The Era of Age Verification on Social Media under Turkish Law

The Regulation on the Provision of Differentiated Services Specific to Children and Age Verification by Social Network Providers was published in the Official Gazette numbered 33396 on October 10, 2026.

The Regulation introduces provisions concerning domestic or foreign-sourced social network providers accessible from Turkey, as well as regulations regarding differentiated services to be offered by these providers to children who have reached the age of fifteen, age verification, parental control tools, and objection mechanisms.

The definition of “differentiated service” is set forth in Article 4, paragraph 1(a). According to this definition, it refers to the provision of social network services to children who have reached the age of fifteen by applying measures regarding “safety, privacy, content presentation, algorithms, communication, and parental control tools” that are appropriate for their age and developmental levels. However, the rationale behind the service being “differentiated” is not clear from the wording of the Regulation. Furthermore, the specific boundaries defining what is appropriate for age and developmental levels have not been established. Consequently, a compliance process for social network providers can be anticipated, the duration of which remains undefined.

The Regulation prohibits social network providers from offering services to children who have not yet reached the age of fifteen. However, due to the broad definition of a “social network provider,” there is a possibility that the scope could extend to—for instance—quiz applications used in classrooms that also aim to facilitate social interaction. Thus, while the Regulation aims to cover social network providers in a broad sense, it appears to encompass a scope that could also impact ed-tech startups. During the debates regarding the Regulation, attention was drawn not only to the protection of the best interests of the child but also to the risks associated with identity verification and tagging practices. However, regarding personal data protection standards during identity verification, it was specified that—based on whether the child has reached the age of fifteen—an "age verification token" (as defined in the Regulation) would be used, and that this token would not contain any other personal data.

Article 7(1)(d) of the Regulation also highlights the territorial scope of the rules. It states that, upon application, a token could be generated using passport details to allow users not resident in Turkey to access social network services. However, no mechanism has been provided regarding how the technical infrastructure for this should be established, how the application process and its outcomes should be handled, or the minimum standards for personal data protection resulting from such applications. In this context, if an EdTech entity is classified as a social network provider, we believe it is necessary to clearly disclose the provisions regarding territorial use and exceptional tokens in user agreements, and—crucially—to provide detailed information on the usage mechanism, personal data protection measures, and the technical classification of the service.

Article 8, titled "Provision of differentiated services for children," provides a more detailed explanation of the technical specifications of such differentiated services. In this regard, it is stated that factors such as the child's age, best interests, physical, psychological, and emotional development, and the prevention of risks related to sexual abuse and commercial exploitation of children will be taken into account. Paragraph 3 of the same article stipulates that user agreements or data policies must be presented in a manner that the child can understand. However, a crucial point to consider here is that the language must be simplified or restructured in a way that does not create any distinct legal liability. Therefore, it is of great importance to consult your lawyer regarding this matter.

The procedures and principles to be applied when providing differentiated services under Article 8, Paragraph 5 are specified. Furthermore, it is stipulated that these measures—along with other measures to be adopted by the social network provider—must be published on the social network provider's website.

The social network provider is required to establish a free and accessible application and appeal mechanism that includes a Turkish language option, enabling the resolution of objections regarding account restrictions, closures, or differentiated measures. The appeal mechanism process must also be explained in language that children can understand, and the provisions of Article 8, Paragraph 3 must be applied by analogy.

It is stated that the guidelines regarding the age verification indicator will be shared with social network providers by the relevant ministry.

It is stipulated that social network providers must carry out age verification procedures for existing accounts at least once by March 31, 2027. The Regulation will enter into force on November 1, 2026.