Türkiye's Regulation on the Provision of Child-Specific Differentiated Services and Age Verification by Social Network Providers was published in the Official Gazette on 10 October 2026 and took effect on 1 November. Platforms must now check a user's age at account creation with a token generated through the state's e-Devlet gateway. Under-15s may not hold accounts, and 15-to-18-year-olds must receive age-appropriate differentiated services. Existing accounts have until 31 March 2027 to complete verification.
We could not retrieve the Gazette text itself, so the details below rest on press and law-firm reporting of the regulation. Readers should check them against the official text.
The case for the rule
The strongest argument for the regulation is a serious one. Children face real harms online, including compulsive-use design, contact from strangers and targeted advertising. Self-declared birthdays are a fiction that every platform knows how to bypass. Parliament passed the underlying bill in April, Al Jazeera reported, after a school attack in Kahramanmaraş. A government that wants to enforce a minimum age needs some reliable signal, and a state ID system is the most accurate one available.
The design also has privacy-minded features. According to IDTech Wire, the token is generated at turkiye.gov.tr or in the e-Devlet app, and it must not contain names, usernames or other identifying information. It says only whether the holder clears the 15 and 18 thresholds. For 15-to-17-year-olds, reporting describes private-by-default accounts, direct messages limited to followed accounts, no livestreaming and no personalised ads. It also describes free appeals with human review. Those are defensible product rules, and several are close to what safety advocates have asked platforms to adopt voluntarily.
Where the design goes wrong
The weakness is architectural. A minimum-age rule needs a yes-or-no answer, but this rule obtains that answer through a state-controlled identity layer that every platform, and every user, must pass through. Hürriyet Daily News reports that adults 18 and over must also verify through e-Devlet when creating new accounts. Bianet warns that enforcement could require platforms to verify the age of virtually all users, including adults who use anonymous accounts. Officials have said identities will not be disclosed.
That assurance rests on policy, not on the architecture. The state issues the token, the state operates the gateway, and the state knows when and from which account each token was generated. A privacy-preserving design would use zero-knowledge proofs or a third-party credential issuer that cannot see which service asked. Neither the reported design nor the law requires that separation. It is a promise about intent, in a country where intent has not been a reliable guide.
The context matters here. IDTech Wire cites Freedom House's Freedom on the Net 2026, which rates Türkiye "Not Free" at 31 out of 100. On 9 October, the day before the regulation was published, EFF condemned a crackdown in which court orders blocked the sites and accounts of about a dozen LGBTQ+ and feminist organisations. Anonymity is how marginalised communities, journalists and dissidents in such an environment speak at all. An identity-linked access gate does not need to be abused to chill speech. It is enough that users believe it could be.
A second shift in power
The regulation follows Law 7590, the omnibus law that moved internet-governance functions from the telecoms regulator BTK to the Cyber Security Presidency. CMS's legal analysis says the law shifts social-network obligations under Internet Law 5651, including children's safety measures, to the Presidency. It also adds a new Article 60/A to Electronic Communications Law 5809, under which emergency measures must be complied with within two hours. A judge must approve them within 24 hours.
The result is one body that writes the age rules, issues the tokens through its identity infrastructure and holds fast-track emergency powers. Bianet gives the legal basis of the age rule as Additional Article 4 of Internet Law 5651, added by Law 7578. A rule justified by child safety now sits inside a broader consolidation of executive control over online speech.
What proportionate regulation would look like
There is a better way to reach the same goal. Four changes would keep the child-protection aim and shrink the speech risk.
- Separate the issuer from the verifier. Tokens should be unlinkable, so that the gateway cannot tell which platform requested one or when it was used.
- Write no-logging into binding rules. The ban on retaining or reusing tokens should be statutory, auditable and backed by penalties, not left to technical guidance.
- Offer alternatives to e-Devlet. Users without a state-linked identity, or who do not want to use one, should be able to use certified private age-assurance methods.
- Judge the rule by outcomes. Publish evidence on whether verification reduces harm, how many adults abandon anonymous accounts, and how many appeals succeed.
The 31 March 2027 deadline for existing accounts is the real test. The regulation's reach is also unclear. Bianet notes that the regulation lists no covered services, so it is uncertain whether services such as YouTube or WhatsApp fall inside it. Millions of existing accounts will be forced through the e-Devlet gate in one window, and the details of token handling will matter more than the announcement did. Child safety is a legitimate goal. A state identity chokepoint for the open internet is a heavy way to pursue it when privacy-preserving alternatives exist.