Regulation on the Provision of Cusomized Services for Children and Age Verification by Social Network Providers Published
The Regulation on the Provision of Customized Services for Children and Age Verification by Social Network Providers (the “Regulation”), published in the Official Gazette dated October 10, 2026 and numbered 33396, establishes a comprehensive regulatory framework governing the services provided by social network providers to children.
The Law Amending the Social Services Law and Certain Other Laws, published on May 1, 2026, introduced amendments to Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed through Such Publications (the “Internet Law”), imposing new obligations on social network providers, including the implementation of age verification mechanisms, the provision of customized services for children and the introduction of parental control tools. The Regulation sets out the procedures and principles governing the implementation of these obligations. The Regulation will enter into force on November 1, 2026 and it applies to domestic and foreign social network providers accessible from Türkiye and their users. The principal obligations imposed on social network providers under the Regulation are summarized in this Legal Alert.
I. Age Restrictions and Age Verification Requirements
Pursuant to Article 5 of the Regulation, in line with the amendments made to the Internet Law on May 1, 2026, social network providers are prohibited from providing services to children under the age of 15. Accordingly, Articles 6 and 7 of the Regulation require users to verify their age at the account creation stage through an age verification token generated via the e-Government Gateway (e-Devlet Kapısı). The token will indicate only whether the user is under the age of 15, between the ages of 15 and 17, or aged 18 or above, without containing any other personal data.
Under Article 7 of the Regulation, the age verification token will be generated via the e-Government Gateway upon the user's request and subsequently uploaded by the user to the relevant social network platform. The social network provider will verify that the token was issued by the Cybersecurity Presidency (the "Presidency") and determine the user's age group accordingly. The use of the token for any purpose other than age verification is prohibited. Account creation requests from users verified to be under the age of 15 will be rejected, while users aged 15 to 17 will be provided with customized services for children. The Regulation further requires social network providers to continue applying their own age verification methods throughout the provision of their services.
Where there is reasonable suspicion that an account is being used in a manner inconsistent with the verified age group, the relevant account must be suspended until the user completes a new token-based age verification. Users who are temporarily present in Türkiye but are not residents are exempt from the age verification control mechanisms. However, to access social network services offered in Türkiye, such users must obtain an exceptional token generated by the Presidency via the e-Government Gateway using only their passport information.
II. Provision of Customized Services for Children
Pursuant to Article 8 of the Regulation, social network providers are required to customize the services offered to users aged 15 to 17 in accordance with their age and developmental levels. In this regard, the Regulation prioritizes the best interests of the child, the protection of their development and the prevention of risks of sexual abuse and commercial exploitation. The principal obligations imposed on social network providers under the Regulation are as follows:
Privacy and Account Security: High level privacy settings must be applied by default to children's accounts, personal data processing must be kept to a minimum and accounts must not be made public. In addition, follower and following information must not be visible to other users and technical measures must be implemented to prevent screenshots of children's profile pictures, posts and images.
Communication and Interaction Restrictions: Only accounts followed by the child may send messages to the child’s account, while read receipts must be disabled, and child users must not be permitted to initiate live broadcasts. Social network providers are also prohibited from recommending children’s accounts to other users or other users’ accounts to children.
Use of Contact Data: Synchronization of children’s accounts with contact lists, email address books or contact sources on other platforms is prohibited. An exception applies to the processing of parents' contact information for account creation, verification, recovery, security, and parental supervision purposes. Any data obtained in violation of this prohibition, together with records derived from such data, must be deleted without delay. The use of third-party contact data to make children’s accounts searchable, discoverable, or recommendable is also prohibited.
Content Presentation and Platform Design: Social network providers must implement content filtering and recommendation-system settings to reduce children’s exposure to content that may harm their development. Services capable of creating addictive effects, as well as interfaces, designs and functions that enable the consecutive presentation of visual content through scrolling, tapping, clicking, similar user actions or automatically, are also prohibited.
Profiling and Advertising: Customization of children’s accounts based on user behavior and the use of children’s personal data for profiling or personalized commercial advertising purposes are prohibited.
