While the widespread use of social media by children offers significant opportunities for communication and access to information, it also presents various risks, including exposure to harmful content, cyberbullying, online exploitation, and threats to the protection of personal data. These risks have increased the importance of legal regulations aimed at protecting children in the digital environment. The new regulation on the protection of children requires social media network providers (as the law states ‘social network providers’) to implement age-appropriate protective measures across various processes, ranging from account creation to service design and the processing of personal data.
In this context, the Regulation on the Provision of Age-Specific Segregated Services and Age Verification by Social Media Providers (“Regulation”), published in the Official Gazette No. 33396 dated October 10, 2026, and set to take effect on November 1, 2026, imposes significant obligations on social media providers. The deadline for existing accounts that have not yet undergone age verification is March 31, 2027. The regulation covers topics such as the prohibition of providing services to children under the age of 15, age verification mechanisms, the security of children’s accounts, the protection of personal data, and parental control tools.
I. LEGAL BASIS AND SCOPE OF THE REGULATION
The Regulation imposes various obligations on social network providers concerning the prevention of access to social networking services by children under the age of 15, age verification, the provision of segregated services specifically designed for children aged 15 to 18, the security of children's accounts, the protection of personal data, and the establishment of parental control mechanisms.
The Regulation applies to social network providers established in Türkiye or abroad whose services are accessible from Türkiye, as well as to their users. Article 4 of the Regulation defines a social network provider as a natural or legal person that enables users to create, view or share content such as text, images, audio and location information over the internet for the purpose of social interaction. Therefore, when determining the scope of the Regulation, the focus should be on whether the service provided falls under this definition rather than whether the platform is labeled as “social media.” Social media providers not established in Turkey are also subject to the Regulation with respect to services accessible from Turkey. Consequently, platforms not established in Turkey but providing services to users in Turkey must also comply with the relevant obligations.
II. THE AGE LIMIT OF FIFTEEN AND CHILD-SPECIFIC, SEPARATE SERVICES
Pursuant to Article 5 of the Regulation, social media providers may not provide services to children under the age of 15. To ensure compliance with this obligation, providers must take the necessary technical and administrative measures and establish systems to verify users’ ages. Pursuant to Article 6 of the Regulation, account creation requests from children who, because of age verification, are determined not to have reached the age of 15 will be rejected.
For users who have reached the age of 15 but have not yet turned 18, the Regulation requires the provision of segregated services specifically designed for children. The regulation envisions significant changes in the content, privacy, and communication features of social media services provided to children who have turned 15 but have not yet turned 18.
High-level privacy settings will be applied by default on children’s accounts; accounts will be private by default, and there will be no option to make them public. Information regarding followers and accounts being followed will be visible only to the child account holder. Only accounts that the child follows will be able to send messages to the child and read receipts will not be displayed for these messages.
In addition, necessary technical measures will be taken to prevent others from taking screenshots of the child’s profile photo, account, posts, and images. In the design of these services, it will be mandatory to consider the child’s best interests, physical and psychological development, and the risks they may face in the digital environment.
The regulation also imposes certain restrictions on designs and algorithms that could lead children to spend more time on the relevant platforms. Interfaces, designs and functionalities that enable visual content to be presented sequentially on children's accounts, whether through scrolling, tapping, clicking or similar user actions, or automatically, shall be prohibited. Furthermore, children’s accounts may not be customized based on children’s behavior; personal data belonging to children may not be used for profiling or personalized commercial advertising activities. Social media providers are also required to implement filtering and recommendation system settings that minimize children’s exposure to content that could harm their physical, psychological, and emotional development.
III. AGE VERIFICATION REQUIREMENT AND PROTECTION OF PERSONAL DATA
Under Articles 6 and 7 of the Regulation, social media providers are required to verify a user’s age during the account creation process using an age token generated through the e-Government Portal. Upon the user's request, the age verification token is generated through an online service provided by the Cybersecurity Presidency, which is accessible following identity verification through the e-Government Portal. The user then uploads the token to the relevant social network platform. The social media provider verifies that the token was generated by the Presidency to determine the user’s age group. The token contains information regarding whether the user has reached the age of 15 and whether they have turned 18. It contains no other personal data or information and may not be used for any purpose other than age verification. Thus, rather than sharing the user’s identity information with the platform, the focus is on verifying that the user meets the age threshold required for the service to be provided.
The age verification requirement is not limited to account creation. Throughout the provision of the service, the social network provider must implement single-stage or multi-layered age verification methods of its own choosing. If there is reasonable suspicion that a verified account is being used in a manner inconsistent with the specified age range, the account will be suspended; to reactivate it, the user must verify their age using the age verification token.
Subsection (d) of the first paragraph of Article 7 of the Regulation provides for a special procedure for users who are not residents of Turkey but are temporarily present in the country. Article 7(1)(d) of the Regulation establishes a special age verification procedure for users who are not resident in Türkiye but are temporarily present in the country. Under this procedure, a special age verification token may be generated upon the user's request based on their passport information.
