Turkey has no comprehensive, binding artificial-intelligence statute. The National Artificial Intelligence Strategy 2024-2025 Action Plan, a Presidential coordination document assigning priority actions across government and industry, is a policy plan rather than a law and imposes no obligation on a private actor.
A comprehensive, EU AI Act-modelled bill (TBMM Bill No. 2/2234, submitted ) and a narrower bill amending the Penal Code and the Internet Law to require labelling of AI-generated content and to create a rapid takedown mechanism for it (TBMM Bill No. 2/3358, submitted ) both remain under parliamentary review as of this review and have not been enacted.
The Personal Data Protection Authority (KVKK Kurumu) has issued non-binding guidance addressing generative AI (November 2025) and agentic AI systems (), construing the existing Personal Data Protection Law rather than creating new obligations. The one binding, sector-specific instrument located is a July 2026 amendment to the Ministry of Trade's advertising regulation, which requires disclosure of AI use in advertising and bars a deceptive AI deepfake endorsement.
The same July 2026 amendment adds a paragraph 12 to Article 18 of the Commercial Advertising and Unfair Commercial Practices Regulation, prohibiting an advertisement in which a digital copy of a real person, created using artificial intelligence technologies, is presented, contrary to fact, as having personally experienced or used a good or service, or as having recommended it.
A regulation amending the Ministry of Trade's Commercial Advertising and Unfair Commercial Practices Regulation, published in the Official Gazette on and in force from , adds a paragraph 8 to Article 18 requiring that where an advertisement uses artificial intelligence or other software in a way that significantly affects a consumer's economic behaviour regarding a good or service, or presents a digital character generated with artificial intelligence technologies that cannot be distinguished from a human being, this fact must be stated clearly, understandably, and in a manner distinguishable from the rest of the advertisement.
Turkey's comprehensive personal-data statute is KVKK, Law No. 6698 (), substantially amended by Law No. 7499 (), which rebuilt the special-categories lawful-basis structure and replaced the near-blanket-consent cross-border transfer regime with an adequacy-first mechanism backed by standard contracts and binding corporate rules, fully in force from once the transitional Provisional Art. 3 window closed.
KVKK lists biometric and genetic data as special-category data at Art. 6(1) but supplies no statutory definition of biometric data, voiceprint, or faceprint anywhere in the Act, so a captured identifier is treated inclusively as special-category data without any modality-specific rule. Breach notification (Art. 12(5)) requires notice to the affected subject and the Board within the shortest time, with no numeric statutory deadline in the Act's own text.
The private right of action (Art. 11(1)(ğ)) requires proof of damage from unlawful processing, unlike a no-proof-of-damage statutory-damages mechanism found elsewhere in this region.
Art. 12(5) requires a controller to notify the affected data subject and the Board within the shortest time where personal data has been obtained unlawfully by others; the Board may make the breach public. The Act sets no numeric deadline. Board Decision 2019/10 of interprets that phrase as 72 hours, so the controller must notify the Board without delay and at the latest within 72 hours of learning of the breach.
The controller notifies each affected data subject within the shortest reasonable time after identifying them. A controller that cannot notify the Board within 72 hours for a justified reason explains the delay to the Board with its notice.
KVKK is Turkey's single omnibus personal-data statute, broadly General Data Protection Regulation (GDPR)-modeled, covering both public institutions and private-sector data controllers. Art. 5 sets the lawful bases: explicit consent by default, or one of six alternative grounds (a legal provision, vital-interest necessity, contract necessity, a legal obligation, the data subject's own publication of the data, the controller's legitimate interest, or establishment or exercise of a right).
Controller and processor are defined at Art. 3(g)/(i). Law No. 7499 () amended the special-categories and cross-border transfer articles without changing this general lawful-basis structure.
Post-2024 Art. 9 requires an Art. 5/6 lawful basis for the underlying processing plus a cross-border mechanism: a Board adequacy decision published in the Official Gazette for the destination, or, absent adequacy, Board-approved binding corporate rules, a Board-published standard contract, a Board-approved written commitment, or an international convention Turkey is party to.
A party relying on the standard-contract route must notify the Authority within 5 business days of signature (Art. 9(5)); failure carries its own fine tier added by the 2024 amendment. Law No. 7499 brought the amended Article 9 into force on . Provisional Article 3 kept the first paragraph of Article 9, as it stood before the amendment, in effect alongside the amended text until , so the adequacy-first regime is the sole operative one from that date. No data localization is compelled.
