Any Turkish product that lets users post reviews, comments, images, listings or game content is a hosting provider under Law No. 5651 on the Regulation of Internet Publications, and many are also “social network providers” with a much heavier set of duties. Turkish law, like the EU, does not require platforms to monitor everything users upload, but removal deadlines are counted in hours and the framework keeps changing: social network rules arrived in 2020 and were expanded in 2022, the Constitutional Court struck down the main personal-rights route in Article 9 with effect from October 2024, and in 2026 the enforcement authority moved and new child-protection duties took effect. This article explains the hosting provider’s position, the current blocking routes, the social network layer, and how all of this compares with the EU Digital Services Act (DSA).
The hosting provider: no general monitoring, but removal on notice
Law No. 5651 defines a hosting provider (yer sağlayıcı) as a natural or legal person that provides or operates the systems hosting services and content (Article 2(1)(m)). Article 5(1) sets the baseline: a hosting provider has no obligation to check the content it hosts or to investigate whether there is unlawful activity. Article 5(2) adds the counterweight: once notified in accordance with the Law, it must take unlawful content down. The Law also defines a “warning method” (uyarı yöntemi) in Article 2(1)(r): a person whose rights are infringed first notifies the content provider and, if no result is obtained within a reasonable time, the hosting provider, through their contact addresses. A hosting provider must also keep traffic data for between one and two years as set by regulation (Article 5(3)), and failing to notify the authority of its hosting activity or to comply with the Law is subject to administrative fines (Article 5(6)).
In practice this means a platform needs a visible contact channel, a process for handling complaints, and the ability to act on official decisions within hours. It does not mean filtering everything in advance.
Removal and access-blocking routes after the 2020 to 2026 changes
Three routes are currently in force, and one has disappeared. A practical consequence of Law No. 7590 (Official Gazette of 31 July 2026, No. 33326, in force on publication) is that most functions previously exercised by the Information and Communication Technologies Authority (BTK) under Law No. 5651, including access-blocking and social network oversight, now sit with the Cybersecurity Presidency (Siber Güvenlik Başkanlığı), whose head is the “Başkan” referred to in the Law.
| Route | Grounds | Who decides, and how fast |
|---|---|---|
| Article 8 | Sufficient suspicion of listed crimes: incitement to suicide, child sexual abuse, facilitating drug use, supplying substances dangerous to health, obscenity, prostitution, gambling, crimes against Atatürk, illegal betting, and (since 2022) certain intelligence-law offences | Judge, court, or in urgent cases the prosecutor (judicial approval within 24 hours); the Başkan may order access-blocking ex officio for these crimes. Compliance within four hours. |
| Article 8/A | Right to life, security of life and property, national security, public order, prevention of crime, public health | Judge or, where delay is harmful, the Başkan on request of the Presidency of the Republic or relevant ministries; judicial approval sought within 24 hours, decided within 48 hours. Compliance within four hours. |
| Article 9/A | Violation of privacy | Application to the Presidency, implemented within four hours; the applicant must bring it before a criminal judgeship of peace within 24 hours, which decides within 48 hours. |
| Article 9 (annulled) | Formerly personal rights | Annulled by the Constitutional Court (decision of 11 October 2023, E. 2020/76, K. 2023/172), effective 10 October 2024. |
Two features run through all routes. Blocking is to be applied at URL level where possible, with whole-site blocking only if URL blocking is technically impossible or ineffective (Articles 8(17) and 8/A(3)). And the Constitutional Court’s 2023 decision also removed the Başkan’s power to order content removal (as opposed to access-blocking) ex officio under Article 8(4). With Article 9 gone and no replacement provision enacted as of November 2026, personal-rights claims that are not about privacy must, in our reading, be pursued through general civil and criminal procedures, alongside the warning method and, for large social networks, the application channel in Additional Article 4; we review how that works in practice in our article on content removal and access-blocking.
Social network providers: the extra layer in Additional Article 4
A “social network provider” is a person enabling users to create, view or share text, images, sound or location content for social interaction (Article 2(1)(s)). Additional Article 4, introduced in 2020 and expanded in 2022, applies mainly to those with more than one million daily accesses from Türkiye. Its core duties are:
- a representative in Türkiye for foreign-based providers; a natural-person representative must be a Turkish citizen resident in Türkiye, and above ten million daily accesses the representative must be fully authorised and, if a legal entity, a branch set up by the provider as a capital company;
- a reasoned positive or negative reply to individuals’ applications within 48 hours; since 1 November 2026 this is no longer limited to privacy and personal-rights content;
- six-monthly reports in Turkish on removal decisions and applications, including information on algorithms, advertising policy and transparency, plus a public advertising library;
- measures to host Turkish users’ data in Türkiye, and a crisis plan for emergencies affecting public security and health;
- liability for damages if content found unlawful by a judge or court is not removed within 24 hours of notification, without the claimant first having to sue the content provider; and direct liability for crimes committed through hashtags or featured content not removed within four hours of notification.
Law No. 7578 added further duties from 1 November 2026: no service to children under 15, with age verification; separate services for children aged 15 and over; parental control tools; measures against deceptive advertising; and, above ten million daily accesses, implementation of urgent Article 8/A decisions within one hour and measures to stop removed content from being republished. We cover these in our article on the under-15 ban and our note on the age verification regulation. Sanctions escalate from administrative fines to a ban on Turkish advertisers placing new advertising and court-ordered bandwidth throttling of up to 90 percent, and for certain duties fines of up to three percent of global turnover. Game platforms have a parallel regime under Additional Article 5, explained in our gaming platform compliance guide.
