Turkish Cybersecurity Directorate issues regulation on children’s access to social networks

On 10 October 2026, the Regulation on the Provision of Segregated Services for Children by Social Network Providers and on Age Verification (the “Regulation”) was published in the Official Gazette, introducing a new regulatory framework for children’s access to social networks that will take effect on 1 November 2026. The Regulation sets out requirements for social network providers on age verification, age-differentiated services, personal data protection, account security, content and advertising, parental controls and certain platform functionalities.

Under the new framework, social network providers may not provide services to children under 15. Users aged 15 to 18 may continue to access social network services, subject to enhanced privacy, security and child-protection requirements. These include mandatory age verification, restrictions on profiling and personalised advertising, stricter default privacy settings and limitations on content recommendations, messaging and certain platform features.

Age verification will principally rely on a verification token generated through the e-Government (e-Devlet) portal. Social network providers accessible from Türkiye will therefore need to review their onboarding and age-verification processes as well as the design of services offered to users aged 15 to 18. Existing accounts that have not undergone the prescribed verification must be verified at least once by 31 March 2027.

The key requirements introduced by the Regulation are outlined in detail below.

Age verification

Social network providers must implement the necessary technical and organisational measures to verify users’ ages. When creating an account, users must upload an age verification token generated through the e-Government (e-Devlet) portal following identity verification. The token will disclose only the applicable age threshold and may not contain the user’s name, username or other identifying information. It may only be used for age-verification purposes.

Account requests from children under 15 must be rejected, while users aged 15 to 18 will be subject to the Regulation’s age-differentiated service requirements. Following initial verification, providers should operate their own single or multi-layered age-verification methods. Where there is reasonable doubt that an account is being used by someone outside the verified age group, the account must be suspended and re-verification required before access is restored.

Enhanced safeguards for users aged 15 to 18

Accounts of users aged 15 to 18 must be private by default, without an option to make them publicly accessible, and follower and following information must be hidden from other users. Contractual terms, user settings and data policies must also be presented in a form that children can understand.

Children’s accounts may not be personalised based on their behaviour, and their personal data may not be used for profiling or personalised commercial advertising. Content filtering and recommendation systems must also be configured to reduce exposure to content that could adversely affect children’s development.

The Regulation also restricts certain platform features. In particular:

• direct messages may only be sent by accounts followed by the child, and read receipts must be disabled;
• children’s accounts may not be synchronised with contact lists or recommended to or from other accounts;
• technical measures must prevent screenshots of children’s profile photos, accounts, posts and images;
• live-streaming functionality may not be offered; and
• interfaces enabling visual content to continue automatically or through continuous scrolling, tapping or similar actions may not be provided.

These restrictions will require providers to review not only their privacy and data-processing practices, but also the default design and functionality of services made available to users aged 15 to 18.

Enhanced parental controls

Social network providers must offer clear and accessible parental control tools. These must enable parents or other legally authorised persons to control account and privacy settings, make purchases, rentals and paid subscriptions subject to parental permission or approval, set spending limits, and monitor or restrict usage time and location sharing.

The tools must include a Turkish-language option, be easy to access and activate, and operate across different devices and operating systems. Providers must also prevent children from disabling or removing parental controls without the parent’s knowledge and the required security verification, while ensuring that the controls do not disproportionately interfere with children’s privacy.

Application and objection mechanism

Social network providers must establish a free and accessible mechanism, with a Turkish-language option, for applications and objections relating to age-verification results, account suspensions or closures, and measures applied as part of age-differentiated services.

Applications and objections may not be reviewed exclusively through automated systems and must be subject to meaningful human review. Account content and personal data must be preserved until the process is concluded. Providers must also inform users of their right to complain to the Cybersecurity Directorate and annually report and publish information on applications and objections, including acceptance rates and average resolution periods.

Sanctions

Non-compliance may result in sanctions imposed by the Cybersecurity Directorate under Additional Article 4 of Internet Law No. 5651, including administrative fines of up to 3% of the social network provider’s worldwide annual turnover, advertising bans and restrictions on internet bandwidth of up to 90%. Before a sanction is imposed, the provider must be notified of the non-compliance and given a reasonable period to remedy it, taking into account the nature of the breach.

The severity and duration of the non-compliance, the number of children affected and the provider’s good-faith compliance efforts will be taken into account when determining the sanction.

Transitional period

The Regulation will enter into force on 1 November 2026. Existing accounts created before that date that have not previously undergone the prescribed age verification must be verified at least once by 31 March 2027.

Accounts identified as belonging to children under 15 must be closed after the account holder is informed, subject to completion of any application or objection process initiated by the user. Accounts identified as belonging to users aged 15 to 18 will become subject to the Regulation’s age-differentiated service requirements.

The Cybersecurity Directorate is also authorised to issue guidance on the technical structure and use of the age verification token and other implementation matters.

Key considerations for social network providers

With the Regulation taking effect on 1 November 2026 and the deadline for verifying existing accounts set for 31 March 2027, social network providers accessible from Türkiye should review their readiness across three key areas:

• Age verification: adapting onboarding and existing-user processes to the new verification requirements.
• Product and privacy design: identifying features and default settings that must be restricted or redesigned for users aged 15 to 18, particularly in relation to privacy, profiling, advertising, recommendations, messaging and live streaming.
• Governance and user rights: implementing the required parental controls and application and objection mechanism, while monitoring further guidance on the technical implementation of the age verification token.

Given the technical, privacy and operational changes required, early coordination between legal, privacy, product and technical teams will be important in preparing for implementation.