decisions is not published again.
Article 22 also widens the 48-hour response duty in paragraph 3 beyond Article 9 and 9/A content, adds paragraph 23 to the transparency reports, and cuts the deadline for information requests under paragraph 18 from three months to “immediately”, within a period set by the Presidency of at most fifteen days.
What happens on breach
The sanction sits in the former paragraph 20, renumbered paragraph 24. As amended, it allows the President to impose an administrative fine of up to 3% of the provider’s global turnover in the previous calendar year for breach of paragraphs 6, 7, 13, 16, 18, 19, 20, 21 and 23. The child rules (7), parental controls (20), deceptive advertising (21) and re-publication (23) are all on that list. The one-hour rule (22) is not, and Article 22 attaches no separate sanction to it; failures to execute Article 8/A decisions remain subject to the sanctions already in Article 8/A and Additional Article 4.
Article 22 adds an escalation ladder if the obligation remains unmet:
- 30 days after notification of the fine: the President bans Turkish resident taxpayers from placing new advertising with the provider (no new contracts or payments).
- Three months after the advertising ban: the President may apply to a criminal judgeship of peace for 50% bandwidth throttling.
- 30 days after that decision is implemented: a further application for up to 90%; the judge may set a lower rate, not below 50%. Access providers implement within four hours.
- Once the obligation is met, the advertising ban is lifted and the court decisions lapse automatically.
Who enforces, and what secondary rules to expect
Law No. 7590 (Official Gazette 31 July 2026, No. 33326), Article 27(5), replaced “Kurum” with “Başkanlık” in Articles 22 and 23 of Law No. 7578, and Article 2 of Law No. 5651 now defines “Başkanlık” as the Cybersecurity Presidency. The duties are therefore supervised by the Cybersecurity Presidency (Siber Güvenlik Başkanlığı), not the ICTA (BTK); see our piece on that transfer.
The last paragraph of Additional Article 4 leaves implementing procedures to the Presidency; until it issues its own, Provisional Article 2 of Law No. 7545 (added by Law No. 7590) keeps existing regulations in force. On 19 May 2026 the Minister of Family and Social Services, Mahinur Özdemir Göktaş, said that a working group within her Ministry would set the principles for under-15 social media use and that the related regulation would be put in place within six months, and that age verification would run through e-Devlet and other methods, coordinated by the ICTA and the Presidency. As of early October 2026, we could not find a regulation or procedure on age verification for social networks in the Official Gazette. The statutory duties apply from 1 November regardless.
Age verification and KVKK
Verifying age means processing personal data, so Law No. 6698 (KVKK) applies too. Three provisions frame the design:
- Article 4 requires specific, explicit and legitimate purposes, relevant, limited and proportionate data, and retention only as long as necessary. Collect what proves the age band, not a full identity profile, and decide what is deleted after the check.
- Article 5(2) lists conditions that allow processing without explicit consent, including where it is expressly provided for by law (a) and where it is necessary to comply with a legal obligation of the controller (ç). Whether a given verification flow rests on one of these should be assessed and recorded.
- Article 6 classifies biometric data as special category data, processable only on the grounds in Article 6(3) and with the Board’s adequate measures. If a method processes biometric data (for example, some facial analysis tools), this stricter regime must be assessed.
Verification vendors and any transfer abroad need the usual processor contracts and transfer analysis. Our age assurance piece compares methods.
Where to start
- Run the Article 2(1)(s) test on each product and record the reasoning.
- Choose an age verification method and complete a KVKK review of its data flows.
- Specify the 15+ experience: defaults, contact settings, recommendations and ads.
- Build parental controls covering account settings, paid-transaction approval and usage-time limits.
- Document your deceptive advertising controls.
- Publish the paragraph 7 measures on your website.
- If you are near ten million daily accesses, test a one-hour response path for Article 8/A decisions and a re-upload control.
Do the child rules apply if we have fewer than one million daily accesses from Türkiye?
On the wording, yes. Paragraphs 7, 20 and 21 address every “sosyal ağ sağlayıcı” without the thresholds used elsewhere in Additional Article 4; only paragraphs 22 and 23 are limited to providers above ten million daily accesses. The 2020 procedures, which still apply, are limited to the one-million tier, so watch the implementing rules.
Does the law say how age must be verified?
No. It requires necessary measures “including age verification” and leaves the method open. The Presidency may set procedures, and the Family Minister has said e-Devlet will be among the methods, but as of early October 2026 we could not find any implementing text in the Official Gazette.
Which authority enforces these rules?
The Cybersecurity Presidency. Law No. 7590, Article 27(5), replaced the ICTA references in Article 22 of Law No. 7578 with the Presidency, and “Başkan” in Law No. 5651 now means the Cybersecurity President. Fines and advertising bans therefore come from the President, who also applies to the criminal judgeship of peace for throttling.
Sources. Law No. 7578, Arts. 22, 23 and 27 (Official Gazette 1 May 2026, No. 33240); Law No. 7590, Arts. 26 and 27 (Official Gazette 31 July 2026, No. 33326); Law No. 5651, Arts. 2(1)(g) and (s), 8/A and Additional Art. 4 (consolidated text); Procedures on Social Network Providers, Arts. 2 and 22 (ICTA Board decision 2020/DK-İD/274, Official Gazette 2 October 2020, No. 31262);Law No. 6698 (KVKK), Arts. 4, 5 and 6; Law No. 5395, Art. 3; Ministry of Family and Social Services statement, 19 May 2026.
This article is general information and not legal advice; a specific situation should be assessed with counsel.
Author
More from Vircon Insights
The Departing Founder's Shares: Structuring Good Leaver / Bad Leaver under Turkish Law
September 16, 2026Is a Term Sheet Binding? What a Letter of Intent Is Really Worth Under Turkish Law
September 3, 2026How SAFEs Work under Turkish Law: Discounts, Caps and the Limits of the TCC
September 2, 2026The EU AI Act in Turkish Law: A Concordance of Terms and Obligations for Providers and Deployers
October 11, 2026The Turkish Equivalent Of…: A US–Türkiye Corporate Law Concordance for Founders, Investors and Counsel
October 9, 2026MASAK Thresholds Doubled from 7 October 2026: AML Obligations for Payment, E-Money and Crypto Firms in Türkiye
October 8, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →ICOs, Crypto & Blockchain
Crypto-asset regulation, token offerings, exchange and custody licensing.
View service →Gaming & Esports Law
Studio funding rounds, chain of title, publishing and platform agreements, esports.
View service →