November 2026 – Türkiye has introduced a new regulatory framework for social media platforms, bringing significant changes to how children can access and use social media services.
The “Regulation on the Provision of Separate Services Tailored to Children and Age Verification by Social Media Providers” (the “Regulation”), published in the Official Gazette dated 10 October 2026, entered into force on 1 November 2026.
The Regulation applies to both domestic and foreign social media providers accessible from Türkiye ("Providers") and introduces mandatory age verification, a ban on providing services to children under 15, and stricter safeguards for users aged 15 to 17.
What Are the Key Changes?
1. Mandatory age verification and a ban on users under 15
Providers can no longer offer their services to children under the age of 15.
To enforce this restriction, Providers must verify the age of users through an “age verification token” generated via the e-Government Gateway during account creation. Importantly, the token only confirms whether a user meets the relevant age thresholds (15 and 18), without disclosing their identity or other identifying information.
Age verification is also an ongoing obligation: where there is reasonable ground to suspect that an account is being used inconsistently with its verified age category, Providers must suspend the account and require renewed token-based verification.
Non-resident users temporarily visiting Türkiye are expected to be subject to a separate age verification process.
2. A safer, more restricted social media experience for users aged 15–17
Providers must offer a differentiated service model for users aged 15 to 17, with restrictions affecting core platform features, advertising, and content recommendations.
In particular:
- Private accounts by default: Children’s accounts must remain private, without an option to make them public;
- No behavioural profiling or personalised advertising: Providers cannot personalise children’s accounts based on their behaviour or use their personal data for profiling or personalised commercial advertising;
- No livestreaming: Livestreaming features must be disabled for children’s account; and
- Restrictions on potentially addictive features: Providers cannot offer features that may encourage addictive use, including continuous feeds displaying visual content through swiping, tapping, clicking, or automatic progression.
Additional safeguards apply to social interactions and account visibility. In particular, messaging must be restricted to accounts followed by the child, read receipts must be disabled, and contact list synchronisation and certain account recommendations must be limited. Children's follower and following lists must also be hidden from other users.
Providers must further implement technical measures to prevent screenshots of children's profile photographs, accounts, posts, and images and ensure that terms of service, privacy policies, and account settings are presented in child-friendly language.
3. Parental Control Tools
Providers must introduce accessible parental control tools, with a Turkish-language option, allowing parents and legal guardians to:
- manage children’s account settings and location sharing;
- monitor and limit screen time; and
- approve paid transactions and set spending limits.
4. Human review and transparency
Providers must establish free, accessible mechanisms, available in Turkish, allowing users to challenge age verification outcomes, account suspensions or closures, and restrictions imposed under the differentiated service model.
Importantly, appeals cannot be handled solely through automated decision-making systems and must receive meaningful human review.
Providers must also submit annual reports to the Cybersecurity Directorate covering appeal volumes, acceptance rates, and average resolution times and publish these statistics on their websites.
What Happens to Existing Accounts?
With the Regulation now in force, Providers should review their existing age verification processes, identify the changes required to their platform features and privacy settings, and prepare to verify existing accounts by 31 March 2027. Particular attention should be given to implementing the restrictions applicable to users aged 15-17, including those relating to advertising, content recommendations, messaging, and parental controls.
The Cybersecurity Directorate is also expected to issue technical guidance on the structure and implementation of the age verification token. Providers should monitor this guidance and factor any additional technical requirements into their compliance plans.
What Are the Consequences of Non-Compliance?
Non-compliance may result in administrative fines of up to 3% of the Provider’s global turnover in the preceding calendar year under the Internet Law No.5651. Before imposing sanctions, Providers must be notified of the breach and given a reasonable period to remedy it.
What Should Social Media Providers Do Now?
With the new regime already in force, Providers should prioritise reviewing their age verification processes, account eligibility rules, and existing user bases ahead of the 31 March 2027 transition deadline.
Compliance will also require a broader review of platform design, particularly recommendation algorithms, advertising practices, privacy settings, livestreaming functionality, and parental controls.
For Providers operating across multiple jurisdictions, the new requirements may necessitate Türkiye-specific product configurations, particularly where globally available platform features are incompatible with the restrictions applicable to users aged 15-17.