The Regulation on the Provision of Differentiated Services for Children and Age Verification by Social Network Providers (“Regulation”), published in the Official Gazette dated 10.10.2026 and numbered 33396, establishes the procedures and principles governing age verification, content safety, personal data protection and parental controls applicable to social network providers offering services to children.
The Regulation, issued pursuant to Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed Through Such Publications (“Law No. 5651”), applies to domestic and foreign social network providers accessible from Türkiye and their users.
Under the Regulation, social network providers are prohibited from providing services to children under the age of 15, while they are required to offer differentiated services incorporating specific safety measures appropriate to the age and developmental needs of children aged 15 to 17.
Age Verification Becomes Mandatory for Access to Social Networking Services
Under the Regulation, social network providers are required to verify users' ages when they create an account.
Where age verification establishes that a child is under the age of 15, the application to create an account must be rejected. Accounts belonging to children aged 15 and over will be subject to the requirements governing differentiated services for children.
Age verification will be carried out using an age verification credential generated through the e-Government Gateway (e-Devlet Kapısı). Social network providers will determine users' age groups by verifying the validity of the credentials uploaded to their platforms through the service provided by the Cyber Security Presidency (“Presidency”).
The age verification credential will indicate only whether the user has reached the ages of 15 and 18. The user's identity, exact age and other personal information will not be disclosed to the social network provider. Providers will not be permitted to use the credential for purposes other than age verification.
Social network providers may also apply additional verification methods of their own following the initial age verification. Where there is reasonable suspicion that an account is being used inconsistently with the verified age group, providers may suspend the account and request renewed verification.
An exemption from the age verification mechanisms specified in the Regulation is provided for users who are not resident in Türkiye and are present in the country temporarily. Upon application, the Presidency may issue an exceptional age verification credential to enable such users to access social networking services in Türkiye.
Safety Measures Established for Differentiated Services for Children
The Regulation requires social networking services provided to children aged 15 and over to be designed in a manner that protects their physical, mental, psychological, social and emotional development.
Accordingly, social network providers must implement the following measures in relation to children's accounts and their experience of the platform:
- Privacy and data protection: Children's accounts must have a high level of privacy protection enabled by default, and the processing of personal data must be kept to a minimum.
- Account visibility: Children's accounts must be private by default, without an option to make them public. Information concerning followers and followed accounts must not be visible to other users.
- Messaging: Children's accounts may receive messages only from accounts they follow, and read receipts must not be provided.
- Access to contact lists: Social network providers must not access or process third-party contact information stored on devices or online storage services through children's accounts. Only parental contact information may be processed for account creation, verification, recovery, security and parental supervision purposes.
- Account recommendations: Children's accounts must not be recommended to other users. Third-party contact information obtained through children's accounts must not be used for account matching or user recommendations.
- Content safety: Content filtering and recommendation system settings must be implemented to reduce children's exposure to content that could adversely affect their development.
- Live streaming and content feeds: Live streaming features must not be made available on children's accounts. Interfaces and functions that enable visual content to be displayed consecutively through scrolling, tapping or similar actions, or automatically, must not be used.
- Profile security: Technical measures must be implemented to prevent others from taking screenshots of children's profile photographs, accounts, posts and images.
- Advertising and personalisation: Children's accounts must not be personalised on the basis of their behaviour, and children's personal data must not be used for profiling or personalised commercial advertising.
Social network providers must also refrain from offering services that may encourage addictive behaviour among children, prepare agreements and data policies that children can understand, and ensure that the content provided is appropriate to their developmental needs.
These obligations extend beyond content moderation and cover account creation, user interactions, data processing, advertising and interface design across social networking platforms.
Parental Control Tools Become Mandatory
Under the Regulation, social network providers must offer clear, understandable and user-friendly parental control tools enabling parents to manage their children's activities in the digital environment.
These tools must allow parents to control account and feature settings, require parental authorisation for transactions such as purchases, rentals and paid subscriptions, monitor and restrict usage time, and manage location sharing.
Parental control tools must be available in Turkish, be designed to operate across different devices and operating systems, and be clearly communicated to child users when activated.
Measures must also be implemented to prevent children from disabling or removing parental controls without the parent's knowledge and without undergoing the same security verification procedure.
The provision of parental control tools does not relieve social network providers of their obligation to offer differentiated services for children. For this reason, parental supervision will be implemented not as a substitute for the security measures that platforms are required to implement directly, but as a mechanism that complements them.
Application and Appeal Mechanisms Must Be Established
Social network providers must establish mechanisms for reviewing applications and appeals concerning age verification results, account suspensions or closures, and measures implemented under the differentiated services framework for children.
These mechanisms must be available in Turkish, free of charge and accessible, and must ensure that applications are resolved promptly.
Applications must not be reviewed exclusively through automated systems; meaningful human review must form part of the assessment process.
Content and personal data associated with the relevant account must not be deleted until the application or appeal has been resolved. Users must also be informed of their right to lodge a complaint with the Presidency or pursue judicial remedies against the outcome.
Social network providers must annually report the number of applications and appeals, acceptance rates and average resolution times to the Presidency and publish this information on their websites.
Sanctions May Be Imposed for Non-Compliance
Failure to comply with the obligations established under the Regulation will be subject to the relevant provisions of Additional Article 4 of Law No. 5651.
Before a sanction is imposed, the social network provider must be notified of the non-compliance and granted a reasonable period to remedy it, taking into account the nature of the breach.
In determining the applicable sanction, consideration will be given to the severity and duration of the breach, the number of children affected and the social network provider's good-faith efforts to achieve compliance.
Accordingly, social network providers should not only implement the required technical measures but also maintain processes for monitoring compliance and demonstrating the measures taken where necessary.
Transitional Arrangements for Existing Accounts
Existing accounts created before the Regulation enters into force that have not been verified through an age verification credential must undergo age verification at least once by 31.03.2027.
Where verification establishes that a child is under the age of 15, the existing account must be closed after notifying the child. If an application or appeal is submitted in relation to the closure, the account must not be deleted until the appeal process has been concluded.
Existing accounts belonging to children who are verified as having reached the age of 15 will become subject to the requirements governing differentiated services for children.
Entry into Force
The Regulation will enter into force on 01.11.2026.
A transitional period until 31.03.2027 has been provided for the age verification of existing accounts.
Assessment and Conclusion
The Regulation introduces comprehensive obligations for social network providers in terms of both technical infrastructure and service design by making children's access to social networking services subject to age verification.
In particular, preventing children under the age of 15 from accessing social networking services and differentiating the safety, privacy and content features of services provided to children aged 15 to 17 will require social network providers to modify their existing user management systems and platform designs.
Furthermore, limiting age verification credentials to age-group information and prohibiting the use of children's personal data for profiling and personalised advertising make the protection of children's personal data a central element of the Regulation.
Accordingly, social network providers accessible from Türkiye must review their age verification infrastructure, default privacy and security settings for children's accounts, content recommendation systems, advertising practices, parental control tools and application and appeal mechanisms before the Regulation enters into force.
In addition, given the requirement to verify the ages of existing account holders by 31.03.2027, it is important to plan the necessary technical and operational preparations for the transitional period.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
