Türkiye Turns On Age Checks for New Social Media Accounts

On Sunday 1 November 2026 Türkiye tied every new social media account to a token from the state’s own identity portal. The Regulation on Child-Specific Segregated Services and Age Verification by Social Network Providers, published in Official Gazette No. 33396 on 10 October 2026, bars under-15s and makes every new user prove an age band through e-Devlet. The design inverts Australia’s, and a cyber-security agency, not a data-protection authority, runs it.

What took effect on 1 November, and what waits until March

The regulation took effect on 1 November (Article 13), with the statutory ban it implements. Law No. 7578, published on 1 May 2026 with a six-month delay, rewrote paragraph 7 of Additional Article 4 of Law 5651, the internet law: a provider may not serve children under 15 and must take measures, including age verification, to prevent it.

Article 6(2) requires verification at account creation, so new sign-ups are covered. Transitional Article 1 gives providers until 31 March 2027 to pass every existing, unverified account through the token once; under-15 accounts are then closed after notice and their data deleted once any appeal is concluded. The Directorate of Communications’ Centre for Combating Disinformation said on 23 October, Anadolu Agency reported, that the start covered new accounts only, and warned of phishing messages urging immediate verification.

How the e-Devlet token works, and what platforms never see

Article 7 makes e-Devlet, the state’s e-government portal, the sole channel. A user logs in, requests an age verification token from a Cyber Security Presidency (Siber Güvenlik Başkanlığı) service and uploads it to the platform. The token states only whether the holder has turned 15 and, if so, 18; it carries no other personal data, not even a username, and the platform may use it for nothing else. Article 12 has the Presidency write a technical guide and share it with providers; nothing requires publication.

No official page confirmed on 2 November that the service was running. In a statement carried by Anadolu Agency on 31 October, the Cyber Security Presidency said the technical process and user steps would be shared in stages. Its news page was silent on 2 November.

What a 15-year-old’s account must look like

Article 8 defines the segregated service for verified 15- to 17-year-olds: private by default with no public option; follower lists hidden; messages only from followed accounts, without read receipts; no contact syncing or friend suggestions; no live streaming; anti-screenshot measures; no endless scrolling feeds on any interface; no profiling or personalised advertising. Article 9 adds parental tools for settings, spending, screen time and location.

Article 10 requires a free, Turkish-language appeal against any verification result, suspension or closure, with meaningful human review and no fully automated decisions, a stricter line than Austria’s new statute on decisions no official takes.

Who enforces it, and how hard the sanctions bite

The enforcer is the Cyber Security Presidency, which the consolidated text of Law 5651 shows took over the internet law’s enforcement role from the Information and Communication Technologies Authority (BTK) in July 2026, the same executive machinery now writing Türkiye’s AI rules by circular.

A provider failing the paragraph 7 duty can be fined up to 3 per cent of its previous calendar year’s global turnover. Law 7578 adds a ladder: 30 days after the fine, a ban on new advertising by Turkish-resident advertisers; three months later, an application to a criminal judgeship of peace to throttle bandwidth by 50 per cent; 30 days after that, up to 90 per cent. Article 11 requires prior notice, a cure period and regard to the number of children affected.

Where the challenge stands, and what to watch

The Freedom of Expression Association, İFÖD, said on 13 October it would ask the Council of State to annul and stay the regulation, arguing that Law 5651 mentions neither e-Devlet nor adult verification, that the guide is withheld from the public and that the agency issuing blocking orders controls the gate. No filing was announced by 2 November. İFÖD’s benchmark is Australia’s Online Safety Amendment (Social Media Minimum Age) Act 2024, whose section 63DB bars platforms from collecting government-issued identification or using an accredited digital ID service unless a reasonable alternative exists. Türkiye mandates that channel.

T24 reported in April that YouTube Türkiye, with the bill before parliament, said it would have to close under-15 users’ and creators’ accounts. On Sunday Euronews Türkçe reported platforms saying they were taking the steps needed to comply.

What to watch is whether the token service is demonstrably live and the guide published; whether the Council of State grants a stay before March, when the regime extends to all accounts; and whether Europe, facing its own December deadline on deepfakes and nudification apps, reads state-issued age tokens as privacy by design or as surveillance.