The Regulation on the Provision of Child-Specific Segregated Services and Age Verification by Social Network Providers (“Regulation”), prepared by the Cyber Security Presidency, was published in the Official Gazette dated 10 October 2026 and numbered 33396, and will enter into force on 1 November 2026.
Key Obligations Introduced
- Social network providers will be prohibited from providing services to children under the age of 15. Children aged 15 and above may only be provided with segregated services appropriate to their age and level of development.
- Mandatory age verification using an age verification token obtained through the e-Devlet Gateway will be required at the account creation stage. The token will contain only information confirming whether the relevant age threshold has been met and will not involve identity verification or the sharing of any other personal data.
- Default privacy, notification and interaction restrictions will be mandatory for children’s accounts, including private account settings, a prohibition on live streaming, screenshot restrictions, and prohibitions on profiling and personalised advertising.
- Social network providers will be required to offer parents accessible parental control tools in Turkish that enable effective control over matters such as account settings, spending limits and usage time.
- Existing accounts must undergo age verification at least once by 31 March 2027. Accounts found to be non-compliant will be closed or made subject to the segregated service requirements.
Appeal Mechanism and Sanctions
Social network providers are required to establish a free and accessible application and appeal mechanism, with a Turkish-language option, to ensure the prompt resolution of applications and appeals concerning age verification results, account suspension or closure, and measures implemented as part of segregated services. Applications and appeals may not be reviewed entirely by automated systems and must be subject to meaningful human review. Content and personal data associated with the relevant account may not be deleted until the application or appeal has been resolved. Applicants must also be informed of their right to lodge a complaint with the Cyber Security Presidency (“Presidency”) and to seek judicial remedies against the outcome. In addition, social network providers are required to report annually to the Presidency, and publish on their own websites, data regarding the number of applications and appeals, acceptance rates, and average resolution times.
In the event of non-compliance with the obligations set out under the Regulation, sanctions may be imposed pursuant to the relevant provisions of Additional Article 4 of Law No. 5651 on the Regulation of Publications on the Internet and the Prevention of Crimes Committed through Such Publications. Before imposing a sanction, the social network provider will be notified of the non-compliance and granted a reasonable period to remedy it, depending on the nature of the violation. The severity and duration of the violation, the number of children affected, and the social network provider’s good-faith compliance efforts will be taken into account when determining the sanction.
Social network providers operating in Türkiye are advised to review their age verification, segregated service and parental control processes before the Regulation enters into force.