Art. 11 gives a data subject the right to learn whether their data is processed, to request information on processing, to learn its purpose and whether use matches that purpose, to know the data's domestic and foreign transferees, to request rectification, to request erasure or destruction under Art. 7, to have those operations reported to prior transferees, and, at Art. 11(1)(ğ), to claim compensation for damage from unlawful processing.
Article 11(1)(g) gives a data subject the right to object to a result against them that arises from the analysis of their data processed solely through automated systems.
The Personal Data Protection Board (KVKK) enforces the Act with tiered administrative fines under Art. 18: 5,000 to 100,000 TL for notice failures, 15,000 to 1,000,000 TL for security failures, 25,000 to 1,000,000 TL for noncompliance with a Board decision, 20,000 to 1,000,000 TL for registry failures, and, added by Law No. 7499 in 2024, 50,000 to 1,000,000 TL for Art. 9(5) transfer-notification failures; fines are now appealable to administrative courts under Art. 18(3), also added in 2024.
Art. 11(1)(ğ) lets a data subject claim compensation for the damage arising from the unlawful processing, which requires proof of damage, unlike a no-proof-of-damage statutory-damages tort found elsewhere in this region.
Art. 6(1) lists biometric and genetic data, alongside race, ethnic origin, political opinion, philosophical belief, religion, health, sexual life, criminal convictions, and trade-union or association membership, as special-category data.
Processing requires one of the Art. 6(3) grounds added by the 2024 amendment: explicit consent, a legal provision, vital-interest necessity, the subject's own publication of the data consistent with the subject's intention to make it public, rights establishment, public health necessity, employment or social security law, or a closed list of nonprofit-association member data; the pre-2024 text instead required near-universal explicit consent.
KVKK gives no statutory definition of biometric data, voiceprint, or faceprint anywhere in the Act, so the term must be read inclusively: a voiceprint or faceprint captured for identification falls within the undefined biometric data category and triggers this special-category regime, even though no provision names either modality or sets a biometric-specific retention rule.
Turkey has no scraping-specific statute, so general law governs each dimension separately. The Penal Code's information-system-crimes chapter criminalises unlawfully entering a computer system or continuing to remain within one, and obstructing or corrupting the data or operation of one; the entry offence carries no security-measure element and no exception for a page served without any access barrier, so whether reading such a page meets it is untested.
No reported Turkish decision addresses the enforceability of a browsewrap or clickwrap terms-of-service against a scraper, but the general incorporation rule for standard contract terms in the Turkish Code of Obligations (Law No. 6098) answers both: terms the drafter neither expressly disclosed nor gave the other party a chance to learn are deemed unwritten, while terms the drafter did disclose and give a genuine chance to learn bind a party who accepts them, whether by an active step such as creating an account or, since a declaration of will may be tacit under the Code's general rule (Art. 1(2)), by conduct such as continuing to use the site after that notice.
The Law on Intellectual and Artistic Works (Law No. 5846) gives an author the exclusive right to reproduce a work in whole or in part, by any method, and permits quotation only within a closed list of enumerated cases that does not reach training or mining a work's content, so copying copyrighted text to train a model needs the rightsholder's permission; a bill to add a licensing requirement specifically for using works, performances, phonograms, productions, and broadcasts to train, fine-tune, test, or build datasets for an AI system offered for use in Turkey was submitted to the Grand National Assembly (Esas No. 2/3634) and remains pending.
The same Law confers a sui generis database producer right on a substantial investment in a database's content, independent of copyright in the individual contents.
The Personal Data Protection Law (KVKK), Law No. 6698, applies to personal data with no general carve-out for information the data subject has made public; its ground for data the subject has manifestly published (Art. 5(2)(d)) only removes the need for separate explicit consent and is not a scope exclusion, so scraped public personal data remains subject to KVKK's purpose-limitation, security, and cross-border-transfer duties (Art. 9), and biometric identifiers drawn from scraped content fall within the special-category regime (Art. 6).
