10 October 2024 is the day the most widely used tool for protecting reputation online in Türkiye ceased to exist. Until that day, someone targeted by a false or degrading publication could apply to a criminal judgeship of peace (sulh ceza hâkimliği) and obtain an access-blocking order (erişimin engellenmesi) without filing a lawsuit. The provision behind that route, article 9 of Law No. 5651, was annulled in its entirety by the Constitutional Court in decision E. 2020/76, K. 2023/172, dated 11/10/2023. The decision appeared in the Official Gazette of 10/01/2024, issue 32425, and the annulment took effect nine months after publication, on 10/10/2024.
Nothing was enacted in its place. Bills to rewrite the provision have been raised, but as these lines are written none has become law. The gap itself stayed oddly invisible: much of the guidance ranking at the top of search results, law firm pages included, still sets out the old procedure as though it were live. Most carry no date; some that do are dated 2026.
So the first step with a new file is not legal analysis but a date check: does what the client believes predate 2024? If it does, every expectation built on it — who applies, to which authority, how quickly an answer arrives — is wrong from the outset.
What exactly lapsed on 10 October 2024?
The annulled provision was article 9 of Law No. 5651, the article devoted to the protection of personality rights, and it fell away as a whole. This was not a narrowing at the margins but the closing of a route: there is today no general basis on which a judge can be asked for an access-blocking order simply because personality rights have been infringed.
The same decision brought a second change, easy to miss. The phrase “removal of the content and/or” in the fourth paragraph of article 8 of Law No. 5651 was also annulled. The scope of an order issued by the Presidency of its own motion narrowed accordingly: such an order can now concern access blocking only, not removal of the content.
The difference is no technicality. It decides what the client actually ends up with. Blocking leaves the material where it is and merely makes it harder to reach from Türkiye; it lives on in a mirror hosted abroad, an archive page, a screenshot. Removal targets the source and is the only lasting remedy.
Three narrow doors that remain open
Law No. 5651 has not become inoperative. The surviving provisions work, but only for narrow and specified situations:
- Article 8 — catalogue offences. Where the content constitutes one of the offence types listed in the statute, blocking is available. A report that merely damaged commercial reputation does not, on its own, get through this door.
- Article 8/A — cases where delay is prejudicial. Where urgency of the quality the statute demands is present, the mechanism moves quickly; ordinary disputes about corporate reputation fall outside that definition.
- Article 9/A — privacy of private life. Where the content violates the privacy of private life, this route is in force and is the fastest option still standing. For material touching an executive’s home, family or health, it earns its keep.
The 9/A route has two sides. The first is institutional: under Law No. 7590 (adopted 24/07/2026, Official Gazette of 31/07/2026, issue 33326), the competent authority in the application of Law No. 5651 ceased to be the Information and Communication Technologies Authority and became the Cybersecurity Presidency. An application built on an old template knocks at the wrong door. The second concerns timing: the Presidency’s order is submitted for the approval of a criminal judge of peace within 24 hours, and the judge rules within 48 hours.
Additional article 4 of the statute allows progress through a different channel. A social network provider with more than one million daily accesses from Türkiye must answer applications made by individuals, positively or with a reasoned refusal, within 48 hours at the latest. That obligation is underrated: even a reasoned refusal, placed in the file, documents that the platform was put on notice.
The main route now runs through the civil courts
Everything outside the narrow field of articles 8, 8/A and 9/A has fallen back on the general law, and most claims about commercial reputation sit there. The competent court is the civil court of first instance (asliye hukuk mahkemesi), and the basis is articles 24 and 25 of the Turkish Civil Code (Türk Medeni Kanunu): halting, establishing and preventing an unlawful attack on personality rights. On paper the available claims look like a replacement for what was lost.
In practice they are not. Requests for interim relief (ihtiyati tedbir) are in most cases refused, and the reasoning gathers at the same point in file after file: access blocking and removal are already the relief sought in the action itself, so the outcome cannot be reached by way of an interim measure.
