The Regulation on the Provision of Segregated Services Specific to Children and Age Verification by Social Network Providers (“Regulation”), was published in the Official Gazette dated October 10, 2026 and will enter into force on November 1, 2026. The Regulation was drafted by the Cybersecurity Presidency, which is also empowered to issue further secondary legislation related to concerning the matters set out under the Regulation.
The Regulation is the anticipated secondary legislation implementing the age verification requirements already envisaged under Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications (“Internet Law”). Accordingly, the Regulation sets out the procedures and principles applicable to services offered by social network providers (“SNPs“) with respect to (i) age verification process, (ii) the provision of segregated services to children aged 15 and above, and (iii) parental control tools.
Prohibition of Services to Children under the Age of 15
With the amendments introduced to the Internet Law, SNPs had already been prohibited from providing services to children under the age of 15, and the Regulation maintains the same prohibitions. For the purposes of the Regulation, a child is defined as any person under the age of 18, even if they have attained legal adulthood at an earlier age. To determine whether a user has reached the age of 15, the Regulation sets out the principles and procedures governing age verification.
Age Verification Process
The Regulation requires SNPs to verify users’ age through an age verification token during account creation. Accordingly, the age verification token is generated through the online service which is provided by the Cybersecurity Presidency and accessed via the e-Government Gateway (“e-Gov”), the Turkish digital governmental platform for public services.
In line with a privacy-oriented approach, the Regulation underlines that the age verification token generated through the e-Gov may only contain the following information: (i) whether the user has reached the age of 15; and (ii) if the user has reached the age of 15, whether the user has reached the age of 18. The age verification token shall not contain any other personal data other than the user’s age group. It shall not contain the usernames displayed on the user’s profile maintained by the SNP or any other information or data that would enable third parties to identify or render the user identifiable.
Under the Regulation, the user uploads an age verification token obtained through the e-Gov to the SNP’s platform, and the SNP confirms the token’s authenticity and determines the user’s age group accordingly. Where there is reasonable suspicion that a verified account is being used in breach of the applicable age group, the SNP must suspend the account until the user completes verification again with a new token. Following the verification, account creation requests from children under the age of 15 must be rejected, while accounts of children aged 15 and over become subject to the rules on segregated services for children.
In this regard, SNPs are obliged verify all existing accounts with an age verification token at least once by March 31, 2027.
Segregated Services Specifically Designed for Children Aged 15 and Above
The amendments to the Internet Law also required SNPs to take sufficient measures to provide segregated services specifically designed for children aged 15 and above. The Regulation further elaborates on this requirement, specifying that while providing segregated services, SNPs must take into account the best interests of the child and their physical, mental, psychological, social, and emotional development needs.
Accordingly, SNPs must comply with the following requirements when providing segregated services specifically designed for children aged 15 and above:
- Key Considerations. In providing content, advertising and other services, SNPs must take into account (i) the child’s age, (ii) the best interests of the child, (iii) the protection of the child’s physical, psychological and emotional development, and (iv) the prevention of risks of sexual abuse and commercial exploitation of children.
- Privacy and data protection. High-level privacy settings must be enabled by default, and data processing must be limited to what is strictly necessary. Contracts, user settings, and data policies intended for children must be presented in a manner children can understand.
- Content and algorithms. Content filtering and recommendation systems must be configured to minimize children’s exposure to content that may harm their development. Services that may lead to addiction must not be provided.
- Account privacy and visibility. Accounts must be private by default, with no option to make them public. Other users must not be able to view children’s followers or the accounts they follow. Children’s accounts must not be recommended to other users, and other accounts must not be recommended to children.
- Messaging and communication. Only accounts followed by a child may send messages to that child and read receipts must be disabled. Children’s accounts must not be synchronized with sources containing contact information from other applications.
- Protection against unwanted exposure. Other users must not be able to take screenshots of content related to children’s profiles. Children’s accounts must not include live-streaming features or interfaces that display visual content consecutively, whether automatically or through scrolling, tapping, clicking, or similar interactions.
- Profiling and advertising. Children’s accounts must not be personalized based on their behavior. Their personal data must not be used for profiling or personalized commercial advertising.
In parallel to the Internet Law, the Regulation also obliges SNPs to publish the measures taken related to segregated services on their websites.
Parental Control Tools
SNPs must provide clear and user-friendly parental control tools to persons legally authorised to make decisions on behalf of the child. At a minimum, these tools must allow parents to (i) manage account and feature settings, (ii) require parental approval for paid transactions and set spending limits, and (iii) monitor and limit usage time and manage location sharing.
The Regulation further sets forth that parental control tools must also be available in Turkish, easy to find and activate, and compatible across devices and operating systems. Children must be notified when the tools are activated, and safeguards must prevent them from disabling the controls without the parent’s knowledge. The tools must also be designed to foster communication and empowerment rather than surveillance, without disproportionately compromising the child’s privacy. Finally, SNPs must publish clear and understandable information on the scope and use of these tools on their websites.
Appeal Mechanisms
SNPs must establish a free and accessible application and appeal mechanism in Turkish to receive and promptly resolve appeals concerning age verification results, account suspension or closure, and measures taken related to segregated services. These applications and appeals must be subject to meaningful human review and must not be handled entirely by automated systems.
Furthermore, SNPs must also report the number of applications and appeals, their acceptance rates, and average resolution times to the Cybersecurity Presidency annually and publish this information on their website.
Authors: Begüm Alara Şahinkaya, Rana Deliktaş