No Turkish statute or reported case establishes a scraping-specific unfair-competition, misappropriation, or trespass doctrine beyond the general unfair-competition provisions of the Turkish Commercial Code (Law No. 6102), and no statute assigns legal weight to a robots.txt directive. Article 25 of the Turkish Code of Obligations provides that standard contract terms may not contain provisions that, contrary to good faith, put the other party at a disadvantage or worsen its position.
Article 55(1)(c)(3) of the Turkish Commercial Code lists among the principal cases of unfair competition taking over another person's market-ready work products by technical reproduction methods and exploiting them without an appropriate contribution of one's own.
Article 243(1) criminalises unlawfully entering the whole or part of a computer system, or unlawfully continuing to remain there, an offence punishable by imprisonment or a judicial fine.
Where such entry causes the system's data to be destroyed or altered, Art. 243(3) sets imprisonment of six months to two years, and Art. 243(4), added in 2016, separately punishes unlawfully intercepting data transfers within or between computer systems by technical means without entering the system, at one to three years.
Article 244 punishes obstructing or disrupting a computer system's operation with imprisonment of one to five years (para. 1), and corrupting, destroying, altering, or rendering inaccessible the data within a system, inserting data into it, or transmitting its data elsewhere, with imprisonment of six months to three years (para. 2); the penalty is increased by half where a bank, credit institution, or public institution's system is affected (para. 3), and where the offender derives an unlawful benefit for self or another through these acts and no more serious offence is constituted, imprisonment rises to two to six years plus a judicial fine of up to 5,000 days (para. 4).
Articles 20 to 25 of the Turkish Code of Obligations regulate standard contract terms, meaning contract terms that a drafter prepares alone and in advance, to use in many similar contracts, and presents to the other party.
Under Article 21, standard terms that go against the other party's interest enter the contract only if, when the contract is made, the drafter expressly informs the other party that the terms exist and gives it the chance to learn their content, and the other party accepts them; otherwise the terms are deemed unwritten, as are terms foreign to the nature of the contract and the particular character of the work.
Under Article 22, the contract's other provisions stay valid when terms are deemed unwritten. Under Article 23, a term that is unclear or open to several meanings is read against the drafter and in favor of the other party. Under Article 24, a clause that gives the drafter the power to change a provision of the contract, or to add a new rule, unilaterally against the other party is deemed unwritten.
Under Article 25, standard terms may not contain provisions that, contrary to good faith, put the other party at a disadvantage or worsen its position. The Code entered into force on .
Additional Article 8, added to the Law on Intellectual and Artistic Works by Law No. 5101 and in force since , gives the producer of a database who makes a substantial investment, qualitatively or quantitatively, in creating, verifying, or presenting its content the exclusive right to permit or prohibit the permanent or temporary transfer of a substantial part or all of that content to another medium by any means, and its distribution, sale, rental, or communication to the public by any means, subject to the exceptions the Law lists and to exceptions required for public security or administrative or judicial proceedings.
Protection runs for fifteen years from the date the database is disclosed, and a substantial new investment that brings about a substantial qualitative or quantitative change in the database's content earns its own fifteen-year term.
Articles 54 to 63 of the Turkish Commercial Code regulate unfair competition. Article 54 declares deceptive conduct, and other conduct contrary to the rule of good faith, that affects relations between competitors, or between suppliers and customers, unfair and unlawful.
Article 55(1) lists the principal cases, among them taking over another person's market-ready work products by technical reproduction methods and exploiting them without an appropriate contribution of one's own (point (c)(3)), exploiting or passing on to others information obtained secretly and without permission, or learned in another unlawful way, and the producer's business secrets (point (d)), and using pre-written standard terms that, in a misleading way and to the other party's detriment, depart significantly from the statutory rule or provide a distribution of rights and duties significantly contrary to the nature of the contract (point (f)).
Under Article 56, a person whose customers, credit, professional reputation, commercial activities or other economic interests are harmed or endangered by unfair competition may ask for a declaration that the act is unlawful, an injunction, removal of the resulting situation, damages where there is fault, and non-pecuniary damages where the Code of Obligations' conditions are met.
Customers whose economic interests are harmed may bring the same actions, except a claim for destruction of the means and goods. Article 62 punishes intentionally committing one of the acts listed in Article 55 with imprisonment of up to two years or a judicial fine, on the complaint of a person entitled to bring the Article 56 civil action, unless the act constitutes a more serious offence. The Code entered into force on .
