New Regulations in Türkiye on Age Verification and Provision of Seperate Services for Children by Social Network Providers
The Regulation on the Provision of Separate Services for Children and Age Verification by Social Network Providers (the “Regulation”), published in the Official Gazette dated 10 October 2026 and numbered 33396, will enter into force on 1 November 2026.
The Regulation was issued pursuant to Additional Article 4 of Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed through Such Publications. It covers domestic and foreign social network providers accessible from Türkiye, as well as their users, and introduces obligations relating to account creation, existing accounts and platform features.
What Are the Age Thresholds?
The Regulation establishes age thresholds of 15 and 18 for the provision of services. Social network providers shall not provide services to children under the age of 15 and shall reject account creation requests submitted by such users.
Users aged 15 or above but under 18 may access separate services specifically designed for children. As the Regulation defines a child as any person under the age of 18, even if they attain legal majority at an earlier age, these protections shall continue to apply regardless of early attainment of legal majority. Users aged 18 or above shall not be subject to the restrictions applicable to children but shall remain subject to age verification when creating an account.
How Will the Age Thresholds and Verification Be Applied?
To implement these age thresholds, the use of an age verification token generated through the e-Government Gateway shall be mandatory when creating an account.
The token shall be generated at the user’s request through an online service provided by the Cybersecurity Presidency (the “Presidency”) and uploaded by the user to the relevant platform. The social network provider shall determine the user’s age group by confirming that the token was generated by the Presidency through the e-Government Gateway.
The token shall indicate only whether the user has reached the age of 15 and, if so, whether they have reached the age of 18. It shall not contain a username or any other information or data that would allow third parties to identify the user, directly or indirectly. Social network providers shall not use the token for any purpose other than age verification.
Age verification shall not be limited to account creation. Following the initial verification, social network providers shall apply single or multi-layered age verification methods of their own choosing throughout the provision of services. Where there are reasonable grounds to suspect that an account is being used in a manner inconsistent with the verified age range, the account shall be suspended, and verification using a token shall be required before it can be used again. The methods used must be reliable, verifiable, non-discriminatory and accessible to all users, including persons with disabilities. A special procedure is also provided for users who do not reside in Türkiye but are temporarily present in the country. Upon application, these users may obtain an exceptional token through an online service accessed using their passport details.
Transitional Period for Existing Accounts
A transitional period until 31 March 2027 has been granted for the age verification of existing accounts. Accounts created before the Regulation enters into force that have not been verified using an age verification token must undergo token-based verification at least once by this date. This obligation is not limited to accounts known to belong to children. Where verification establishes that a user is under the age of 15, their account shall be closed following notification, while accounts belonging to children aged 15 or above shall be subject to the rules governing separate services for children. Data relating to closed accounts shall be deleted upon completion of any application or objection procedure or, where no such procedure has been initiated, without delay. This transitional period for existing accounts does not postpone the Regulation’s general entry into force on 1 November 2026.
Provision of Separate Services
The separate services to be provided to children aged 15 or above require various changes to platform content and design. Social network providers shall take into account the best interests of the child and their physical, mental, psychological, social and emotional development, and shall implement filters and recommendation system settings to reduce exposure to content that may harm their development. The child’s age shall be taken into account in content, advertising and other services, with due regard to preventing risks of sexual abuse and commercial exploitation. Contracts, user settings and data policies shall also be presented in a manner that children can understand.
Children’s accounts shall be private by default, and no public account option shall be offered. Information on followers and followed accounts displayed in posts shall not be visible to any account other than that of the child who owns the account. Only accounts followed by the child may send them messages, and messages shall not include read receipts. Children’s accounts shall not be synchronised with address books or similar sources of contact information, matched with third parties’ contact data, or made searchable or discoverable through such data. Furthermore, children’s accounts shall not be recommended to other accounts for following, nor shall other accounts be recommended to children’s accounts for the same purpose. The processing of contact information belonging solely to a parent for account creation, verification, recovery, security and parental control purposes is excluded from the prohibition on synchronisation.
Significant restrictions have also been introduced regarding platform features. Children’s accounts shall not include live-streaming features or services that may have an addictive effect. Interfaces, designs and functions that enable visual content to be presented consecutively through swiping, tapping, clicking or similar actions, or automatically, are also prohibited. These restrictions shall apply across all interfaces through which the service is provided. Social network providers shall also take technical measures to prevent others from taking screenshots of the child’s profile photo, account, posts and images.
Regarding the protection of personal data, children’s accounts shall have high privacy settings enabled by default and shall allow only minimal data processing. Children’s accounts shall not be customised based on behaviour, and children’s personal data shall not be used for profiling or personalised commercial advertising.
Parental Control Tools
The Regulation also requires providers to offer tools that allow parents to manage their children’s account use. These tools will include mechanisms for controlling account and feature settings, requiring parental permission or approval for paid transactions, setting spending limits, monitoring and limiting usage time, and managing location sharing. The tools must offer a Turkish language option, be easily accessible and work across different devices. Children will be notified when these tools are activated. Providers must take measures to prevent the tools from being disabled without the parent’s knowledge and the necessary security verification, while ensuring that the child’s privacy is not disproportionately restricted. Offering parental control tools will not remove the provider’s obligation to offer separate services for children.
Appeal Process for Account Actions Following Age Verification
Providers must establish a free and accessible application and appeal mechanism, with a Turkish language option, to challenge age verification results, account suspensions or closures, and measures applied as part of separate services for children. Applications must not be reviewed solely through automated systems and must undergo meaningful human review. Account content and personal data must not be deleted until the process is completed. The notification of the outcome must explain the options for filing a complaint with the Presidency and seeking judicial review. The number of applications and appeals, acceptance rates and average processing times must be reported annually to the Presidency and published on the provider’s website.
Sanctions
Measures taken as part of separate services for children must also be published on the provider’s website. Failure to comply with the obligations will be subject to the relevant sanctions under Additional Article 4 of Law No. 5651. Before a sanction is imposed, the provider will be notified of the breach and given a reasonable period to remedy it, depending on its nature. The severity and duration of the breach, the number of children affected, and the provider’s good-faith compliance efforts will be considered when determining the sanction.
Conclusion
The Regulation requires social network providers to establish a framework that takes users’ age groups into account, from account creation throughout the provision of services. Providers will therefore need to review their age verification processes, platform features for children’s accounts, user policies and parental control tools before the Regulation enters into force on 1 November 2026. They must also complete token-based verification of existing accounts by 31 March 2027. The age verification token guidelines to be prepared by the Presidency will also be important for implementing the technical framework and verification process.