Turkey

Turkey has no comprehensive, binding artificial-intelligence statute. The National Artificial Intelligence Strategy 2024-2025 Action Plan, a Presidential coordination document assigning priority actions across government and industry, is a policy plan rather than a law and imposes no obligation on a private actor.

A comprehensive, EU AI Act-modelled bill (TBMM Bill No. 2/2234, submitted 24 June 2024) and a narrower bill amending the Penal Code and the Internet Law to require labelling of AI-generated content and to create a rapid takedown mechanism for it (TBMM Bill No. 2/3358, submitted 7 November 2025) both remain under parliamentary review as of this review and have not been enacted.

The Personal Data Protection Authority (KVKK Kurumu) has issued non-binding guidance addressing generative AI (November 2025) and agentic AI systems (12 March 2026), construing the existing Personal Data Protection Law rather than creating new obligations. The one binding, sector-specific instrument located is a July 2026 amendment to the Ministry of Trade's advertising regulation, which requires disclosure of AI use in advertising and bars a deceptive AI deepfake endorsement.

Turkey's comprehensive personal-data statute is KVKK, Law No. 6698 (7 April 2016), substantially amended by Law No. 7499 (2 March 2024), which rebuilt the special-categories lawful-basis structure and replaced the near-blanket-consent cross-border transfer regime with an adequacy-first mechanism backed by standard contracts and binding corporate rules, fully in force from 1 September 2024 once the transitional Provisional Art. 3 window closed.

KVKK lists biometric and genetic data as special-category data at Art. 6(1) but supplies no statutory definition of biometric data, voiceprint, or faceprint anywhere in the Act, so a captured identifier is treated inclusively as special-category data without any modality-specific rule. Breach notification (Art. 12(5)) requires notice to the affected subject and the Board within the shortest time, with no numeric statutory deadline in the Act's own text.

The private right of action (Art. 11(1)(g)) requires proof of damage from unlawful processing, unlike a no-proof-of-damage statutory-damages mechanism found elsewhere in this region.

Turkey has no scraping-specific statute, so general law governs each dimension separately. The Penal Code's information-system-crimes chapter criminalises unauthorised entry into a computer system and obstructing or corrupting the data or operation of one, but its trigger is unauthorised access rather than the act of copying content, so a scraper reading a public, unauthenticated page without defeating an access control falls outside a plain reading of these provisions.

No reported Turkish decision addresses the enforceability of a browsewrap or clickwrap terms-of-service against a scraper; the general contract-formation rules of the Turkish Code of Obligations (Law No. 6098) would govern such a claim, but no scraping-specific application of them has been located.

The Law on Intellectual and Artistic Works (Law No. 5846) permits fair-practice quotation and a narrow personal-use reproduction right, but Turkey has not enacted a text-and-data-mining exception, so training a model on scraped copyrighted text rests only on the general quotation and personal-use grounds if they can be stretched to fit; the same Law confers a sui generis database producer right on a substantial investment in a database's content, independent of copyright in the individual contents.

The Personal Data Protection Law (KVKK), Law No. 6698, applies to personal data without a general carve-out for information the data subject has not made public; its narrow exception for data the subject has manifestly published (Art. 5(2)(d)) is a lawful-basis ground rather than a scope exclusion, so scraped public personal data remains subject to KVKK's purpose-limitation, security, and cross-border-transfer duties, and biometric identifiers drawn from scraped content fall within the special-category regime.

No Turkish statute or reported case establishes a scraping-specific unfair-competition, misappropriation, or trespass doctrine beyond the general unfair-competition provisions of the Turkish Commercial Code (Law No. 6102), and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule.

Turkey enacted a standalone Cybersecurity Law, Law No. 7545 (adopted 12 March 2025, published in the Official Gazette No. 32846 on 19 March 2025, and in effect from that date), separate from the Personal Data Protection Law (KVKK)'s own security-of-processing clause.

The Law creates a Cybersecurity Directorate (Siber Güvenlik Başkanlığı) under the Presidency and transfers to it the national cybersecurity functions its own transitional provisions describe as previously exercised by the Information and Communications Technologies Authority (BTK), including BTK's contracts, personnel, and assets; the Law's own vocabulary for a computer-incident-response team is SOME (Siber Olaylara Müdahale Ekibi), and the pre-2025 national CERT acronym USOM does not appear in the primary text reviewed here, so its formal continuation or retirement under the new Directorate is not confirmed.