Turkey enacted a standalone Cybersecurity Law, Law No. 7545 (adopted , published in the Official Gazette No. 32846 on , and in effect from that date), separate from the Personal Data Protection Law (KVKK)'s own security-of-processing clause.
The Law creates a Cybersecurity Directorate (Siber Güvenlik Başkanlığı) under the Presidency and transfers to it the national cybersecurity functions its own transitional provisions describe as previously exercised by the Information and Communications Technologies Authority (BTK), including BTK's contracts, personnel, and assets; the Law's own vocabulary for a computer-incident-response team is SOME (Siber Olaylara Müdahale Ekibi), and the pre-2025 national CERT acronym USOM does not appear in the primary text reviewed here, so its formal continuation or retirement under the new Directorate is not confirmed.
Article 7(1) binds any entity that uses information systems to provide services or to collect and process data within the Law's scope, public institutions, professional bodies of a public-institution character, and natural and legal persons alike, with police, coast guard, gendarmerie, intelligence, and armed-forces internal-service activities excluded under Article 2(2), to report a detected vulnerability or cyber incident to the Directorate without delay, to cooperate with Directorate information requests, and, for public institutions and critical infrastructure, to procure cybersecurity products only from Directorate-certified providers; failing the first three of those duties carries an administrative fine of 1,000,000 to 10,000,000 Turkish lira under Article 16(10).
The Law's own text sets no numeric clock for the reporting duty, leaving concrete technical measures to implementing regulations it directs the Presidency to issue within one year of publication, whose current status is not confirmed in the primary text reviewed.
A separate, narrower regime (Arts. 6 and 18) requires a cybersecurity product, system, or service, and the company supplying it, to be certified or authorized by the Directorate before that company may supply public institutions or critical infrastructure, and gates the export of cybersecurity products, systems, software, hardware, and services on Presidency-set procedures; no declared activity in this corpus's vocabulary expresses being a cybersecurity-product vendor or an export party, so this regime is recorded here rather than raised against a guess, the same treatment this profile gives regimes whose bound party is a designated status.
Critical infrastructure itself is a sector-by-sector, case-by-case government designation the Cyber Security Council makes under Article 9(4). Obstructing an authorized inspector's information request carries one to three years' imprisonment and a judicial fine (Art. 16(1)), and other named offenses in the Law carry their own criminal exposure, but the Article 7(1)(a)-(c) duties raised in the instrument below are enforced only by administrative fine.
KVKK Article 12(1)-(4), the comprehensive privacy regime's own security-of-processing clause requiring a data controller to take technical and organizational measures for an appropriate level of security, and Article 12(5), the duty to notify the data subject and the Personal Data Protection Board of a personal-data breach with no fixed statutory clock, both stay in the privacy topic rather than here, the same place General Data Protection Regulation (GDPR) Article 32 sits; the privacy topic's own row already records Article 12(5) as a breach-notification instrument.
Turkish Penal Code Articles 135 through 140's personal-data offenses and the Articles 243-244 information-system offenses bind the person attacking a system rather than the operator or manufacturer, so they belong to the scraping topic's computer-misuse family and are not restated as a security-topic presence here.
Law No. 7590 () added a further transitional article continuing the transfer of national cybersecurity functions and assets from BTK and the Telecommunications Communication Presidency to the Cybersecurity Directorate, evidence the institutional build-out remains active more than a year after enactment.
The Electronic Communications Network and Information Security Regulation published in Official Gazette No. 29059 requires an operator to notify the Authority as soon as possible of network and information security breaches affecting more than five percent of its subscribers.
The Regulation sets the procedures and principles operators must follow to ensure network and information security. Article 5 requires every operator to take the basic measures of the third part. Article 5 also requires an operator of a listed authorization type whose annual net sales reach a Board-set value to take the additional measures of the fourth part.
Article 6 requires the operator to establish an information security management system covering its authorized services and critical systems. Article 13 requires an internal audit of that system at least once every two years. Article 37 requires an annual network and information security report by the end of March.
Article 60 of Electronic Communications Law No. 5809 lets the Authority fine an operator up to three percent of its net sales of the previous calendar year for violating the legislation.
Article 7(1) of Turkey's Cybersecurity Law binds any entity that uses information systems to provide services or to collect and process data within the Law's scope. It must report a detected vulnerability or cyber incident to the Cybersecurity Directorate without delay. It must also supply the Directorate with any data or documentation the Directorate requests.
