On 10 October 2026, the Regulation on the Provision of Differentiated Services for Children and Age Verification by Social Network Providers (the "Regulation") was published in the Official Gazette. Issued by the Cyber Security Presidency, the Regulation introduces mandatory age verification, restrictions on children's access to social networks and additional safeguards for users aged 15 to 17.
The Regulation applies to domestic and foreign social network providers whose services are accessible from Turkey and will enter into force on 1 November 2026.
Mandatory Age Verification
Under the Regulation, social network providers must verify users' ages when creating new accounts through an age-verification token generated via Turkey's e-Government portal (e-Devlet).
The token indicates whether a user has reached the age of 15 or 18 without disclosing their identity or other personal information. Providers must verify the authenticity of the token and determine the user's age category accordingly.
Providers must also implement ongoing age-verification measures during the use of their services. Where there is reasonable suspicion that an account is being used by someone outside the verified age category, the account must be suspended until the user completes a new verification.
The Cyber Security Presidency will issue further technical guidance concerning the structure and implementation of the verification token.
Restrictions on Access and Differentiated Services for Children
The Regulation prohibits social network providers from offering services to children under the age of 15. Account registration requests from users below this threshold must be rejected, and existing accounts belonging to such users must be closed.
Users aged 15 to 17 may continue accessing social networks, subject to additional protective measures. In particular, providers must:
- Maintain private accounts without offering an option to make them public.
- Restrict messaging and account discovery functionalities.
- Disable livestreaming and continuous visual-content feeds.
- Prevent behavioural profiling and personalised commercial advertising.
- Implement enhanced privacy settings and safeguards against potentially harmful content.
These requirements will necessitate adjustments to the design and operation of social networking services available to minors.
Parental Controls and Appeal Mechanisms
The Regulation also requires providers to offer accessible parental-control tools, allowing parents or legal guardians to manage account settings, approve paid transactions, establish spending limits, monitor usage time and manage location-sharing features.
In addition, providers must establish accessible appeal mechanisms for users wishing to challenge age-verification results, account suspensions or closures, and restrictions imposed on child accounts. Such appeals must involve meaningful human review rather than relying exclusively on automated decision-making.
Entry into Force and Compliance Considerations
The Regulation will enter into force on 1 November 2026. Social network providers must complete the prescribed token-based verification of existing accounts opened before its entry into force by 31 March 2027, unless those accounts have already been verified through the required mechanism.
Failure to comply may result in sanctions under Law No. 5651, subject to prior notification of the infringement and an opportunity to remedy it.
The Regulation represents a significant development in Turkey's approach to children's online safety. Social network providers operating in Turkey should review their age-verification procedures, account functionalities, privacy settings and parental-control mechanisms to assess their compliance with the new requirements. Further technical guidance from the Cyber Security Presidency will be particularly relevant to the implementation of the mandatory verification system.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