The gap between being right in law and seeing the content leave the screen has widened, and it coincides with the window in which reputational damage does its work. Build the file for that reality: not a thin petition resting on removal alone, but a longer case carrying the declaratory and compensation elements.
Delisting is not deletion
Where the source is out of reach, a second layer comes into play: search engines. The Board decision of the Personal Data Protection Authority dated 23/06/2020 and numbered 2020/481 sets the frame. Under that decision search engines are treated as data controllers (veri sorumlusu), and removal from the index of results returned for a search on a person’s name and surname can be requested.
The individual applies to the search engine first; if that application is refused or goes unanswered, a complaint to the Board becomes available, and the Board applies a balancing test against the criteria it has published. Knowing how data subject applications are assessed makes it easier to see which argument does the work.
This route does not remove anything; the source page stays where it is. Even so, it is the result genuinely sought in many files. When an investor, a customer or a hiring committee runs a name search, content that has dropped out of the results has become invisible.
The AI layer: who does a removal order actually bind?
Every tool described so far rests on one assumption: an address, a publisher who put it there, and a server hosting it. A removal or blocking order binds those parties. Whether the same order reaches the training data of a language model, or an answer generated for a user by an AI assistant, is a separate question, and in Turkish law that question is still open.
Saying it is open is not ignorance but an acknowledgement that the legislation has yet to speak. Whether the reasoning behind treating search engines as data controllers — collecting and processing personal data and serving it to third parties — produces the same conclusion for large language model providers is under discussion and unsettled. Any text reporting that discussion as an established rule deserves to be read at arm’s length.
Two practical observations sit alongside it. The first is evidential: an answer generated for a single user does not sit at a fixed address the way a published report does. An executive who meets such a faulty output starts with nothing in hand, so recording the screen with its date and time should be the first reflex. The second is scale: synthetic content can be reproduced faster than any remedy aimed at a single address can keep up. Hence the debate around detecting and labelling manipulated material now belongs to reputation practice.
In what order should you move on day one?
The order is an order of urgency. The first step is the record: the content, its publication date and its accessibility from Türkiye, documented through a notary determination or a court-ordered preservation of evidence (delil tespiti). Proving that something existed after it is taken down is hard, and the other side knows it.
The second step is choosing the channel. If the content violates the privacy of private life, 9/A; if it constitutes a catalogue offence, 8; if there is urgency of the quality the statute demands, 8/A. If none fits, the civil route remains and the file is built accordingly.
The third step is direct notice to the platform. For a social network provider above the threshold the 48-hour obligation to answer applies; elsewhere, the notice is how you earn the right to say later that they were aware. The fourth step is the application to the search engine. The fifth, where needed, is the action before the civil court of first instance — an instrument of outcome now, not of speed.
Before 2024, reputation management was largely a question of a petition: the right application to the right judgeship, and the rest ran mechanically. Today it is a question of sequence. Knowing which door your content fits, which channel owes you an answer within how many hours, and which step delivers a permanent rather than a temporary result recovers part of the speed that was lost. Every step taken without that knowledge — an application to the wrong authority, a screenshot never recorded, a hope pinned on interim relief — takes away what remains.
This article is provided for general information only and does not constitute legal advice. Please seek legal support for an assessment of any specific matter.
Author
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro callMore from Vircon Insights
Life After the Flip-Up: Running the Turkish Subsidiary and Moving the IP
September 9, 2026After the Flip: The Ten Mistakes Turkish Founders Make in Year One of the Delaware Topco
August 6, 2026ESOP After the Flip-Up: Migrating Turkish Option Plans into a Delaware Topco
August 5, 2026The First 90 Days of Your US Company: EIN, Bank Account and Tax Calendar
September 11, 2026Double-Trigger Acceleration: What Happens to Founder and Employee Equity in an Acquisition
September 10, 2026Incorporating for the European Market: Dutch BV, Irish Ltd and Estonia Compared
September 10, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →US Company Formations & Flip-Ups
Delaware C-Corp, flip-up structures, SAFE/convertible notes, 83(b).
View service →