Türkiye’s Cybersecurity Presidency has published the regulation that puts the under-15 social media ban into practice. The Regulation on the Provision of Differentiated Services for Children and Age Verification by Social Network Providers, published in the Official Gazette of 10 October 2026 (No. 33396), enters into force on 1 November 2026. It answers three questions: how age is verified (with a token generated through e-Devlet, the state’s e-government gateway), how the service for 15 to 17 year olds must differ (no public accounts, no live streaming, no infinite feeds, no personalised ads) and what happens to existing accounts (they must be verified by 31 March 2027).
We covered the statutory framework, Additional Article 4 of Law No. 5651 as rewritten by Law No. 7578, in our note on the under-15 ban. This note focuses on what the regulation adds.
Who is covered?
The regulation applies to domestic and foreign social network providers accessible from Türkiye, and to their users (Art. 2). The definition of a social network provider is the statutory one: a natural or legal person that enables users to create, view or share content such as text, images, sound or location on the internet for the purpose of social interaction (Art. 4(1)(e)).
There is no daily-access threshold. We read the child provisions of the statute as applying to every provider regardless of size; the regulation confirms that reading. A community app with a few thousand users and the largest global platform are subject to the same rules.
How age must be verified
An e-Devlet token for every new account. A social network provider must verify the user’s age status with an age verification token at account creation (Art. 6(2)). The rule is not limited to children: adults opening an account must present a token too.
The token works as follows (Art. 7):
- The user logs in to the e-Devlet gateway and generates a token through an online service provided by the Presidency.
- The token carries two facts only: whether the user is 15 or older and, if so, whether the user is 18 or older. It contains no other personal data, no username and nothing that makes the person identifiable to third parties.
- The user uploads the token to the platform. The provider first confirms that the Presidency generated it through e-Devlet, then reads the age group.
- The provider may not use the token for any purpose other than age verification.
The platform’s own methods after onboarding. Once the token check is done, the provider runs single or layered age verification methods of its own choosing for as long as it provides the service. If there is reasonable suspicion that a verified account is being used contrary to its age band, the provider suspends the account, and it can be used again only after a fresh token check (Art. 6(3)). In practice this means monitoring signals that, for example, a child is using a parent’s account.
Principles for any method. Age verification must establish only the age threshold, not identity (Art. 5(3)). Methods must be technically robust against false statements and manipulation and produce consistent, verifiable results (Art. 5(4)); be presented to users, parents and the Presidency in a clear, auditable and testable way (Art. 5(5)); and not produce systematically discriminatory outcomes by age, sex, disability, language, appearance or similar characteristics, while remaining accessible to all users including persons with disabilities (Art. 5(6)). Facial age-estimation tools need careful assessment against this last principle and under the KVKK.
Visitors to Türkiye. Users who are not resident in Türkiye and are there temporarily are exempt from the age verification controls. To use services in Türkiye, however, they obtain an exceptional token through e-Devlet, on application, without identity authentication and using passport details only (Art. 7(1)(d)). The regulation does not separately address users outside Türkiye.
Technical guide. The Presidency will prepare a guide setting out the token’s technical structure, data format and the verification process providers must follow, and share it with providers (Art. 12(1)). Integration planning will follow that guide.
