The announcement
On September 14, 2026, Turkey's Family and Social Services Minister Mahinur Özdemir Göktaş confirmed that Ankara is building the technical backbone for its under-15 social media ban through e-Devlet, the government's digital-identity portal. Platforms will not receive a user's name or ID number — the portal instead issues a one-way "unique key" confirming only whether the user clears the age threshold (Turkish Minute, Sept. 14, 2026). The law behind this, No. 7578, was adopted by the Grand National Assembly on April 22, 2026, approved by the President on April 30, and published in the Official Gazette on May 1 (Issue 33240) — putting its social media and gaming provisions into force on November 1, 2026, six months later (TBMM legislative record).
The steelman: a real harm, a real gap
Before litigating the mechanism, the underlying concern deserves a fair hearing. Turkey's data protection authority, KVKK, opened ex officio investigations into six major platforms — TikTok, Instagram, Facebook, YouTube, X, and Discord — in February 2026 over how they process children's personal data, citing "the best interests of the child" as the operative standard (KVKK public notice). That's not a manufactured pretext. Engagement-optimized feeds, unmoderated DMs, and weak self-declared age gates are a documented pattern across jurisdictions, and Turkey is hardly alone in acting on it — Australia, France, and several U.S. states have all moved on under-16 access in the past two years. A regulator that has evidence children are being served products not designed for them has standing to intervene.
The design choice that actually matters
What separates a defensible age-verification regime from an invasive one is architecture, not intent. A system that answers a yes/no age question via a trusted government intermediary — without handing platforms a name, a national ID number, or a persistent identifier they can retain — is close to best practice. It resembles the token/attestation models privacy advocates have pushed as an alternative to platforms collecting scanned IDs or biometric face scans directly, which is the approach several U.S. states and the UK's Online Safety Act have defaulted to. If Ankara's implementation matches Özdemir Göktaş's description — a single-use confirmation with no identity payload retained by the platform — the under-15 gate itself is a proportionate response to a specific, evidenced harm.
The bigger problem: a parallel draft for everyone
The part of this rollout that should worry a free-speech-minded observer sits outside the headline. When the underlying bill passed the Assembly in April, Justice Minister Akın Gürlek disclosed that a separate draft is already in preparation requiring all Turkish social media users — not just minors — to verify their identity through e-Devlet at login (Balkan Insight, April 23, 2026). That is a categorically different proposal. An anonymized age check answers one narrow question and forgets it; a login-time identity requirement for adults creates a durable, government-mediated link between every account and a real person, in a country where courts have ordered blanket account blocks with some regularity — 246 accounts in a single market-manipulation sweep this month, per contemporaneous reporting. Critics quoted in that same report argue the plan would let authorities strip anonymity from dissenting speech under a child-safety banner that never required it. The steelman for under-15 protection does not extend to under-65 protection, and regulators should not be allowed to borrow the legitimacy of one to justify the other.
The gaming rider
Law No. 7578 also requires foreign gaming platforms with more than 100,000 daily Turkish users to appoint a local representative and register them with BTK, the telecoms regulator, publishing contact details on-platform (PILC Law analysis; Digital Policy Alert tracker). Unlike the identity-verification question, this is a fairly conventional accountability mechanism — the EU's Digital Services Act imposes similar legal-representative duties on large platforms — and the threshold is high enough to exempt small studios and niche titles. The risk here is less philosophical and more practical: BTK's toolkit for non-compliance includes bandwidth throttling and access blocking, and a regulator that already exercises that power liberally against social platforms has little reason to use it sparingly against gaming platforms that miss a filing deadline.
What proportionate regulation looks like here
The test for any age-verification regime should be: does it collect the minimum data necessary, held by the minimum number of parties, for the shortest necessary time? On the current public description, the under-15 e-Devlet token clears that bar. The undisclosed identity-verification draft for all users does not, and its existence should shape how the November 1 rollout is scrutinized — not as an isolated child-safety measure, but as the first phase of a broader authentication infrastructure whose second phase has not yet been published for comment. Regulators asking platforms to verify age without seeing identity have made the right call once. The test is whether they make it again when the population being verified is everyone.