Turkey's Cyber Security Presidency regulation, in force since 1 November 2026, bars social network providers from serving children under 15 and ties age checks to a state-issued e-Devlet token

Where the regulation comes from and whom it covers

The Resmî Gazete page of 10 October 2026 prints the regulation under the heading Yönetmelik with the line Cumhurbaşkanlığı (Siber Güvenlik Başkanlığı)'ndan, which is how the issuing body appears. The text defines Başkanlık as the Siber Güvenlik Başkanlığı and ends by saying the Cyber Security President executes it. We rendered the body name in English ourselves.

Art. 3 rests the regulation on Law 5651 on regulating internet publications, additional art. 4, paragraphs seven, twenty and twenty-five. Art. 2 covers social network providers accessible from Turkey, domestic or foreign, their users, and the separate service for children who have turned 15. Art. 4 defines a child as anyone under 18, and a social network provider as a person that lets users create, view or share text, images, sound or location content for social interaction.

Age verification and the e-Devlet token

Art. 5(1) says a social network provider cannot serve children who have not turned 15. Art. 6(2) obliges the provider to verify a user's age at account creation with an age verification token. Account-opening requests from children found to be under 15 are refused, and the accounts of children found to be 15 or over (art. 4 defines a child as anyone under 18) go into the segregated service (art. 6(4)).

Art. 7 sets out the token. Verification is done through e-Devlet Kapısı, the state portal, by a service offered by the Presidency. The token carries only whether the user has turned 15 and, if so, whether 18, and no other personal data, and does not carry the user's platform username or anything that lets third parties identify the user. The user uploads the token to the platform, the provider first confirms it was created by the Presidency through e-Devlet and then reads the age group from it, and the provider cannot use the token for anything other than age verification. Non-resident visitors in Turkey for a short stay are exempt from the checks but can apply for an exceptional token using passport data.

After the token check, the provider runs its own single or layered age methods for as long as service continues (art. 6(3)). If there is reasonable suspicion that a verified account is being used outside its age band, the provider suspends it, and the token has to be presented again before it is used. Art. 5(5) says methods, their reliability and algorithm structures, and the provider's policies for the child service are to be presented in a clear, understandable, auditable and testable way to users, parents and the Presidency, and art. 5(6) asks for non-discriminatory design and accessibility.

What the service for 15 to 17 year olds looks like

Art. 8 says providers separate their service for users found to be 15 or over but still children, taking account of their age and best interests. Defaults are high privacy settings with minimum data processing (art. 8(2)); contracts, settings and data policies are presented in a form the child can understand (art. 8(3)); and content filtering and recommender settings that reduce exposure to harmful content are applied (art. 8(4)).

Art. 8(5) is the detailed list for these accounts. It bars services that may create an addictive effect; makes accounts private by default with no public option; hides follower and following lists from others; lets only accounts the child follows send messages, with no read receipts; bars syncing with phone books, contact lists and similar sources and bars friend suggestions built on third-party contact data; requires technical steps against screenshots of the child's profile photo, posts and images; bars live streaming; bars interfaces that deliver visual content in sequence by scroll, tap, click or automatically; and bars customising accounts to the child's behaviour, profiling, or personalised commercial advertising aimed at the child's personal data.

The measures taken are to be published on the provider's own website (art. 8(6)), and the Presidency may set procedures for applying the article (art. 8(7)).

Parental tools, appeals and reporting

Art. 9 requires clear, usable parental control tools, available to parents and guardians, covering at minimum control of account and feature settings, parental consent and spending limits for purchases and paid memberships, and monitoring and limiting of usage time and location sharing. They are to include a Turkish language option, be easy to find and switch on, work across devices and operating systems, tell the child when they are enabled, and be built to protect privacy rather than monitor. Providing them does not remove the duty to run the segregated service (art. 9(1)).

Art. 10 requires a free, accessible appeals mechanism with a Turkish language option for objections to an age verification result, an account suspension or closure, and measures within the segregated service. Art. 10(3) says an application or appeal cannot be reviewed by fully automated systems and is subject to meaningful human review. Content and personal data on the account are not deleted until the appeal ends (art. 10(4)), the notice of the outcome says a complaint can be lodged with the Presidency and that court action is open (art. 10(5)), and providers report the number of appeals, the acceptance rate and the average time to resolve them to the Presidency each year and publish them (art. 10(6)).

Deadlines and enforcement

Art. 13 puts the regulation into force on 1/11/2026. Gecici madde 1 requires providers, by 31/3/2027, to verify existing accounts that were opened before the regulation and not verified by token, at least once, under art. 7. Accounts found to belong to someone under 15 are closed after notice, with their data deleted once any appeal is concluded or at once if no appeal is made. Accounts of 15 to 17 year olds move into the art. 8 service.

Art. 11 says that where obligations in the regulation are not met, the sanction provisions of additional art. 4 of Law 5651 apply, including for notification, objections and lifting. Before any sanction the provider is told of the breach and given a reasonable period to remedy it depending on its nature. In setting the sanction, the text lists the seriousness and duration of the breach, the number of children affected and the provider's good-faith compliance efforts.

Our reading, marked as inference: the regulation is already in force, so for a platform serving Turkey the practical gap is likely the token integration and the art. 8(5) product changes, and the guide the Presidency is to prepare under art. 12 will probably matter to how the token is implemented. The text we read gives no date for that guide.

What we did not verify

We opened the Resmî Gazete PDF for 10 October 2026 (no. 33396, file 20261010-15), a scanned image of six pages. The text layer holds only the masthead, so we first read the body from a scraping tool's optical-recognition output, which has spelling errors, and then checked the heading and arts. 5 to 14 and geçici madde 1 against page images of the PDF itself. The Cyber Security Presidency heading and the art. 10(3) quotation match the images.

We did not read Law 5651 or its additional art. 4, so we cannot say what sanctions, fines or access restrictions the Presidency can apply or how they are set. We did not see the Presidency's token guide under art. 12 or any procedure under art. 8(7), any technical specification of the e-Devlet service, or any announcement by the Presidency or by platforms about implementation. We did not check whether the regulation has been challenged.

We do not claim how any named platform is affected, how many accounts the 31/3/2027 verification reaches, or that the age token design is compatible with any foreign privacy law. Our description of the Presidency in English is our rendering of the Turkish name.

Related briefings

• Europe AI regulation hub
• Turkey: KVKK amendment on AI deepfakes and platform liability
• UAE: Cabinet Resolution 106 on child social media and age verification
• Mongolia: children's social network bill and AI labelling
• AI Regulation News hub