The “differentiated service” for 15 to 17 year olds
Accounts of users verified as 15 or older but under 18 are subject to the differentiated service rules (Art. 6(4)(b)). The provider applies high privacy settings by default and processes the minimum data (Art. 8(2)); presents terms, settings and data policies in a way the child can understand (Art. 8(3)); and applies content filtering and recommendation settings that reduce exposure to harmful content (Art. 8(4)). The rules with the biggest product impact are in Article 8(5):
| Item | Rule | Product impact |
|---|---|---|
| a | No service that may have an addiction-forming effect. | A general prohibition without a defined test; streaks, notifications and reward loops should be reviewed. |
| b | Accounts are private by default and cannot be offered with a public option. | Public profiles disappear entirely for 15 to 17 year olds. |
| c | Follower and following lists are visible only to the child. | The social graph is hidden. |
| ç | Only accounts the child follows may send messages; no read receipts. | No messages from strangers; read receipts off. |
| d | No syncing with phone contacts, address books or friend lists on other platforms; data obtained in breach, and any matching or recommendation records derived from it, must be deleted without delay. Processing only a parent’s contact details for account security and parental control is permitted. | Contact-finding and address-book matching must be off for this age group. |
| e | The child’s account may not be suggested to others for following, nor others to the child; no matching with third-party contact data, no making the account searchable through it, and no steering towards these functions through interface design, defaults or repeated permission prompts. | “People you may know” style suggestions end; dark patterns are expressly prohibited. |
| f | Technical measures to prevent others from taking screenshots of the child’s profile photo, account, posts and images. | Screenshot blocking in mobile apps; the technical limits on the web need separate assessment. |
| g | No live streaming feature. | Live streaming is off for 15 to 17 year olds. |
| ğ | No interface, design or function that presents visual content sequentially through scrolling, tapping or similar actions or automatically; applies to apps, websites and all other interfaces. | Infinite-scroll and autoplay visual feeds cannot be offered to this age group. |
| h | No personalisation based on the child’s behaviour; the child’s personal data may not be used for profiling or personalised commercial advertising. | Behavioural recommendation algorithms and targeted ads are off. |
The measures under this article must be published on the provider’s website (Art. 8(6)). The Presidency may set further procedures for applying Article 8 (Art. 8(7)).
Parental control tools
The provider must offer clear, understandable and usable parental control tools; offering them does not remove the duty to provide the differentiated service (Art. 9(1)). The tools are used by the persons with legal decision-making authority over the child, such as parents or guardians (Art. 9(2)). At a minimum they must cover (Art. 9(3)):
- control of account and feature settings,
- making paid transactions such as purchases, rentals and paid memberships subject to parental permission or approval, with a spending limit,
- monitoring usage time, letting the parent set and limit it, and location sharing.
The tools must be available in Turkish, easy to find and activate, work across devices and operating systems, notify the child clearly when activated, prevent the child from disabling them without the parent’s knowledge and the same security verification, and be designed so as not to remove the child’s privacy disproportionately, favouring communication and learning over surveillance (Art. 9(4)). Information on their scope and use must be published on the website (Art. 9(5)).
Appeals
The provider must set up a free and accessible complaint and appeal mechanism, with a Turkish-language option, against age verification results, account suspension or closure, and differentiated service measures (Art. 10(1)). Appeals may not be decided by fully automated systems and require meaningful human review (Art. 10(3)). Content and personal data of the account may not be deleted while an appeal is pending (Art. 10(4)). The decision notice must mention the right to complain to the Presidency and to go to court (Art. 10(5)). The number of appeals, acceptance rate and average resolution time must be reported to the Presidency annually and published on the website (Art. 10(6)).
Existing accounts: 31 March 2027
Accounts opened before 1 November 2026 and not verified with a token must be verified with a token at least once by 31 March 2027 (Provisional Art. 1). Accounts of children found to be under 15 are closed with notice; their data is deleted after any appeal is resolved or, if there is no appeal, without delay. Accounts of children aged 15 or older move to the differentiated service.
In short: from 1 November 2026 new accounts are opened with a token and the 15 to 17 rules apply; the deadline for verifying existing accounts is 31 March 2027.
Sanctions
Breach triggers the sanctions regime of Additional Article 4 of Law No. 5651 (Art. 11(1)): an administrative fine of up to 3% of the provider’s global turnover in the previous calendar year, followed by an advertising ban and bandwidth throttling (see our earlier note for the steps). The regulation adds two safeguards: before any sanction, the provider is notified of the breach and given a reasonable period to cure it (Art. 11(2)); and the sanction takes into account the gravity and duration of the breach, the number of children affected and the provider’s good-faith compliance efforts (Art. 11(3)). Documenting compliance work therefore has a direct effect on sanction exposure.