Where it serves public institutions or critical infrastructure, it must source cybersecurity products only from Directorate-certified providers. Failing the reporting, cooperation, or procurement duties in items (a) through (c) carries an administrative fine of 1,000,000 to 10,000,000 Turkish lira under Article 16(10); the Law's own text sets no numeric clock for the reporting duty itself.
A related item (ç) requires a certified cybersecurity company to obtain the Directorate's approval before beginning operations, a licensing duty that binds the narrower class of cybersecurity-product and service vendors rather than a general software or app developer, and is not itself covered by the Article 16(10) fine named above.
Article 38 requires an operator to notify the Authority as soon as possible of network and information security breaches affecting more than five percent of its subscribers and of events that interrupt business continuity. The notification must contain at least the time, nature, impact and duration of the event and the measures taken. Article 12 requires a reporting and feedback mechanism so that breaches and vulnerabilities are reported as quickly as possible.
Article 60 of Electronic Communications Law No. 5809 lets the Authority fine an operator up to three percent of its net sales of the previous calendar year for violating the legislation.
Digital accessibility law6 instruments, 6 in force
Research summary (77 words)
Article 7 of Law No. 5378 on Persons with Disabilities provides that information services and information and communication technology are made accessible to disabled people. The Regulation on the Accessibility of Banking Services, issued by the Banking Regulation and Supervision Agency on the basis of Article 7, sets the accessibility duties of banks.
The duties Turkey places on public bodies for their own websites and apps are covered on law.ungovr.org in the public-sector accessibility entry for Turkey.
Article 2 applies the Law to disabled people, their families, the bodies and organizations that provide services to disabled people, and other persons concerned. Article 3(f) defines accessibility as the ability of disabled people to reach and use buildings, open spaces, transport and information services and information and communication technology safely and independently.
Article 3(g) defines accessibility standards as the standards on accessibility that the Turkish Standards Institute publishes. Article 7 provides that information services and information and communication technology are made accessible to disabled people. Article 69 of Law No. 6518 substituted Article 7 in its current form. The Law's table of amending laws lists Article 7 among the provisions of Law No. 6518 that entered into force on .
The Information and Communication Technologies Authority's Board approved the Procedures and Principles on Measures Aimed at Segments of Society That Need Social Support on (Decision 2018/DK-THD/190), and its Decision 2026/DK-THD/138 of amends them. As amended, Article 10(1) provides that the operator bases the design of its websites and mobile applications on the Accessibility Checklist Level A and on the Web Content Accessibility Guidelines (WCAG-2.2).
The amendment to Article 10(1) entered into force on , and the decision's other amendments entered into force on . The quarterly reporting table of the Procedures, which each obligated operator completes, covers the accessibility of the operator's internet pages (Article 10) and its smart-device applications (Article 11).
Article 1 sets the procedures and principles for making banking services suitable for access and use by customers with disabilities. Article 2 bases the Regulation on Articles 80 and 93(2) and (4) of Banking Law No. 5411 and on Article 7 of Law No. 5378. Article 4(2) requires a bank to offer its services in a form suitable for customers with disabilities and to bring the places where it offers service, and its services, into line with the accessibility standards.
Article 4(7) requires the contracts for banking services to be accessible on the bank's internet pages in audio information and sign-language-interpreted video formats. Article 4(11) bars a bank from charging a customer with a disability an extra fee for the facilitating or informing services it offers under the Regulation. Article 7(9) requires a bank to make all the ATMs it operates suitable for blind customers under the provisions of Article 7.
Article 11(1) requires internet banking and mobile banking applications to be compatible with the accessibility standards. Article 12(2) requires a bank that offers a call center service to offer deaf and hard-of-hearing customers a secure online written channel or a video remote interpreter service.
Temporary Article 1 required a bank to bring its existing services, activities and systems into line with the Regulation by , and requires services offered after the Regulation entered into force to comply. Article 13 enters the Regulation into force on .
Sağırların İşitme ve Görme Engellilerin Yayın Hizmetlerine Erişiminin İyileştirilmesine İlişkin Usul ve Esaslar Hakkında Yönetmelik (Radyo ve Televizyon Üst Kurulu), Resmî Gazete 11/10/2019, sayı 30915, m. 2, 5, 6, 8, 9 ve 10Aile ve Sosyal Hizmetler Bakanlığı
In force since .Binds public and private bodies.
