Operates a social platform, in Turkey

Law No. 5651, Ek Madde 4, as amended by Law No. 7418 (13 October 2022) · Read the law's page

• Binds a social network provider, meaning a person that enables users to create, view or share content such as text, images, sound or location for social interaction (Article 2(1)(s)). Paragraphs 1, 3, 4 and 6 of Additional Article 4 apply from more than one million daily accesses from Turkey; the paragraph 7 duties below state no such threshold.
• Do not provide the service to a child who has not completed fifteen years of age, and take the necessary measures, including age verification, to prevent that (paragraph 7, as replaced by Law No. 7578, in force since 1 November 2026).
• Take the measures necessary to offer a service specifically differentiated for children who have completed fifteen years, and publish the measures taken under paragraph 7 on your own website (paragraph 7).
• Provide clear, understandable and easy-to-use parental control tools that let a parent control the account settings, make purchases, rentals and paid memberships subject to the parent's permission or approval, and monitor and limit usage time (paragraph 20, in force since 1 November 2026).
• Take measures that block deceptive advertisements (paragraph 21).
• If you have more than ten million daily accesses from Turkey, carry out decisions given in urgent cases under Article 8/A immediately and within one hour at the latest (paragraph 22).
• If you have more than ten million daily accesses from Turkey, take every necessary measure so that content subject to a removal or blocking decision under the Law is not published on your own website (paragraph 23).

Law No. 7545 (12 March 2025), Art. 7 · Read the law's page

• This binds any entity that uses information systems to provide services, collect data, or process data within the Cybersecurity Law's own broad scope, with no revenue or user threshold gating this particular duty; a separate, narrower certification and export-approval duty binds only cybersecurity product and service vendors and is not raised here.
• Report a detected vulnerability or cyber incident in the area of service provided to the Cybersecurity Directorate without delay; the Law's own text sets no numeric reporting clock.
• Provide the Cybersecurity Directorate promptly with any data, information, document, hardware, software, or other contribution it requests in connection with its duties.
• Where cybersecurity products, systems, or services are procured for use in a public institution or in critical infrastructure, source them only from a provider the Directorate has certified or authorized.

Social Network Provider Age Verification Regulation (Yönetmelik), Resmî Gazete No. 33396, 10 October 2026, implementing Law No. 5651, Ek Madde 4(7), (20) and (25) · Read the law's page

• Binds a social network provider, meaning a person that enables users to create, view or share content such as text, images, sound or location for social interaction, accessible from Turkey and based in Turkey or abroad (Articles 2 and 4(1)(e)). The Regulation sets no daily-access threshold.
• Do not provide the service to a child who has not completed fifteen years of age (Article 5(1)).
• Verify each user's age at account creation with an age verification token generated through the e-Devlet Kapısı, which states only whether the user has completed fifteen and, if so, eighteen years of age, and use the token for no other purpose (Articles 6(2) and 7(1)).
• Reject an account-opening request from a user found not to have completed fifteen years of age, and suspend an account on reasonable suspicion that it is used outside its verified age range until a new token verification is made (Article 6(3) and (4)(a)).
• For a user verified as having completed fifteen years of age, offer a differentiated service: high privacy settings by default, private accounts by default, no live broadcasting, no interface that serves visual content in automatic or swipe-driven sequence, and no profiling or personalized commercial advertising (Article 8(2) and (5)).
• Publish the measures taken for the differentiated service on your own website (Article 8(6)).
• Provide clear, understandable and easy-to-use parental control tools that include at least account and feature settings, parental approval of paid transactions with a spending limit, and monitoring and limiting of usage time and location sharing (Article 9(1) and (3)).
• Offer a free, accessible appeal mechanism in Turkish for age verification results, account suspensions and differentiated-service measures, with human review of each appeal (Article 10(1) and (3)).
• By 31 March 2027, verify at least once with a token each account opened before the Regulation's start date that was not verified with one; close with notice an account found to belong to a child under fifteen, and place the account of a child found to have completed fifteen under the differentiated service (Transitional Article 1).