One and a Half Million Blocked Sites
On June 26, 2026, Turkey's Freedom of Expression Association (İFÖD) published its EngelliWeb 2025 annual report, documenting 1,505,484 websites and domain names blocked inside Turkey — produced by more than 1.28 million separate decisions issued by hundreds of courts and state institutions. In 2025 alone, 232,000 sites were added to that total, a single-year record.
The report's title, "Digital Martial Law: Silencing the Public Under the Pretext of Public Order," is not rhetorical flourish. It describes a censorship apparatus that has become structural, pervasive, and — as Turkey's 2026 legislative agenda makes clear — still expanding.
The Legal Machine
Turkey's internet regulation framework centers on Law No. 5651, enacted in 2007 and amended repeatedly since. Its Article 8/A provision, which permits blocking on grounds of "national security and public order," has evolved into the regime's primary legal instrument. The Information and Communication Technologies Authority (BTK) administers the framework alongside broadcast regulator RTÜK and capital markets regulator SPK.
Article 8/A blocking decisions surged from 71 in 2024 to 179 in 2025 — a 152% increase — and the targeted addresses jumped from 828 to 6,300. Courts in Istanbul's Çağlayan district recorded a 99% noncompliance rate with Constitutional Court rulings protecting online expression, according to data compiled from the EngelliWeb report. The targets are revealing: the most common subjects of Article 8/A blocking in 2025 were independent media, Kurdish-language outlets, and content critical of government officials — not the national security threats the provision was designed to address.
Throttling as Political Precision Tool
Turkey has complemented blanket blocking with selective throttling — targeted bandwidth restrictions deployed during political crises, leaving the government deniability while achieving suppression.
When Istanbul Mayor Ekrem İmamoğlu, the main opposition presidential candidate, was arrested on March 19, 2025, authorities throttled access to X, YouTube, Instagram, and TikTok for 42 hours. When police blockaded the Republican People's Party (CHP) headquarters in September 2025, access to eight platforms — including WhatsApp, Telegram, and Signal — was restricted for 21 hours. Turkey's Interior Ministry examined 257,481 social media accounts in 2025, a 30% increase from 2024.
Mandatory Identity Verification: Closing the Anonymity Gap
The EngelliWeb report landed weeks after Turkey's parliament had already passed its next major control layer. On April 22-23, 2026, the Grand National Assembly adopted amendments to Law No. 5651 requiring mandatory identity verification for all social media users on platforms with more than one million daily Turkish users — capturing X, YouTube, TikTok, Instagram, and Facebook.
The mechanism routes verification through e-Devlet, Turkey's national digital government portal. Personal identity data is not shared with platforms but is held by BTK. Accounts that do not comply during the implementation window will be closed. A separate provision bans children under 15 from social media entirely; ages 15-17 face access restrictions.
The government's stated case for this measure has some substance. Universal account verification does address real problems: coordinated inauthentic behavior, mass bot campaigns, anonymous harassment, and identity fraud. Justice Minister Akin Gürlek cited these harms when announcing the law.
But the civil liberties trade-off is stark and asymmetric. Online anonymity is not primarily a convenience — it is a prerequisite for political speech in high-stakes environments. Whistleblowers, journalists protecting sources, domestic abuse survivors, LGBTQ+ users in hostile social contexts, and political dissidents all depend on the ability to communicate without identity disclosure. A system that ties every account to a national ID held by the same regulatory authority that issues blocking orders is not, in context, a neutral accountability measure. It is a surveillance chokepoint.
VPN Licensing: The Final Circuit Breaker
Turkey's internet authorities have long known that VPN services are the primary technical workaround for its blocking regime. By end of 2025, 454 VPN server addresses linked to 26 services — including Proton, Surfshark, TunnelBear, and CyberGhost — had already been blocked.
In April 2026, the government announced pending legislation to formalize this into a licensing system: all VPN providers operating in Turkey would need to register with the state and comply with Turkish legal obligations, or face nationwide blocking. The government justified the proposal by citing school shootings in Kahramanmaraş and Şanlıurfa that month, claiming perpetrators had accessed violent online content via VPN.
The pattern is familiar across restrictive digital regimes: introduce a maximally scoped regulatory framework with a tragic and politically irresistible justification. VPN regulation in this context is not a child safety measure — it is the removal of the last broadly accessible circumvention tool used by journalists, activists, and ordinary users to reach blocked content.
The Architecture Underneath the Numbers
Freedom House's 2025 Freedom on the Net report rated Turkey 31 out of 100 — a "Not Free" classification placing it in the bottom tier of 72 assessed countries. That assessment covered through May 2025. The 2026 legislative session has since added mandatory identity linkage and pending VPN licensing.
The cumulative picture is not of a country struggling to balance free expression with legitimate regulatory interests. It is of a censorship apparatus built methodically over eighteen years, now closing its remaining gaps. The Law 5651 amendments have progressively expanded blocking authority. Cybersecurity Law No. 7545, passed in March 2025, added criminal penalties for companies that resist government information requests. The ID verification mandate removes anonymity. The VPN licensing regime would close circumvention.
What the EngelliWeb numbers document is the run-up to a qualitative shift: from a regime that blocks content to one that identifies people. Once every account on every major platform is linked to a national ID held by BTK, the question changes. It is no longer "which URLs can we block?" It becomes "who said this?"
That is not a censorship infrastructure. It is a surveillance one.