How this compares with the EU Digital Services Act
The DSA (Regulation (EU) 2022/2065), applicable in full since 17 February 2024, starts from the same principle. Article 6 exempts hosting providers from liability for stored information if they lack actual knowledge of illegality and, once aware, act expeditiously to remove it; Article 8 prohibits general monitoring obligations. The differences lie in the mechanics.
| Topic | Türkiye (Law No. 5651) | EU (DSA) |
|---|---|---|
| Trigger for removal | Judicial or administrative decisions, the warning method, social network applications | Any notice allowing a diligent provider to identify illegality without detailed legal examination (Art. 16(3)), plus authority orders (Art. 9) |
| Deadlines | Fixed: four hours, 24 hours, 48 hours, one hour for the largest networks | “Expeditiously”, “timely”, “without undue delay” |
| User safeguards | Reasoned reply to applications; reporting to the authority | Statement of reasons to affected users (Art. 17); internal complaints for online platforms (Art. 20) |
| Local presence | Representative for foreign providers above one million daily accesses; above ten million, a fully authorised representative (a branch, if a legal person); data localisation measures | Legal representative for non-EU intermediaries (Art. 13); no data localisation |
| Largest services | Thresholds by daily access from Türkiye | 45 million average monthly active EU recipients (Art. 33); Commission fines up to 6 percent of turnover (Art. 74) |
A platform serving both markets can usually run one notice-and-action system, but it must be configured for the Turkish clocks and the Turkish authority’s channels, and it should record the legal basis of each Turkish decision separately from DSA notices. Where users upload items or mods inside a game or app, the ownership questions in our article on user-generated content sit alongside these liability rules.
Where to start
- Map your services: hosting provider only, social network provider, game platform, or more than one; count daily access from Türkiye against the one and ten million thresholds.
- Publish a contact channel that works for the warning method and for official notifications, and staff it so that four-hour deadlines can be met around the clock.
- Implement URL-level removal and geo-restriction tools, and log each decision with its legal basis, time received and time executed.
- If you are a social network above one million daily accesses, check the representative, reporting, data localisation and 48-hour reply processes, and the under-15 and parental control duties in force since 1 November 2026.
- If you also operate in the EU, align the Turkish workflow with your DSA notice, statement-of-reasons and complaint systems rather than running two separate teams.
Frequently asked questions
Must a Turkish platform pre-screen user content?
No. Article 5(1) of Law No. 5651 states that a hosting provider is not obliged to check the content it hosts or investigate unlawful activity. The duty arises on notification: the provider must remove unlawful content once notified in accordance with the Law, and must comply with judicial and administrative decisions within the statutory deadlines, typically four hours.
Can someone still get content blocked for defamation under Article 9?
Not through Article 9. The Constitutional Court annulled it by its decision of 11 October 2023, effective 10 October 2024. Privacy violations can still go through Article 9/A, and the catalogue crimes and public-order grounds through Articles 8 and 8/A. Other personal-rights claims, in our reading, now rely on general civil and criminal procedures.
Which authority enforces Law No. 5651 now?
Since Law No. 7590 of July 2026, most functions previously carried out by the Information and Communication Technologies Authority under Law No. 5651, including access-blocking and social network oversight, are assigned to the Cybersecurity Presidency (Siber Güvenlik Başkanlığı), and the “Başkan” in the Law is its head. The Law’s references to the former authority for these functions have been amended accordingly.
Does complying with the DSA mean we comply in Türkiye?
Not automatically. The principles match, but Law No. 5651 sets fixed hour-based deadlines, local representation and data localisation duties for large social networks, and Turkish-specific grounds such as the Article 8 crimes list. A DSA-compliant system is a good base, but it needs Turkish channels, clocks and records.
If you are on the other side, as a company whose reputation is affected by user content, see our guides on complaint sites and online reviews and on content hosted on foreign platforms.
Sources. Law No. 5651 on the Regulation of Internet Publications (Articles 2, 5, 8, 8/A, 9, 9/A, Additional Articles 4 and 5), as amended by Laws No. 7253 (2020), No. 7418 (2022), No. 7578 (Resmî Gazete 1.5.2026, No. 33240, in force 1.11.2026) and No. 7590 (2026); Constitutional Court decision of 11.10.2023, E. 2020/76, K. 2023/172; Regulation (EU) 2022/2065 (Digital Services Act), Articles 6, 8, 9, 13, 16, 17, 20, 33, 74 and 93.
This article is general information and not legal advice; a specific situation should be assessed with counsel.
Author
More from Vircon Insights
Selling Online in Türkiye: ETBİS Registration, Law 6563 Duties and the Marketplace Thresholds a Growing Platform Will Hit
October 16, 2026Who Owns the Sword? Virtual Items, User-Generated Content and Mods Under Turkish Law
October 24, 2026Removing Content from Google, Meta and X from Türkiye: What a Turkish Order Achieves and Which Foreign Channels Work
November 13, 2026Financing Company Licence in Türkiye for Lending and BNPL Fintechs: Law No. 6361 Requirements, Process and Alternatives
November 13, 2026Hiring Your First Employees in Türkiye as a Foreign-Owned Company: Labour Law No. 4857 and Severance (Law 1475 Art. 14)
November 11, 2026Entering Türkiye as a Foreign Company: Subsidiary, Branch or Liaison Office (TCC Art. 40, KVK Art. 3, Law 4875)
November 10, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Gaming & Esports Law
Studio funding rounds, chain of title, publishing and platform agreements, esports.
View service →ICOs, Crypto & Blockchain
Crypto-asset regulation, token offerings, exchange and custody licensing.
View service →