What this law does
The Regulation is made under Article 24 and Article 37(1)(ö) of Law No. 6112 on the Establishment of Radio and Television Enterprises and Their Media Services. It covers the national terrestrial television services of private media service providers that hold a national terrestrial television broadcasting licence or a temporary broadcasting right, and the television services of the Turkish Radio and Television Corporation.
Article 5 requires accessible programmes, meaning programmes broadcast with at least one of detailed subtitles, sign language and audio description, to make up at least 10% of a provider's monthly broadcast time within six months, 25% within two years and 40% within five years, with at least two evening-band programmes a week broadcast as accessible programmes.
Article 6 requires a provider to broadcast one main news bulletin a day in sign language and to voice its weather and road, market and currency, and score screens. Article 8 requires the sign-language interpreter to fill at least one eighth of the screen, Article 9 requires public service announcements to carry at least one of the three translation types, and Article 10 requires the symbols of the protective symbol system to be voiced.
Articles 6, 9 and 10 entered into force three months after publication on and the other articles on the day of publication.
Article 4/A bans every kind of discrimination on the grounds of disability, direct and indirect discrimination included, and provides that the measures necessary for making reasonable accommodations for disabled people are taken to secure equality and remove discrimination.
Article 3 defines direct discrimination as any different treatment based on disability that prevents, limits or makes harder a disabled person's equal enjoyment of rights and freedoms compared with those in a comparable situation, and indirect discrimination as a seemingly neutral act, measure or practice that puts a disabled person at a disadvantage that cannot be objectively justified.
Article 3 also defines a reasonable accommodation as the necessary and appropriate changes and measures, not imposing a disproportionate or excessive burden, that a disabled person needs in a particular case. Article 4(b) makes the ban on discrimination on grounds of disability a general principle for the services the Law covers. The Law's table of amending laws gives as the day the provisions of Law No. 6518 that inserted Article 4/A entered into force.
Article 3 bans discrimination on the grounds of sex, race, colour, language, religion, belief, sect, philosophical and political opinion, ethnic origin, wealth, birth, marital status, health condition, disability and age.
Article 4 lists the forms of discrimination the Law reaches, including direct and indirect discrimination and failure to make a reasonable accommodation, and Article 2 defines a reasonable accommodation as the necessary and appropriate changes and measures, proportionate and within financial means, that a disabled person needs in a particular case to enjoy rights and freedoms on an equal footing.
Article 5 provides that public bodies, natural persons and private-law legal entities that offer education, health, transport, communication, social security, accommodation, culture, tourism and similar services may not discriminate against a person who uses, has applied for or asks for information about those services, and it requires those responsible for planning and providing the services to take the needs of different disability groups into account and to ensure that reasonable accommodations are made.
Any natural or legal person who claims harm from a breach of the ban may apply to the Institution, whose President may invite the parties to conciliation, and its Board decides whether the ban was violated. Article 25 sets an administrative fine of 1,000 to 15,000 Turkish lira for a violation, which the Board may convert once into a warning. The Law was published in the Official Gazette of , No. 29690, and Article 29 brings it into force on publication.
Turkey has no adult-content age-verification statute or app-store age-verification requirement. The Penal Code's obscenity article (Law No. 5237, Art. 226) criminalises giving, showing, displaying, selling, renting, distributing, or advertising obscene material where a child (defined at Art. 6(1)(b) as a person who has not completed eighteen years) could obtain, see, or be shown it, and separately criminalises child sexual abuse material at a materially higher penalty tier.
That is a criminal prohibition running to any person, not an age-verification or age-gating obligation placed on a service. Two more targeted duties do impose that kind of obligation.
The Law on Regulation of Internet Publications (Law No. 5651), as amended by Law No. 7578 () from , bars a social network provider from serving children who have not completed fifteen years of age, requires it to take measures including age verification and to offer a service differentiated for children who have completed fifteen years, and is enforceable by a fine of up to three percent of the provider's global turnover.
The Radio and Television Broadcasting Law (Law No. 6112) requires an on-demand broadcasting service provider to present content that could adversely affect the physical, mental, or moral development of children and young people so that they would not normally encounter it.