The data protection angle
The e-Devlet token is designed to carry no personal data, which greatly reduces the KVKK burden of the initial check. Law No. 6698 still applies at three points. First, once the age band read from the token is linked to a user account it is personal data; set its retention period and access rights. Second, the provider’s “own methods” during the life of the account (behavioural signals, facial analysis and the like) are a separate processing activity, subject to the proportionality and minimisation principles of Article 4 and, if biometric data is involved, to Article 6 and the Board’s adequate measures. Third, the ban on profiling and personalised advertising for 15 to 17 year olds (Art. 8(5)(h)) should be applied to data flows towards ad-tech vendors as well. For method choice, see our note on age assurance and our KVKK compliance guide.
Checklist for platforms
- Assess whether each product is a social network provider and record the reasoning; games with chat, guilds or user content should also check the gaming platform regime.
- Add the e-Devlet token step to sign-up; follow the Presidency’s technical guide and plan the exceptional-token flow for visitors to Türkiye.
- Define the additional age signals used during the life of the account, the reasonable-suspicion threshold and the suspension flow; document discrimination and accessibility testing.
- Build a separate configuration for 15 to 17 year olds: private account, hidden follower lists, message restrictions, no contact sync or suggestions, screenshot blocking, no live streaming or infinite feeds, no behavioural personalisation or targeted ads.
- Design parental controls in Turkish, across devices and tamper-resistant, including spending limits, usage time and location sharing.
- Set up a free, Turkish-language appeal mechanism with human review, and plan the annual statistics report.
- Prepare a communication and closure timetable to verify the existing user base by 31 March 2027.
- Publish the measures, parental tools and appeal routes on the website.
Frequently asked questions
Do adult users need an e-Devlet token too?
Yes. The regulation requires the user’s age status to be verified with a token at account creation (Art. 6(2)) and does not limit this to children. For an adult, the token only states that the user is 18 or older.
Will the platform learn the user’s identity?
Not from the token. It contains only the 15 and 18 age thresholds and no name, ID number, username or other identifying information (Art. 7(1)(b)). The provider may use it only for age verification.
Are small platforms covered?
The regulation covers all domestic and foreign social network providers accessible from Türkiye and sets no user or access threshold.
How long do platforms have for existing accounts?
Until 31 March 2027. Existing accounts not verified with a token by then are in breach; accounts found to belong to under-15s are closed with notice.
What is the sanction for breach?
The sanctions in Additional Article 4 of Law No. 5651 apply: a fine of up to 3% of global turnover, an advertising ban and bandwidth throttling. Under the regulation, the provider is first notified and given a reasonable period to cure.
Sources. Regulation on the Provision of Differentiated Services for Children and Age Verification by Social Network Providers, Official Gazette 10.10.2026, No. 33396, Arts. 1-14 and Provisional Art. 1; Law No. 5651, Art. 2(1)(s) and Additional Art. 4; Law No. 7578, Art. 22; Law No. 6698 on the Protection of Personal Data, Arts. 4, 5, 6.
This article is general information and not legal advice; a specific situation should be assessed with counsel.
Author
More from Vircon Insights
Türkiye Geographic Data Permits Regulation 2026: What Companies Working with Location Data Must Check
October 16, 2026Türkiye Bans Social Media for Under-15s from 1 November 2026: What Platforms Must Change (Law 7578)
October 12, 2026TCMB Writes Biometric Remote Identification into the Payment Services Regulation: What Payment and E-Money Institutions Must Change (RG 4.9.2026)
October 16, 2026Selling Online in Türkiye: ETBİS Registration, Law 6563 Duties and the Marketplace Thresholds a Growing Platform Will Hit
October 16, 2026Türkiye Extends Maternity Leave to 24 Weeks and Paternity Leave to 10 Days: What Employers Must Update (Law 7578)
October 15, 2026Your First Ten Employees in Türkiye: The Employment Law Set-Up a Startup Needs Before the Second Hire
October 14, 2026Related Practice Areas
ICOs, Crypto & Blockchain
Crypto-asset regulation, token offerings, exchange and custody licensing.
View service →Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →