Turkey's under-15 social media rules: what platforms must do

The short answer

From 1 November 2026, Turkey's Internet Law (No. 5651), as amended by Law No. 7578, bars social network providers from serving children under 15 and requires them to verify users' ages, with a separate, restricted service for users aged 15 to 17. A regulation published on 10 October 2026 sets out the details, including content-filtering settings for those accounts and human review of appeals. Existing accounts must be verified by 31 March 2027.

"Social network provider" is the law's term for any service where people create, view or share content to interact with each other, so the rules reach further than the big social networks. Ages are checked with a token from e-Devlet, the government's online services portal. The token tells the platform only whether the user is under 15, 15 to 17, or 18 or over.

Who is who

• Law No. 5651. Turkey's Internet Law of 2007. Its Additional Article 4 (ek madde 4, written "ek 4" below, so "ek 4/7" is its paragraph 7) holds the duties of social network providers. Law No. 7578 changes that article and adds Additional Article 5 (Ek Madde 5) on game platforms, both from 1 November 2026.
• Social network provider (sosyal ağ sağlayıcı). Any real or legal person that lets users create, view or share content such as text, images, sound or location on the internet for social interaction (Law 5651, Art. 2(1)(s), repeated in the regulation, Art. 4(1)(e)). The definition has no size threshold and names no apps.
• Presidency of Cyber Security (Siber Güvenlik Başkanlığı). A body attached to the Presidency of the Republic (Cumhurbaşkanlığı). Since 31 July 2026, Law No. 7590 has made it the authority for the social network rules in Law 5651, a role the Information and Communication Technologies Authority (BTK) used to hold. It issued the 10 October 2026 regulation, and its head executes it (Art. 14). Older texts and news name BTK. "The Presidency" below means this body.
• The regulation. The Regulation on Separated Services for Children and Age Verification by Social Network Providers (our translation of Sosyal Ağ Sağlayıcı Tarafından Çocuklara Özgü Ayrıştırılmış Hizmet Sunulmasına ve Yaş Doğrulamaya İlişkin Yönetmelik), Resmî Gazete No. 33396, 10 October 2026. An article number with no law named is one of its articles.
• Child (çocuk). Anyone under 18, even if they come of age earlier (Art. 4(1)(ç)).
• Separated service (ayrıştırılmış hizmet). The version of a social network that children aged 15 to 17 get, with safety, privacy, content presentation, algorithm, communication and parental-control settings suited to their age and development (Art. 4(1)(a)).
• Age verification token (yaş doğrulama belirteci). A token the user creates on e-Devlet and uploads to the platform. It holds only the age band: no name, no user name, nothing that identifies the user. The platform checks that the Presidency issued it and may use it for nothing but age verification (Art. 7(1)).
• Daily access from Turkey (Türkiye'den günlük erişim). The law's measure of a platform's size. Some duties start above 1 million or 10 million daily accesses from Turkey.

Timeline

Who is covered

The regulation applies to every social network provider that can be reached from Turkey, whether it is based in Turkey or abroad, and to its users (Art. 2). The core duties have no size threshold: not serving under-15s, checking ages, running the separated service, parental controls and measures against deceptive ads.

Other duties in ek 4 depend on size:

• More than 1 million daily accesses from Turkey: a representative in Turkey if the provider is based abroad (ek 4/1); an answer within 48 hours to applications from individuals, with reasons for a refusal, a duty that from 1 November 2026 is no longer limited to applications about content under Arts. 9 and 9/A (ek 4/3); six-monthly reports to the Presidency (ek 4/4); and measures to keep Turkish users' data in Turkey (ek 4/6).
• More than 10 million daily accesses from Turkey: urgent decisions carried out within one hour, and measures against re-publication (ek 4/22 and 4/23, below).

Game platforms have their own article, with a line at 100,000 daily accesses for platforms based abroad (see Game platforms, below).

Two more points:

• Visitors. People who do not live in Turkey and are there for a while are exempt from these age checks. To use a social network while in Turkey, they can apply for an exceptional token, which the Presidency issues through e-Devlet from passport details alone, without identity verification (Art. 7(1)(d)).
• No general monitoring. Law 5651 still says a hosting provider need not check the content it hosts or look for unlawful activity (Art. 5(1)). The new duties are specific ones, such as the under-15 ban, age checks, the service for users aged 15 to 17 and, for the largest platforms, stopping re-publication.

The duties, article by article

"ek 4/7" means Law 5651, Additional Article 4, paragraph 7, as in force from 1 November 2026; "Art." means the regulation. The last two columns are our reading.

Accounts for users aged 15 to 17

Under the regulation anyone under 18 is a child (Art. 4(1)(ç)), and children who have turned 15 get the separated service. Their accounts follow these rules (Art. 8(5)):

• no features that may build addiction;
• private by default, with no option to make the account public;
• followers and followed accounts visible only to the child;
• messages only from accounts the child follows, with no "seen" receipts;
• no syncing with phone contacts, address books or friend lists from other apps, and no use of such data; a parent's contact details may still be used for sign-up, recovery, security and parental supervision;
• the child's account is not suggested to others, and no accounts are suggested to the child;
• technical measures so that others cannot screenshot the child's profile photo, account, posts and images;
• no option for the child to start a live stream;
• no design that serves visual content one item after another as the child scrolls, taps or clicks, or on its own, in the app, on the website or anywhere else;
• no personalisation based on the child's behaviour, no profiling and no personalised commercial ads.

The duty a moderation API touches is Art. 8(4): content-filtering and recommendation settings that reduce the child's exposure to content that may harm their development. Art. 8(6) asks the platform to publish these measures on its own site.

What "content-filtering settings" means in practice

This is our reading, not legal advice. Art. 8(4) names no categories and no method. Read with Art. 8(1), which asks the platform to take into account the child's age, best interest and development, and the prevention of sexual abuse and commercial exploitation, it points to five pieces of work:

1. Decide which kinds of content you keep from users aged 15 to 17, for example sexual content, violence, hate, self-harm and scams.
2. Classify each post, comment, message and image into those kinds as it arrives.
3. Keep flagged items out of what these accounts see: posts, search results, recommendations and messages.
4. Send doubtful items to a person, and handle appeals (Art. 10).
5. Describe the measures on your site (Art. 8(6)).

Step 2 is what a content moderation API does. The other four are your policy and your product.

Appeals need a person

Every platform needs a free, accessible way to apply and appeal, with a Turkish option, that settles cases quickly (Art. 10(1)). It covers three things: the result of an age check, a suspended or closed account, and measures taken under the separated service. It is open to the people the platform has acted on (Art. 10(2)).

• An application or appeal may not be reviewed by fully automated systems (tamamen otomatik sistemlerle incelenemez) and gets meaningful human review (anlamlı insan incelemesi) (Art. 10(3)).
• The account's content and personal data are kept until the appeal is settled (Art. 10(4)).
• The decision tells the user they can complain to the Presidency and go to court (Art. 10(5)).
• Once a year, the platform sends the Presidency the number of applications and appeals, the acceptance rate and the average time to decide, and publishes them on its own site (Art. 10(6)).

Our reading: when a filter under the separated service affects a user aged 15 to 17, for example by holding back a post they wrote, an appeal about it needs a person. Art. 10(3) rules out settling it with a second automated check.

Platforms with more than 10 million daily accesses

Two duties start on 1 November 2026 for the largest platforms:

• One hour for urgent decisions (ek 4/22). Art. 8/A of Law 5651 lets the authorities order content removed or blocked when delay would be harmful, for example to protect life, national security, public order or public health. Such orders generally have to be carried out within four hours; above 10 million daily accesses, within one hour.
• No re-publication (ek 4/23). The platform takes every necessary measure so that content covered by a removal or access-blocking decision under Law 5651 is not published on its site again. The law does not say how. In practice it means recognising copies of specific content, usually by fingerprint (hash) matching. A classifier such as Detectivision judges categories, not copies.

From 1 November 2026, the six-monthly reports of platforms above 1 million daily accesses also cover how they apply ek 4/23 (ek 4/4).