Article 7(1) binds any entity that uses information systems to provide services or to collect and process data within the Law's scope, public institutions, professional bodies of a public-institution character, and natural and legal persons alike, with police, coast guard, gendarmerie, intelligence, and armed-forces internal-service activities excluded under Article 2(2), to report a detected vulnerability or cyber incident to the Directorate without delay, to cooperate with Directorate information requests, and, for public institutions and critical infrastructure, to procure cybersecurity products only from Directorate-certified providers; failing the first three of those duties carries an administrative fine of 1,000,000 to 10,000,000 Turkish lira under Article 16(10).

The Law's own text sets no numeric clock for the reporting duty, leaving concrete technical measures to implementing regulations it directs the Presidency to issue within one year of publication, whose current status is not confirmed in the primary text reviewed.

A separate, narrower regime (Arts. 6 and 18) requires a cybersecurity product, system, or service, and the company supplying it, to be certified or authorized by the Directorate before that company may supply public institutions or critical infrastructure, and gates the export of cybersecurity products, systems, software, hardware, and services on Presidency-set procedures; no declared activity in this corpus's vocabulary expresses being a cybersecurity-product vendor or an export party, so this regime is recorded here rather than raised against a guess, the same treatment this profile gives regimes whose bound party is a designated status.

Critical infrastructure itself is a sector-by-sector, case-by-case government designation the Cyber Security Council makes under Article 9(4); the operator duties that designation triggers likewise bind a status no declared activity can express and are not flagged.

Obstructing an authorized inspector's information request carries one to three years' imprisonment and a judicial fine (Art. 16(1)), and other named offenses in the Law carry their own criminal exposure, but the Article 7(1)(a)-(c) duties raised in the instrument below are enforced only by administrative fine.

KVKK Article 12(1)-(4), the comprehensive privacy regime's own security-of-processing clause requiring a data controller to take technical and organizational measures for an appropriate level of security, and Article 12(5), the duty to notify the data subject and the Personal Data Protection Board of a personal-data breach with no fixed statutory clock, both stay in the privacy topic rather than here, the same place General Data Protection Regulation (GDPR) Article 32 sits; the privacy topic's own row already records Article 12(5) as a breach-notification instrument.

Turkish Penal Code Articles 135 through 140's personal-data offenses and the Articles 243-244 information-system offenses bind the person attacking a system rather than the operator or manufacturer, so they belong to the scraping topic's computer-misuse family and are not restated as a security-topic presence here.

Law No. 7590 (24 July 2026) added a further transitional article continuing the transfer of national cybersecurity functions and assets from BTK and the Telecommunications Communication Presidency to the Cybersecurity Directorate, evidence the institutional build-out remains active more than a year after enactment.

Turkey has no adult-content age-verification statute or app-store age-verification requirement. The Penal Code's obscenity article (Law No. 5237, Art. 226) criminalises giving, showing, displaying, selling, renting, distributing, or advertising obscene material where a child (defined at Art. 6(1)(b) as a person who has not completed eighteen years) could obtain, see, or be shown it, and separately criminalises child sexual abuse material at a materially higher penalty tier.

That is a criminal prohibition running to any person, not an age-verification or age-gating obligation placed on a service. Two more targeted duties do impose that kind of obligation. The Law on Regulation of Internet Publications (Law No. 5651) requires a social network provider with more than one million daily accesses from Turkey to take measures providing a service specifically differentiated for children, enforceable by a fine of up to three percent of the provider's global turnover.

The Radio and Television Broadcasting Law (Law No. 6112) requires an on-demand broadcasting service provider to present content that could adversely affect the physical, mental, or moral development of children and young people so that they would not normally encounter it. Law No. 5651's children's-service duty is itself subject to a further amendment (Law No. 7578, 22 April 2026) that takes effect on 1 November 2026 and had not yet altered the operative text as of this review.

Turkey has no press-publisher neighbouring right of the kind the European Union's Digital Single Market Directive Article 15 creates; the Law on Intellectual and Artistic Works (Law No. 5846) grants related rights only to performers, phonogram producers, film producers, and broadcasting organisations, not to print or online news publishers. There is no mandatory platform-to-publisher bargaining code.

The Law's own provisions for daily news and press content, rather than a separate hot-news or misappropriation doctrine, are the operative privilege: no unfair-competition or misappropriation claim distinct from this copyright framework has been identified for time-sensitive factual reporting. No statute or reported Turkish decision addresses whether a hyperlink is itself a communication to the public, or whether framing or inline display changes the answer.

The Law predates the concept of a machine-readable text-and-data-mining reservation, and no amendment through the most recent (2021) amending Act adds one, so no text and data mining (TDM) opt-out mechanism of that kind exists.