Türkiye's under-15 social media rules took effect on 1 November 2026 for newly created accounts. The regulation was published in the Official Gazette on 10 October, and Hürriyet Daily News reports it was prepared by the Cyber Security Directorate. The Gazette index lists it as the "Regulation on the Provision of Child-Specific Differentiated Services by Social Network Providers and on Age Verification" (Sosyal Ağ Sağlayıcı Tarafından Çocuklara Özgü Ayrıştırılmış Hizmet Sunulmasına ve Yaş Doğrulamaya İlişkin Yönetmelik), in issue 33396. Protecting children online is a legitimate aim. The way Türkiye chose to enforce it deserves more scrutiny than the aim does.
The case for the rules
The strongest argument for the rules is that platform self-regulation has failed. Self-declared birthdates are trivially falsified, and companies have little commercial reason to look closely at who is behind an account. A state-issued credential gives a hard check that does not depend on any single company's goodwill. Türkiye has also built the token to be minimal. According to Hürriyet, it indicates only whether a user meets the 15 and 18 age thresholds, with no names or other identifying data. That is a more privacy-protective design than uploading ID documents to private companies, which many age-assurance schemes require.
What the regulation requires
Per the same reporting, platforms may not let under-15s open accounts. Accounts for teenagers must offer differentiated services: private by default, no livestreaming, no personalised ads and no infinite scroll. Parents get controls over settings, screen time and purchases. Existing accounts must be verified by 31 March 2027.
The legal basis is Law No. 7578, passed in late April 2026. Bianet reports that Article 22 of that law amended Additional Article 4 of Internet Law No. 5651 and puts the enforcement duty on social media providers. Daily Sabah reported in April that the law also requires differentiated content for 15-to-18-year-olds, local representatives for platforms with over 1 million Turkish users, and one-hour responses to harmful-content notices.
One detail is still unclear. Hürriyet describes the teen protections as applying to 15-17 accounts, while bianet describes a 15-to-18 band. The text of the regulation should settle which applies. I could not read the scanned Official Gazette PDF, so I have not checked the regulation's articles or any sanctions for non-compliance.
The gatekeeper problem
The token is only as private as the system that issues it. Bianet notes that the platform must confirm the token was generated through e-Government under the authority of the Cybersecurity Directorate. So every verification passes through a state-run identity system, whatever the token contains.
That is a structural change. An age check was supposed to answer one narrow question. Here it also makes a government login the precondition for using private speech platforms. The state does not need to log which platform you verified for in order to have a chokepoint. It only needs to be able to issue, delay or decline tokens. The state also runs the one system that links a token request to a real citizen. A design promise of "no identifying data in the token" is a policy choice, and a later regulation could revise it.
The free-speech cost falls on adults. Bianet reports that enforcement could require platforms to verify the ages of virtually all users, because a platform cannot exclude under-15s without knowing who is not one. Anonymous and pseudonymous accounts are how dissidents, minority communities and whistleblowers speak safely. Türkiye already has a record of blocking content and accounts. The EFF documented in October that access to websites and social media accounts of LGBTQ+ and feminist groups has been restricted since mid-September. Those facts do not prove the verification system will be misused. They do mean that the safeguard against misuse cannot rest on trust alone.
Bianet also notes that the regulation does not list the services it covers, so whether services like YouTube or WhatsApp fall under the rules depends on the statutory definition. That ambiguity is risky for platforms and users alike. When a rule is vague and the regulator is also the identity issuer, the regulator holds unusual leverage over platforms that want to stay in the market.
A more proportionate path
The goal of keeping young children out of adult-oriented feeds does not require a single mandatory state login. Proportionate alternatives exist:
- Accept several privacy-preserving age-assurance methods, including independently audited ones, rather than one government credential.
- Put token issuance and metadata handling under statutory limits that independent oversight can enforce, with a ban on logging which platforms a token was used for.
- Publish the full list of covered services and the criteria for coverage.
- Require transparency reporting on how many tokens were requested, issued and refused.
- Review the scheme on a fixed schedule, with evidence on whether under-15s are actually kept off platforms.
The verification deadline for existing accounts, 31 March 2027, gives Türkiye five months to build these safeguards in. If it does not, a child-safety measure will have created an identity checkpoint for speech that serves the state more than it serves children. Other governments weighing age-verification mandates should watch whether the token stays as thin as promised.