Turkey's ban on social media for under-15s took effect on 1 November 2026. The case for it is serious. Children face real harms online, including compulsive-use design, contact from strangers and targeted advertising. Platforms have been slow to fix these on their own. A rule that puts the verification duty on companies, rather than on children or parents, answers a real enforcement gap. By the standards of age-assurance schemes elsewhere, Turkey's technical design is also better than average.
The design still carries risks that the government has not shown it can manage. It matters most in a country where Freedom House rates the internet "Not Free."
What changed on 1 November
According to Turkish Minute, the ban rests on amendments to the internet law published on 1 May, followed by a regulation published on 10 October. The amendments gave social media provisions a six-month transition. Platforms must now reject account applications from children under 15. Existing accounts must be verified by 31 March 2027, and under-15 accounts found along the way are to be closed after notification, with a chance to challenge the decision.
Users prove their age by authenticating on e-Devlet, the government services portal. They receive a digital token showing whether they meet the age thresholds of 15 and 18, and they upload it to the platform. Hurriyet Daily News reports that the token contains no names or other identifying information.
For 15-to-17-year-olds the rules go beyond access. Per the same reports, accounts must stay private. Livestreaming and personalized advertising are prohibited, and direct messages are limited to accounts the teenager follows. Hurriyet also reports a ban on infinite-scroll feeds, and platforms must provide parental controls over settings, screen time and paid transactions. Turkish Minute adds that they must offer a free appeals process in Turkish with human review.
The legal basis is the internet law, Law No. 5651. Bianet reports that the duty derives from Article 22 of Law No. 7578, which amended Additional Article 4 of Law 5651. We could not independently check that article number against the statute text.
The strongest part of the design
The token approach avoids the worst pattern in age assurance, which is handing passports or face scans to every app. If the token carries only an over-15 or over-18 flag, a platform learns nothing about who the user is. The government's stated claim is that the system will protect children without sharing identities with social media companies. If that holds, it beats the commercial alternatives, which concentrate biometric and ID data in private verification vendors.
The 15-to-17 protections are also the kind of design-focused rule this publication has argued for. They regulate product features such as private-by-default accounts, no livestreaming and limits on who can message a teenager. They do not regulate speech.
Where the privacy claim runs out
The token hides the user's identity from the platform. It does not hide the user from the issuer. Getting a token means authenticating to a state portal, so the state is in the loop for every verification. Bianet reports that platforms must confirm the token was issued under the authority of the Cybersecurity Directorate. Nothing in the sources we could read says what the state logs, how long it keeps records, or whether it can link a token request to a later account. That is an inference from the architecture, not a documented practice, but it is the question that decides whether the scheme is privacy-preserving or merely privacy-looking.
The scope is the second problem. Bianet warns that enforcement could require platforms to verify the ages of virtually all users, including adults with anonymous accounts. Because existing accounts must be verified by 31 March 2027, anonymity on mainstream platforms ends in practice for anyone who stays. In a country where Freedom House's Freedom on the Net 2026 reports throttled social media during opposition demonstrations, scores of blocking and removal orders, and criminal charges for users' posts, anonymity protects dissent. Freedom House scores Turkey 31 out of 100 and warns that the age-verification law threatens online privacy by requiring platforms to install verification systems or face heavy fines and bandwidth restrictions. We could not confirm fine amounts in the sources we reviewed.
The appeals right and the human-review requirement are welcome. But they address wrongly closed accounts. They do not address surveillance risk.
What proportionate implementation would look like
A proportionate version of this policy is achievable, and the building blocks are already in the rules. We would test Ankara against four conditions:
- Publish the issuer's data practices. The Cybersecurity Directorate should state in law what token-issuance logs it keeps, for how long, and who may access them.
- Make tokens unlinkable. Tokens should be single-use or rotating, so a platform account cannot be tied back to a specific e-Devlet session.
- Bar secondary use. Verification data should be legally barred from use in content-removal, criminal or intelligence proceedings.
- Independent oversight. An audit body outside the executive should be able to inspect the system.
The design-based rules for teenagers should be kept and evaluated on evidence. If they cut harm, they show that product constraints can do the work a blanket ban does clumsily. A hard ban for under-15s may also push children toward unregulated corners of the internet, which makes measured outcomes more important than announcements.
The bottom line
Turkey has built a technically thoughtful age gate on top of an institutional environment that gives users little reason to trust it. The token design deserves credit. Whether the scheme protects children without becoming an identity layer for the whole network depends on safeguards that the sources available so far do not describe. Until they are published, the burden of proof sits with the government, and other countries copying the model should copy those safeguards first.