Age verification processes are also significant under the Law on the Protection of Personal Data No. 6698 (“KVKK”). Personal data processed in connection with age verification must comply with the principles set out in Article 4 of Law No. 6698 on the Protection of Personal Data (“KVKK”), including lawfulness and fairness, processing for specified, explicit and legitimate purposes, and ensuring that processing is relevant, limited and proportionate to those purposes. Furthermore, such processing must be based on appropriate legal ground, data subjects must be duly informed, and the necessary technical and administrative security measures must be implemented.
The obligation to verify age does not grant platforms unlimited authority to collect personal data. Therefore, it is important that verification systems be designed to be both reliable and compliant with the principles of personal data protection.
IV. PRIVACY AND SECURITY MEASURES FOR CHILDREN'S ACCOUNTS
Article 8 of the Regulation sets forth the security and privacy measures that must be applied to services provided to children who have reached the age of 15. High-level privacy settings will be applied by default to children’s accounts; accounts will be private by default, and there will be no option to make them public.
Information about followers and accounts being followed will be visible only to the child who owns the account. Only accounts that the child follows will be able to send messages to the child and read receipts will not be displayed for these messages.
In addition, restrictions apply to practices such as synchronizing children's accounts with telephone contact lists or contact lists maintained on other platforms, providing live-streaming features, and using children's personal data for profiling or personalized commercial advertising.
Children’s accounts will not be able to use the live streaming feature, nor will services that could lead to addictive behavior be offered. Technical measures aimed at preventing the unauthorized recording of children's images and posts also fall within the scope of these requirements. These regulations require social media providers to review not only their content filtering systems but also their account creation processes, communication tools, and algorithmic designs. The primary goal is to protect children’s privacy and reduce the risks they may face in the digital environment.
V. PARENTAL CONTROL, SUPERVISION, AND CONSEQUENCES
Pursuant to Article 9 of the Regulation, social media providers are required to offer clear, understandable, and user-friendly parental control tools. These tools must include, at a minimum, the following mechanisms:
- Control over children’s account and feature settings,
- Requiring parental permission or approval for transactions such as purchases, rentals, and paid subscriptions, and setting spending limits,
- Monitoring, setting, and limiting usage time, as well as managing location sharing.
These tools must include a Turkish language option, be easy to find and activate, and function across different devices and operating systems. When control tools are enabled, the child must be clearly notified. Parental control tools must be designed to strike a reasonable balance between ensuring children's safety and protecting their privacy and personal data. Their use must not result in disproportionate interference with children's right to privacy.
The responsibility for protecting children is not left solely to families; direct obligations are also imposed on platforms. Pursuant to Article 10 of the Regulation, social media providers are required to establish a free and accessible application and appeal mechanism, which includes a Turkish language option, to receive and promptly resolve appeals regarding the suspension or closure of an account based on age verification results, as well as measures applied under the segregated service framework. Applications and appeals cannot be reviewed entirely by automated systems and must undergo meaningful human review. Content and personal data associated with the account cannot be deleted until the review is completed. The notification regarding the outcome must state that a complaint may be filed with the Cybersecurity Presidency and that legal recourse may be sought.
Providers are also required to report data regarding the number of requests and appeals, the acceptance rate, and the average resolution time to the Presidency annually and to publish this information on their own websites.
Pursuant to Article 11 of the Regulation, failure by social network providers to comply with their obligations under the Regulation may result in the application of the relevant sanctions prescribed under Additional Article 4 of Law No. 5651. Depending on the nature of the violation and the applicable statutory provisions, administrative fines and other administrative measures may be imposed. Additional Article 4 of Law No. 5651 also provides for sanctions such as advertising bans and restrictions on internet bandwidth in respect of certain violations. However, these sanctions do not automatically apply to every breach of the Regulation; the specific statutory sanctions applicable to the relevant violation must be considered. Before imposing any sanction, the social network provider must be notified of the non-compliance and granted a reasonable period to remedy the violation, depending on its nature. In determining the appropriate sanction, consideration shall be given to the severity and duration of the violation, the number of children affected, and the provider's good-faith efforts to achieve compliance.
VI. CONCLUSION
The regulation requires social media providers to take a comprehensive approach to the services they offer to children from account creation to content delivery, and from the processing of personal data to complaint and appeal procedures. In this context, compliance is a process that requires not only the establishment of an age verification system but also a comprehensive review of service design, user terms, and internal procedures tailored specifically for children.
Accordingly, the Regulation does not place responsibility for protecting children on social networks solely on parents but also imposes direct obligations on social network providers. Providers must therefore ensure that their age verification systems, child-specific service designs, privacy and security measures, and complaint mechanisms comply with the Regulation.
It is important for social media providers to plan their compliance efforts in line with the effective date of November 1, 2026, and the March 31, 2027, deadline set for the verification of existing accounts. In these efforts, which will be carried out through coordination among legal, technical, and product teams, the protection of children’s personal data and privacy must be prioritized alongside their safety and developmental needs. The success of the regulation’s implementation will depend on transforming the proposed measures into a service structure that is accessible, auditable, and grounded in the best interests of children.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
