The Regulation on the Provision of Child-Specific Segregated Services and Age Verification by Social Network Providers (“Regulation“), prepared by the Cybersecurity Presidency, was published in the Official Gazette dated 10 October 2026 and numbered 33396 and will enter into force on 1 November 2026.
The Regulation prohibits social network providers from offering services to children under the age of 15 and requires them to provide children aged 15 to 17 with segregated services tailored to their age and developmental needs, incorporating specific safety and privacy safeguards. It also introduces obligations concerning age verification, restrictions on certain features of children’s accounts, parental control tools, and the establishment of application and appeal mechanisms.
All social network providers accessible from Türkiye, whether based in Türkiye or abroad. Age verification alone will not be enough and the content, advertisements, communication features, recommendation systems, and privacy settings offered to children must also meet specific child-protection requirements.
The principal obligations imposed on social network providers under the Regulation are summarised below:
- Ban on users under 15: Social network providers are prohibited from providing services to children who have not reached the age of 15. Account registration requests from users identified through age verification as being below this threshold must be rejected.
- Age verification at registration and beyond: Social network providers must verify users’ ages through an age verification token during the account registration process. Additional age verification measures may also be implemented throughout the period of service. Where there are reasonable grounds to suspect that an account is being used in a manner inconsistent with the verified age category, the account must be suspended and the user must be required to undergo age verification again.
- Age Verification Token: Age verification will be carried out using an age verification token generated through a service provided by the Cybersecurity Presidency and accessible via the e-Government Gateway. The token will indicate only whether the user has reached the age thresholds of 15 and 18 and will not contain the user’s name or any other personal data that directly or indirectly identifies the individual. Social network providers will be prohibited from using the token for purposes other than age verification.
- Scope of services for users aged 15 to 17: Social network providers must adapt the services offered to children aged 15 and above to their age and developmental needs. In this context, content filtering and recommendation system settings designed to safeguard children’s physical, psychological, and emotional development must be implemented. User agreements, account settings, and data policies must also be presented in language that children can understand.
- Private accounts and limited contact: Children’s accounts must be private by default, and the option to maintain a public account must not be made available. Information concerning followers and followed accounts must not be visible to other users. Only accounts followed by the child may send messages to the child’s account, and read receipts must not be displayed. Furthermore, social network providers are prohibited from matching children’s accounts with third-party contact information, synchronising them with phone directories or similar sources, or recommending children’s accounts to other users as accounts to follow.
- Restricted features: Live-streaming features must not be made available on children’s accounts. Interfaces and functionalities that enable visual content to be displayed consecutively through swiping, tapping, clicking, or automatic progression must also be prohibited. Services that may foster addictive behaviour must not be offered. In addition, social network providers must implement technical measures to prevent other users from taking screenshots of children’s profile pictures, posts, and images.
- No profiling or targeted ads: Children’s accounts must not be personalised on the basis of children’s behaviour, and children’s personal data must not be used for profiling or personalised commercial advertising. Personal data processing activities relating to children’s accounts must be subject to high privacy settings by default, and data processing must be limited to the minimum necessary.
- Parental controls: Social network providers must offer tools enabling parents to manage their children’s account and feature settings, approve paid transactions and set spending limits, monitor and restrict usage time, and control location sharing. These tools must be available in Turkish, easily accessible, and compatible with different devices. Where parental control tools are activated, the child must be informed, and measures must be implemented to prevent the child from disabling such tools without the parent’s knowledge and the necessary security verification.
- Applications and appeals: Social network providers must establish free and accessible application and appeal mechanisms, available in Turkish, through which users may challenge age verification results, account suspensions or closures, and measures imposed as part of segregated services. Applications and appeals must not be assessed solely through automated systems and must be subject to meaningful human review. Content and personal data associated with the relevant account must not be deleted until the application or appeal process has been concluded.
- Transparency and reporting: Social network providers must publish on their websites the measures adopted in connection with child-specific segregated services. They must also annually report to the Cybersecurity Presidency, and publicly disclose on their websites, data concerning the number of applications and appeals received, acceptance rates, and average resolution times.
- Transitional period for existing social media accounts: Accounts created before the Regulation enters into force that have not been verified through an age verification token, must undergo age verification at least once by 31 March 2027. Whereas, any existing accounts belonging to children found to be under the age of 15 must be closed following notification to the user. Personal data associated with such accounts must be deleted upon completion of the appeal process, where an appeal has been lodged, or without delay where no appeal is submitted. Accounts belonging to children verified as having reached the age of 15 will become subject to the rules governing segregated services.
- Sanctions for non-compliance: Non-compliance will trigger the sanctions set out in Additional Article 4 of Law No. 5651. Before imposing a sanction, the authority must notify the provider of the breach and give it a reasonable period to remedy it, depending on the nature of the breach. Sanctions will be set according to the severity and duration of the breach, the number of children affected, and the provider’s compliance efforts.
In conclusion, the Regulation subjects social network providers’ services for children to specific obligations concerning age verification, account privacy, content and advertising restrictions, parental controls, and application and appeal mechanisms.
Social network providers will therefore need to bring their account registration procedures, age verification infrastructure, platform features available to children’s accounts, and user policies into compliance with the Regulation, taking into account its entry into force on 1 November 2026 and the transitional deadline of 31 March 2027 applicable to existing accounts.
The full text of the Regulation is available via this link.