Transparency: Agreements, user settings and data policies must be presented in a manner understandable to children, and the measures implemented under the customized services framework must be published on social network providers’ websites.
III. Parental Control Tools
Under the Regulation, social network providers are required to offer clear, understandable, and user-friendly parental control tools to protect children from ageinappropriate content, harmful online interactions and risks associated with excessive use. The main functions and principles of these tools, which may be used by parents or legal guardians, are as follows:
Account and Spending Controls: Parents must be able to manage their children' s account settings and features, approve transactions such as purchases, rentals, and paid memberships and set spending limits.
Usage Time and Location Sharing: Parents must be able to monitor, determine, and limit their children's social network usage time, as well as manage location-sharing settings.
Accessibility and Security: Parental control tools must offer a Turkish-language option, be easily accessible, and be compatible with different devices and operating systems. Children must be notified when these tools are activated and safeguards must be implemented to prevent their deactivation without parental knowledge and the required security verification.
Children’s Privacy: Parental control tools must be designed in a manner that does not disproportionately restrict chlildren’s privacy.
In addition, social network providers must publish information on the scope and use of parental control tools on their websites. The provision of such tools does not exempt social network providers from their obligation to provide customized services for children.
IV. Application and Appeal Mechanism
The Regulation requires social network providers to establish a free and accessible application and appeal mechanism with a Turkish-language option, covering age verification results, account suspensions or closures and measures implemented under the customized services framework. Applications and appeals may not be assessed solely through automated systems and must also be reviewed by authorized personnel. Account content and personal data must not be deleted while an application or appeal is pending. The Regulation further requires social network providers to inform users, when notifying them of the outcome of their applications or appeals, of their right to file a complaint with the Presidency or seek judicial remedies. Social network providers must also annually report the number of applications and appeals, their acceptance rates, and average resolution times to the Presidency and publish the same information on their websites.
V. Transitional Provisions for Existing User Accounts
Pursuant to Provisional Article 1 of the Regulation, existing accounts created before the Regulation enters into force that have not been verified through an age verification token must undergo token-based verification at least once by March 31, 2027. Accounts found to belong to users under the age of 15 must be closed after notifying the relevant users. Data associated with such accounts must
be deleted following the resolution of any appeal or, if no appeal is filed, without delay. Existing accounts verified to belong to users age 15 to 17 must be transitioned to the customized services framework for children.
VI. Sanctions
Pursuant to Article 11 of the Regulation, social network providers that fail to comply with their obligations will be subject to the sanctions prescribed under Additional Article 4 of the Internet Law. Accordingly, an administrative fine of up to 3% of their global turnover in the preceding calendar year may be imposed. If the relevant obligations remain unfulfilled within 30 days following notification of the administrative fine, a ban on placing new advertisements with the relevant social network provider will take effect. If the obligations remain unfulfilled within three months following the advertising ban decision, an application may be filed with the Criminal Judgeship of Peace for a 50% reduction in the social network provider’s internet traffic bandwidth. If noncompliance persists for 30 days following the implementation of the initial bandwidth restriction, a further reduction of up to 90% may be requested. Under Article 11 of the Regulation, social network providers must be notified of the violation and granted a reasonable period to remedy it before sanctions are imposed. The severity and duration of the violation, the number of children affected, and the provider’s good-faith compliance efforts will be taken into account when determining the applicable sanction.
VII. Implementation Guidelines and Effective Date
Pursuant to Article 12 of the Regulation, the technical structure of the age verification token, the format of the information it contains, and the procedures to be followed by social network providers during the verification process will be set out in implementation guidelines to be prepared by the Presidency and shared with social network providers. The Presidency is also authorized to resolve any uncertainties arising in the implementation of the Regulation and to establish additional procedures and principles as necessary. Pursuant to Article 13 of the Regulation, the Regulation will enter into force on November 1, 2026.
You can download the full article in PDF format here.
This information note has been prepared for general informational purposes, within the framework of the general principles of Turkish law. It does not constitute advertising or promotional material, nor does it contain an assessment tailored to any specific case. Accordingly, the information contained herein may vary depending on the particular circumstances of each case, and Vardar Şanlı Attorneys at Law shall not be held liable in respect of such circumstances.
