Türkiye's implementing regulation for its child social-media law was published in the Official Gazette on 10 October 2026. From 1 November, platforms may not serve children under 15. The Gazette index for that day (Issue 33396) lists the instrument as the Regulation on Providing Child-Specific Differentiated Services and Age Verification by Social Network Providers. Whatever one thinks of the ban, the more consequential design choice is how age is checked.
The case for acting
The strongest argument for the law is a plain one. Parliament passed it in April, a week after a 14-year-old killed nine students and a teacher at a middle school in Kahramanmaraş, according to Al Jazeera. Parents have long complained that platforms' self-declared birthdates do nothing. Engagement-maximising design, such as infinite scroll, personalised ads and public livestreams, is a legitimate target for regulation. A government that wants protections for minors is not being unreasonable. Nor is it wrong to say that voluntary compliance has failed.
What the rules require
According to The Next Web, citing Bloomberg, platforms must verify age at sign-up using a token from Türkiye's e-government system. Anyone found to be under 15 must be blocked. Existing accounts must be checked by 31 March 2027, and accounts held by under-15s must be closed.
Accounts for 15–17-year-olds must be private by default and filtered. They may not offer livestreaming or personalised ads, and platforms must block screenshots of them. Teens can message only accounts they already follow, and endless-scroll feeds must be switched off. Daily Sabah reports that parents must get tools to manage settings, limit screen time and approve paid purchases. The covered list includes Instagram, Facebook, X, TikTok, Snapchat, YouTube, WhatsApp, Telegram, Discord and Reddit.
The parent statute is Law No. 7578, published in the Official Gazette of 1 May 2026 (No. 33240). As summarised by GUN + Partners, it amends Internet Law No. 5651. It shortens urgent takedown deadlines from four hours to one for providers with more than 10 million daily visits. It also lets the regulator, BTK, bar Turkish advertisers from dealing with non-compliant providers and throttle their bandwidth. The Next Web reports potential fines of up to 3% of global revenue.
The real design decision: a state-issued age token
Most age-assurance debates turn on a tension between accuracy and privacy. The usual approach has users upload a face scan or ID to a private vendor. Türkiye has chosen a third route in which the state is the verifier.
In principle this is better than a patchwork of commercial face-estimation vendors. A government-issued token can be accurate, cheap for platforms and limited to a yes/no answer. Whether the token reveals more than age is the question that matters. That depends on implementation details the regulation will have to settle. A token that carries only an over-15 or under-15 assertion is a reasonable design. One that ties every login to a national identity number is not.
That second outcome would end pseudonymous social media in practice. It would give the state a record of which citizens use which services and when. Türkiye already has a record of restricting platforms during political stress. Al Jazeera notes that critics recall the throttling of communications during the 2025 protests that followed the jailing of Istanbul mayor Ekrem İmamoğlu. A system that links accounts to identities looks different to a user in that setting than the same system would in a country with strong data-protection enforcement.
Proportionality problems
Three features of the package look disproportionate to the harm they address.
- Collateral scope. Covering WhatsApp, Telegram and YouTube alongside feed-driven apps treats messaging and video-viewing as equivalent to algorithmic social feeds. Under-15s lose group chats with classmates and family, which are neither addictive nor high-risk.
- Sanctions that hit everyone. Bandwidth throttling degrades service for all Turkish users, not just the offending minors' accounts. It also blurs a child-safety tool with a speech-control tool, because the same bandwidth lever exists in a law whose one-hour takedown rule is already a pressure point for political content.
- Easy circumvention. Critics cited by Al Jazeera warn that bans can be dodged through VPNs or an adult's account. The Next Web notes that even in Australia, which led on under-16 limits, enforcement has struggled. A rule that families can sidestep without cost mainly pushes children towards less-regulated corners of the internet.
The opposition CHP argues for rights-based policies over bans, per Al Jazeera. That is a position worth taking seriously, although a ban is a blunter instrument than the design mandates for 15–17-year-olds. Default privacy, no personalised ads to minors and no infinite scroll are measures that improve products without removing teenagers' access. They are also the part of the rules least likely to be abused.
What to watch
There are four tests between now and 31 March 2027.
- Token scope. Does the e-government token disclose only an age band, and does the regulation forbid platforms from storing identity data?
- Data-protection oversight. Does the data-protection authority, KVKK, have a role in policing what the state and platforms retain?
- Sanction choice. Does BTK use advertising restrictions and proportionate fines before bandwidth throttling?
- Evidence. Will the government publish figures on accounts closed and on any displacement to unregulated services?
Protecting children online is a legitimate aim, and Türkiye is entitled to pursue it. The design that lets it succeed without becoming an identity checkpoint is a narrow, privacy-preserving age signal, graduated penalties and published evidence. The published regulation should be judged on those points, and on whether the 1 November start date allows platforms the time to build to them.