Game platforms

Law 7578 also brings game platforms into Law 5651. A game platform is anyone who provides the software or technical infrastructure to show, sell, distribute, download or play digital games and related content online, and who provides or coordinates users' access, licence management or interaction (Law 5651, Art. 2(1)(ü), in force since 1 May 2026). From 1 November 2026, Ek Madde 5 says:

• Offer only games rated by age. An unrated game may be offered if it carries the highest age rating, and unrated content must be removed (5/1).
• A game platform based abroad with more than 100,000 daily accesses from Turkey appoints a representative in Turkey, tells the Presidency, and shows the representative's contact details on its site (5/2).
• Provide parental controls for account settings, and parental permission or approval for purchases, rentals and paid memberships (5/3).
• Give the Presidency the information it asks for within the time it sets, at most 15 days (5/4).
• If a duty is still unmet 30 days after the Presidency's notice, fines run from 1 to 10 million Turkish lira, then from 10 to 30 million, then bandwidth cuts of 30% and up to 50% (5/6 and 5/7).

Ek Madde 5 says nothing about chat moderation. A game with chat or user posts may also be a social network provider; ask your lawyer.

What is still open

• The token guide. The Presidency prepares a guide to the token's technical structure, its data format and the steps a platform follows to check it, and shares it with social network providers (Art. 12(1)). The regulation does not say it will be published, and we had not seen a public copy by 16 October 2026.
• More detailed rules. The Presidency may set procedures for the separated service (Art. 8(7)) and for the regulation as a whole, and settle doubts about it (Art. 12(2)).
• Game platform rules. Ek Madde 5(5) leaves the details, including how games are rated, to a regulation. We read the table of contents of every Resmî Gazete issue from 1 May to 16 October 2026, supplementary issues included, and found none.

Where a moderation API fits

A content moderation API sorts content into categories. Under these rules that helps with three duties.

1. Content filtering for users aged 15 to 17 (Art. 8(4)). Check each post, comment, message and image as it arrives, and keep flagged items from these accounts. Detectivision checks images, and text in English, Spanish, Portuguese, French, German, Italian, Turkish, Arabic, Russian and Hindi. The public status endpoint listed these flags on 16 October 2026; GET /api/v1/flags shows the ones your account may send.

Each flag has a threshold, 0.5 by default, and findings below it never come back. So act above your own line: for these accounts you might hide everything flagged at once, and send results with a confidence between 0.5 and 0.7 to a person who can put them back. See Flags.

2. Deceptive ads (ek 4/21). Check ad images with the scam flag, which marks images made to trick people, such as a fake giveaway or a fake payment screen. Text has no scam flag, so ads made of text alone need your own checks.

3. A record of the human decision on appeals about filtered content (Art. 10(3)). A moderator opens the request in the dashboard's Logs, takes one of your own actions, such as Uphold or Reverse, and can add a note. Your system can receive a moderation.action webhook that says which action was taken and who took it, so the decision sits on record next to the appeal. Put your appeal or user id in metadata: it comes back with the result and with every action. See Metadata and actions.

Detectivision never acts on your platform itself: your system carries out every decision. For Turkish swear words and insults, see the Turkish offensive language detection API. Where the checks go in a product: online communities, games and dating apps. Detectivision in Turkish: detectivision.ai/tr.

Talk to us

Start the free trial

What this does not do

• No age checks. Detectivision does not verify or estimate ages, read e-Devlet tokens or handle appeals about age.
• No product settings. Parental controls, privacy defaults, contact-sync limits, screenshot blocking and the other Art. 8(5) rules are features you build.
• No copy matching. It does not recognise re-uploads of specific content (ek 4/23) and has no hash matching.
• No decisions. It flags content and records your team's actions. It does not decide appeals, answer users or report to the Presidency.
• Whole-item flags. Each flag judges the whole text or image. Current plans return no word positions, boxes, masked text or blurred copies.
• Not every language. Text checks are reliable in English, Spanish, Portuguese, French, German, Italian, Turkish, Arabic, Russian and Hindi, and a flag may cover only some of them. Text in other languages is checked, but the results are not reliable (Text).
• No video, audio or live streams yet. They are coming soon.
• Not legal advice. A moderation API can help you meet the filtering duty in Art. 8(4). Whether your measures are enough is for you and your lawyer.

Changelog

• 16 October 2026. First version, from Resmî Gazete issues 33240 (Law 7578), 33326 (Law 7590) and 33396 (the regulation), and the consolidated Law 5651 on mevzuat.gov.tr.