Turkey's regulation on child-specific differentiated services and age verification by social network providers entered into force on 1 November 2026. Platforms must now verify age at account creation and keep under-15s off their services. Existing accounts must be verified by 31 March 2027. The rule is one of the more technically thoughtful age-assurance designs yet adopted, and also one of the bluntest in what it forbids.
The strongest case for the rule
The argument for acting is serious. Platform self-declared ages are trivially false, and voluntary age limits have never been reliably enforced by the platforms that set them. A statutory floor with a verification duty at least makes the age limit real. Parents who want their children off these services currently face a collective-action problem: one child opting out of a platform cuts them off from their peers. A legal rule resolves that. A government that chooses to act on youth wellbeing is not being unreasonable.
What the regulation actually requires
The regulation was published in Official Gazette No. 33396 on 10 October 2026. Its full title is the Regulation on the Provision of Child-Specific Differentiated Services and Age Verification by Social Network Providers. It implements obligations created by Law No. 7578, published in the Official Gazette of 1 May 2026 (No. 33240). A law firm summary says those obligations take effect six months after publication, which is 1 November (Moroglu Arseven via Mondaq).
According to Euronews Turkish's reading of the text, the design has three notable elements:
- A token, not an ID upload. Users obtain an age-verification token through the e-Devlet government gateway. The token reveals only whether the holder is under 15 or between 15 and 18. It carries no name or personal data, and platforms may use it for nothing else.
- A restricted tier for 15 to 17-year-olds. Accounts are private by default, follower lists are hidden, live streaming is barred, infinite or auto-playing feeds are barred, and profiling and personalised advertising are prohibited. Parental tools cover settings, spending and usage time.
- Appeal safeguards. Platforms must offer a free Turkish-language appeal route with meaningful human review, and may not delete content while an appeal is pending.
Accounts of users found to be under 15 are closed with notice, per the same report. The TechPolicy.Press October roundup confirms the 1 November entry into force and the 31 March 2027 deadline for existing accounts.
Where the design deserves credit
The token model is better than what most democracies are debating. Many age-assurance schemes force users to hand a face scan or passport image to a private vendor, creating a honeypot and a commercial incentive to retain data. A one-bit attestation issued by the state and consumed by the platform minimises what the platform learns. The mandatory human review of appeals and the ban on deleting content during an appeal also respect users who are wrongly classified. If every age-verification mandate looked like this on privacy, the debate would be calmer.
Where it overreaches
The problems are in proportionality and in the surrounding legal environment.
First, the rule is a flat prohibition for a 14-year-old, with no apparent route for parental consent. A legal guide cited by one law firm notes that no parental-consent exception appears in the under-15 rule. Evidence that a blanket ban beats a well-enforced safe-by-default tier is thin. The 15 to 17 tier already shows Turkey can legislate design protections, such as private defaults and no autoplay, that target the mechanisms of harm rather than the age of the speaker. Applying those protections to younger teens with parental opt-in would have been more proportionate than excluding them entirely.
Second, the government identity layer matters for speech. Bianet reports that enforcing the rule could require platforms to verify the ages of virtually all users, which could reach adults who use anonymous accounts. Officials have said identities will not be disclosed to platforms. But in a country where social media is already a frequent target of access restrictions, anonymity depends on the issuing state's restraint, not on technology. The token's privacy properties are only as strong as the legal and institutional promise that e-Devlet will not log which platform asked for which token. The regulation, as reported, offers no independent audit of that promise.
Third, the enforcement toolkit is heavy. The regulation points non-compliance to the relevant provisions of Law 5651, and the Mondaq summary of the underlying law describes administrative fines of up to 3% of global turnover for certain obligations. If a provider has not complied 30 days after notice, advertising bans follow, and then bandwidth reductions of 50% and later up to 90%. Bandwidth throttling is a collective penalty: it degrades the service for every Turkish user, including adults who have done nothing wrong, in order to pressure a company over a compliance dispute. A child-safety rule should not carry the same remedy as a national-security one.
Fourth, the transition is tight. Platforms have had weeks, not months, between the regulation's publication and entry into force, to integrate with a government gateway. The reported regulatory design does give platforms until 31 March 2027 for existing accounts, which is a sensible phasing. Turkey should publish clear technical documentation and a sandbox for integration so that compliance failures reflect real misconduct and not integration gaps.
What to watch
The regulation requires annual reporting of application and objection numbers, acceptance rates and resolution times, which should be published by the platforms. That is the right instrument: it lets outsiders measure false-positive rates, which is the central empirical question for any age gate. If the data show many wrongly blocked adults and teenagers, the case for the blanket ban weakens. If they show low error rates and verified safe-by-default effects on 15 to 17-year-olds, Turkey will have built a model other countries can copy selectively.
The sensible reading is to keep the token architecture, the restricted teen tier and the appeals duty, and to revisit the hard under-15 bar and the throttling remedy once the first year of reporting data is public.