Turkey published new social media rules on Oct. 10 that will bar platforms from allowing children under 15 to open accounts starting Nov. 1. Users must verify their age with a certificate issued through the government’s e-Devlet system, and companies that fail to comply face fines of up to 3% of their previous year’s global revenue.
According to Bloomberg reporter Inci Ozbek, platforms will be required to check a government-issued age credential when a user signs up. If the applicant is under 15, the account must be blocked.
Rules cover domestic and foreign platforms operating in Turkey
The framework was issued by the Turkish Presidency’s cybersecurity authority and published in Official Gazette No. 33396 on Oct. 10. It contains 14 articles and one transitional provision. The rules apply to all domestic and foreign social media services accessible in Turkey and define a child as anyone under 18.
Pro-government Turkish media said the scope includes Instagram, Facebook, X, TikTok, Snapchat, YouTube, WhatsApp, Telegram, Discord and Reddit. The regulation itself does not list platform names and does not set a user-threshold test.
Existing accounts must also be checked by March 31, 2027
The measure does not only affect new sign-ups. Under the transitional clause, existing accounts that have not yet gone through the credential process must complete one round of verification by March 31, 2027.
If an existing account is found to belong to a user under 15, the company must notify the user and shut the account. If there is no appeal, the data must be deleted immediately. Existing accounts belonging to users who are at least 15 but under 18 must be moved to a segregated service designed for teenagers.
Age checks run through e-Devlet without disclosing identity to platforms
Article 7 says users must first log in to Turkey’s e-Devlet portal and complete identity authentication, then apply for an age certificate through an online service run by the cybersecurity authority. The certificate is then uploaded to the platform, which only confirms that it was generated by the authority and reads the relevant age bracket.
The credential contains only two pieces of information: whether the user is at least 15, and if so, whether the user is at least 18. It does not include other personal data or an account name, and platforms are barred from using it for anything other than age verification.
Family and Social Services Minister Mahinur Özdemir Göktaş said in a September interview with Turkish media that age verification through e-Devlet can confirm whether a user meets the minimum age without revealing identity to social media companies. Article 5 also says the verification method must only determine whether a user has crossed the age threshold, not establish identity, and must be available for audit and testing by users, parents and the cybersecurity authority.
Platforms must keep checking after sign-up
Verification at account opening is not the end of the process. Article 6 requires platforms to continue assessing age through their own methods after registration. If a company has reasonable grounds to believe an account is being used in a way that does not match the verified age group, it must suspend the account and require the user to complete the credential process again.
Users must be able to appeal a suspension, and the review cannot be handled entirely by automated systems.
Users aged 15 to 17 can still join, but only on a stripped-down service
Teenagers between 15 and 17 may still hold accounts, but only through a restricted version of the platform. Article 8, paragraph 5, sets out a detailed list of prohibited features.
- Platforms cannot offer services that may be addictive.
- Accounts must be private by default, with no option to switch them to public.
- Follower and following lists must be invisible to everyone except the child account holder.
- Only accounts that the child follows may send messages, and messages cannot show read receipts.
- Platforms cannot sync phone contacts, email contacts or friend lists from other apps.
- Child accounts cannot be recommended to others, and others cannot be recommended to the child.
- Companies must use technical measures to stop others from taking screenshots of the child’s profile photo, account and posts.
- Live streaming is not allowed.
One of the most consequential clauses bars any interface, design or function that continuously presents visual content through swiping, clicking or similar actions, or through automatic playback. The rule applies across apps, websites and all user interfaces. BlockTempo interpreted that as blocking infinite scrolling feeds and autoplay short-video streams.
Child accounts also cannot be personalized based on behavior, and personal data cannot be used for targeted advertising.
Parent controls must meet minimum standards
Article 9 sets minimum requirements for parental tools. Parents must be able to manage account and feature settings. Purchases and paid memberships must require parental approval and include spending caps. Parents must also be able to monitor screen time, set time limits and control location sharing.
The regulation says parental tools do not replace the platform’s obligation to provide a segregated service for younger users.
Penalties can escalate beyond fines
The enforcement structure comes from Law No. 7578, which passed parliament in April and was published in the Official Gazette on May 1. It amended Internet Law No. 5651, first enacted in 2007. Article 22 of the internet law says social media providers may not offer services to children under 15, must take necessary measures including age verification, and must provide segregated services to children aged 15 and above. Those measures must also be published on the provider’s own website.
Under the law’s existing penalties, failure to meet those obligations can bring fines of up to 3% of the provider’s previous year global revenue.
Law No. 7578 adds a stepped enforcement ladder. If a company still has not complied 30 days after a fine is served, advertisers that pay taxes in Turkey will be barred from placing new ads with the platform, signing new contracts or making payments. If non-compliance continues for another three months, the authority may ask the criminal peace judgeship to cut the platform’s network bandwidth by 50%. If the company still does not comply after another 30 days, the restriction can be raised to as much as 90%, though the court may set a lower rate as long as it is not below 50%. Once the company remedies the breach, the ad ban is lifted and the bandwidth restriction automatically falls away.
Article 11 of the October regulation adds two qualifiers. Authorities must notify the platform before imposing a fine and allow a reasonable period for correction. In deciding penalties, officials must consider the seriousness of the violation, how long it lasted, how many children were affected and whether the company acted in good faith.
Timing and political dispute
The law passed parliament on April 22, one week after a school shooting at a middle school in Kahramanmaraş. In that attack, a 14-year-old boy killed nine students and one teacher before dying himself.
President Recep Tayyip Erdoğan said in an April television appearance that some digital sharing applications were corrupting children’s minds and said bluntly that social media had become a "cesspool." The main opposition Republican People’s Party, or CHP, responded that protecting children should rely on "rights-based policies," not bans.
In the same interview, Göktaş offered another rationale, saying children spend more than 3.5 hours a day on social media on average, and that excessive screen use may disrupt sleep and is associated with depression and anxiety.
The ban is being introduced as the Turkish government faces criticism from human rights groups over restrictions on speech involving LGBTQ communities, journalists and political opponents. Many social media accounts have also been blocked in recent weeks. Statistics from the Freedom of Expression Association in Turkey, or İFÖD, show that more than 1.26 million URLs had been blocked in the country by the end of 2024.
Turkey puts the state at the center of age verification
The most distinctive part of the framework is the verification channel itself. The age credential is issued by the cybersecurity authority, meaning the Turkish government is taking direct control over who verifies age.
The report compares the approach with Australia’s planned ban for users under 16, due to take effect in December 2025. In that model, the responsibility for judging age sits with platforms, and the law expressly says companies cannot rely on government identity documents as the only method. Turkey instead uses a government e-government system to issue the age certificate and lets platforms read only the age-group result.