I. Introduction
The Regulation on the Provision of Segregated Services Specific to Children by Social Network Providers and on Age Verification (the “Regulation”), published in Official Gazette No. 33396 of 10 October 2026, prohibits social network providers accessible from Turkey, whether domestic or foreign, from serving children under 15. It also provides that children aged 15 and over must be offered a segregated service and that users’ ages must be verified with a token issued through the e-Government Gateway.
The Regulation will take effect on 1 November 2026 and allows until 31 March 2027 for existing accounts, and as the relevant sanction provisions of Law No. 5651 will apply to breaches of its obligations, social network providers should review their registration flows, child accounts and objection processes before the effective date.
II. Age Verification and the Age Token
So that the under-15 limit can be applied, the Regulation requires the provider to verify the user’s age with an age verification token when an account is created. Where verification shows that a child is under 15, the application to open an account will be rejected. Where it shows that the child is 15 or over, the account will be made subject to the segregated service rules described below.
The Regulation provides for the token to be generated, at the user’s request, through an online service offered via the e-Government Gateway by the Presidency of Cybersecurity (the “Presidency”) and uploaded by the user to the provider’s platform. It requires the token to show only whether the user has reached 15 and, if so, whether the user has reached 18, and to contain neither a username nor any other information that makes the user identified or identifiable to third parties. The Regulation also states that a provider may not use the token for any purpose other than age verification.
After the first token verification, the Regulation provides for the provider to operate single or layered age verification methods of its own choosing throughout the service, and requires that, where there is reasonable suspicion that a verified account is being used contrary to its prescribed age range, the account be suspended and token verification be carried out again before it can be used. The token’s technical structure and the process the provider must follow will be set out in guidance to be prepared and shared by the Presidency. The Regulation does not say when that guidance will be shared.
III. Child Account Features and Communication Limits
The Regulation treats as a child anyone under 18, even if that person has attained legal majority earlier, and requires that those aged 15 and over be offered a segregated service. It defines the segregated service as one in which security, privacy, content delivery, algorithms, communication and parental controls are applied in a way suited to the child’s age and level of development. In that service, high privacy settings must apply by default, data processing must be kept to a minimum, and accounts must be private with no public option, while follower and following lists must be hidden from users other than the account holder and only accounts the child follows may message the child’s account.
The Regulation prohibits a provider from synchronising a child’s account with sources such as phone contacts, email address books and contact or following lists on other platforms, from accessing those sources for the purpose of synchronisation and from processing data obtained from them; data obtained in breach of this prohibition, and the matching, inference and recommendation records derived from it, must be deleted without delay. Under the Regulation, a child’s account may not be recommended to other accounts, nor other accounts to the child, for following, and the child’s account may not be made searchable or discoverable through third-party contact data held by the provider, whatever account or source that data was imported from. By contrast, the Regulation does not treat as synchronisation the processing of only a parent’s contact information for creating, verifying and recovering the account, securing it and parental supervision.
The Regulation further prohibits, in child accounts, services that may foster addiction, live broadcasting, and interfaces, designs or functions that present visual content in sequence through swiping, tapping, clicking or similar actions, or automatically. It states that the prohibition on sequential presentation applies in the app, on the website and across every other interface. Under the Regulation, child accounts may not be customised according to the child’s behaviour, and the child’s personal data may not be subjected to profiling or personalised commercial advertising.
IV. Parental Controls and the Objection Mechanism
Under the Regulation, offering parental controls does not discharge the provider’s obligation to provide the segregated service, and these tools must contain, at a minimum, mechanisms for the following: control of account and feature settings, parental permission or approval for paid transactions together with a spending limit, monitoring and limiting of usage time, and location sharing. The tools must also be offered with a Turkish language option. The child must be clearly notified when they are activated, and they must be designed so as not to remove the child’s privacy disproportionately and to rest on communication, learning and empowerment rather than surveillance.
As to objections, the Regulation requires a free, accessible mechanism with a Turkish language option for objections to age verification results, to the suspension or closure of an account and to measures applied under the segregated service. Under the Regulation, applications and objections may not be examined solely by automated systems and will be subject to meaningful human review. The provider must not delete account content and personal data until the application or objection is resolved, and must state in the outcome notice that a complaint can be made to the Presidency and that recourse to the courts is available.
V. Scope and Exemptions
In terms of scope, the Regulation applies to social network providers accessible from Turkey, whether based in Turkey or abroad, and defines a social network provider as a natural or legal person that enables users, for the purpose of social interaction, to create, view or share content such as text, images, audio and location on the internet. Users who are not resident in Turkey and are only temporarily present will, under the Regulation, be exempt from the age verification controls; however, so that these users can use the services offered in Turkey, an exceptional token will be generated by the Presidency on application, without identity verification and using passport information only.
VI. Deadlines for New and Existing Accounts
For new accounts, the Regulation requires token verification at account creation from 1 November 2026 and provides no separate transitional period. For existing accounts opened before the effective date and not yet verified by token, the transitional provision requires the provider to verify them by token at least once by 31 March 2027. Following that verification, the accounts of children found to be under 15 will be closed with notice, and those of children found to be 15 or over will be made subject to the segregated service rules. The transitional provision also provides for data relating to closed accounts to be deleted once any application or objection mechanism that has been invoked has run its course and, where none is invoked, without delay.
VII. Conclusion
Before 1 November 2026, social network providers need to establish whether their services fall within the Regulation. Providers within scope should make their registration flow capable of token verification, bring the sequential presentation, contact matching and recommendation functions in child accounts into line with the Regulation’s limits, and set up an objection mechanism that provides for human review. So that existing accounts can be verified by 31 March 2027, the notification, closure, objection and deletion steps should be planned together.
For sanctions, the Regulation refers to Additional Article 4 of Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications. That article, as amended by Law No. 7578, allows the Head of the Presidency to impose on a non-compliant social network provider an administrative fine of up to 3 per cent of its global turnover in the previous calendar year.
If the obligation is still not met within thirty days of notification of the fine, tax residents in Turkey will be banned from placing new advertising with the provider; if non-compliance continues, the provider’s internet bandwidth may be reduced by order of a criminal judgeship of peace, starting at 50 per cent and rising to up to 90 per cent.