Additional Article 5 of the Law on Regulation of Internet Publications, added by Article 23 of Law 7578 (), bars a game platform from offering games that have not been rated properly, though it may offer an unrated game if it rates the game at the highest age criterion. A game platform based abroad with more than 100,000 daily accesses from Turkey must appoint a natural or legal person as its representative in Turkey and notify the Authority of the representative's details.
A game platform must provide clear, understandable and easy-to-use parental control tools, including mechanisms for controlling account settings and for making purchases, rentals and paid memberships subject to a parent's permission or approval.
The Authority may ask a game platform for explanations about its corporate structure, information systems and data processing mechanisms, and the platform must give the Authority the information and documents it requests immediately and within a period of no more than fifteen days that the Authority sets. If a platform fails to fulfil a duty within thirty days of the Authority's notice, the Head of the Authority may fine it from 1,000,000 to 10,000,000 Turkish lira.
If the platform still has not fulfilled the duty thirty days after that fine is served, the Head may impose a second fine of 10,000,000 to 30,000,000 Turkish lira. If the duty is still unfulfilled thirty days after the second fine is served, the Head may apply to a criminal judgeship of peace to narrow the platform's internet bandwidth by thirty percent.
Article 27(1)(a) of Law 7578 has Articles 22 and 23 take effect six months after the Law's publication on , and Additional Article 5 has bound since .
Article 8(3) of the Radio and Television Broadcasting Law requires an on-demand broadcasting service provider (an audiovisual streaming or video-on-demand service within the Radio and Television Supreme Council's jurisdiction) to ensure that a broadcast service of a nature that could adversely affect the physical, mental, or moral development of children and young people is presented in a way that they would not normally hear or see under ordinary conditions.
A parallel duty at Art. 8(2), strengthened by Law No. 7077 in 2018, separately bars broadcasting such content during time periods children could watch even where a protective symbol is used, for linear radio and television broadcasting rather than on-demand services.
Additional Article 4 of the Law on Regulation of Internet Publications sets duties for a social network provider, which Article 2 defines as a person that enables users to create, view or share content such as text, images, sound or location for social interaction. Paragraphs 1, 3, 4 and 6 of Additional Article 4 apply from more than one million daily accesses from Turkey (paragraph 1 only to a provider based abroad), and paragraph 7 states no access threshold.
Since , paragraph 7, as replaced by Article 22 of Law No. 7578 (), bars a social network provider from providing its service to a child who has not completed fifteen years of age and requires it to take the necessary measures, including age verification, to prevent that.
The provider must also take the measures necessary to offer a service differentiated for children who have completed fifteen years, and the measures taken under paragraph 7 are published on its own website. Before that date, paragraph 7, added by Law No. 7418 (), required only that the provider take the measures necessary to offer a service specifically differentiated for children.
Article 22 also adds new paragraphs after paragraph 19, the first of which requires the provider to offer clear, understandable and easy-to-use parental control tools, and moves the fine provision, formerly paragraph 20, to paragraph 24.
The other new paragraphs require measures against deceptive advertisements and, for a provider with more than ten million daily accesses from Turkey, carrying out urgent blocking decisions within one hour and keeping content that is subject to a removal or blocking decision off its own website.
That provision makes a provider that fails the paragraph 7 duty, along with several other duties in the same article, liable to an administrative fine of up to three percent of its global turnover in the preceding calendar year, imposed by the head of the enforcing authority.
Article 22 extends the fine to the duties of new paragraphs 20, 21 and 23, and provides that a duty still unfulfilled thirty days after a fine is served leads to a ban on new advertising to the provider by taxpayers resident in Turkey and then to a court application to reduce the provider's bandwidth.
The authority responsible for enforcing this Law was renamed the Cybersecurity Presidency (Siber Güvenlik Başkanlığı), succeeding the Information and Communication Technologies Authority (BTK), by Law No. 7590 ().
The Regulation on the Provision of Differentiated Services Specific to Children and on Age Verification by Social Network Providers, issued by the Cybersecurity Presidency (Siber Güvenlik Başkanlığı) and published in Resmî Gazete No. 33396 of , implements paragraphs 7, 20 and 25 of Additional Article 4 of Law No. 5651.
It covers social network providers accessible from Turkey, whether based in Turkey or abroad, and sets no daily-access threshold for them, so it does not narrow the providers that paragraph 7 of Additional Article 4 reaches. A provider may not provide its service to a child who has not completed fifteen years of age, and must verify a user's age at account creation with an age verification token.
The token is generated through the e-Devlet Kapısı at the user's request and states only whether the user has completed fifteen and, if so, eighteen years of age. A user who is not resident in Turkey and is only temporarily present is exempt from the age verification controls.
For users verified as having completed fifteen years of age, the provider must offer a differentiated service with high privacy settings by default, private accounts by default, no live broadcasting, no interface that serves visual content in automatic or swipe-driven sequence, and no profiling or personalized commercial advertising, and must publish the measures taken on its own website.
The provider must also supply parental control tools and a free, accessible appeal mechanism in Turkish that includes human review. Breach of the Regulation's duties is sanctioned under the provisions of Additional Article 4 of Law No. 5651, after the provider is notified and given a reasonable period to remedy the breach.
By , a provider must verify with a token, at least once, each account opened before the Regulation's start date that was not verified with one, close with notice an account found to belong to a child under fifteen, and place the account of a child found to have completed fifteen under the differentiated service.
Turkey has no press-publisher neighbouring right of the kind the European Union's Digital Single Market Directive Article 15 creates; the Law on Intellectual and Artistic Works (Law No. 5846) grants related rights only to performers, phonogram producers, film producers, and broadcasting organisations, not to print or online news publishers. There is no mandatory platform-to-publisher bargaining code.
The Law's own provisions for daily news and press content, rather than a separate hot-news or misappropriation doctrine, are the operative privilege: no unfair-competition or misappropriation claim distinct from this copyright framework has been identified for time-sensitive factual reporting. No statute or reported Turkish decision addresses whether a hyperlink is itself a communication to the public, or whether framing or inline display changes the answer.
The Law predates the concept of a machine-readable text-and-data-mining reservation, and no amendment through the most recent (2021) amending Act adds one, so no text and data mining (TDM) opt-out mechanism of that kind exists.
Law No. 5846, Arts. 35-37official statute text, Turkish Presidency Legislation Information System (Mevzuat Bilgi Sistemi) consolidated text of Law No. 5846
In force since .Binds public and private bodies.
What this law does
Article 35 permits quotation from a work in four settings: taking some sentences or passages of a disclosed work into an independent scientific or literary work; taking mostly theme, motif, passage, or idea elements of a published composition into an independent musical work; including disclosed fine-art works and other published works in a scientific work to the extent justified for illustrating its content; and displaying disclosed fine-art works by projection in scientific conferences or lectures, each conditioned on the quotation being clearly identifiable and, in scientific works, on naming the source and the author.
Article 36 lets daily news and reports disseminated by the press or radio be freely quoted.
It also lets articles or columns on daily social, political, or economic matters be taken as-is or in adapted form by other newspapers or magazines, and disseminated by radio or otherwise, unless the quotation right has been expressly reserved; even where it has been reserved, such articles or columns may still be taken in shortened, press-summary form and disseminated, provided the source publication or agency, its date and issue number, and the author's name, pen name, or mark are cited.
Article 37, rewritten in 2001, allows incorporating parts of intellectual and artistic works into media conveying signs, sound, or images in connection with daily events, for news purposes and not exceeding the scope of informing the public; material so incorporated may be freely reproduced, distributed, performed, or broadcast, provided this freedom is not used in a way that harms the rightsholder's legal interests or conflicts with normal exploitation of the work.
No current case law for Turkey content moderation law
No current case law for Turkey product and AI liability law
No current case law for Turkey digital accessibility law
No current case law for Turkey age gating law
No current case law for Turkey reuse law
Reporting clocks that run here3 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Turkey comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
An app that suffers unlawful acquisition of personal data belonging to a person in Turkey must notify the affected data subject and the Board within the shortest time; Board Decision 2019/10 of reads that as notice to the Board without delay and at the latest within 72 hours of learning of the breach, and notice to each affected data subject within the shortest reasonable time after the data subject is identified.
Report a detected vulnerability or cyber incident in the area of service provided to the Cybersecurity Directorate without delay; the Law's own text sets no numeric reporting clock.
Notify the Authority as soon as possible of a network or information security breach that affects more than 5% of your subscribers and of any event that interrupts business continuity; the Regulation states no numeric clock (art. 38(1)).
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
