Turkey today published a regulation in the Official Gazette that bars social media providers from serving anyone under 15, requires every new account to be verified with a government-issued age token from November 1, 2026, and strips users aged 15 to 17 of personalized advertising, public profiles, live streaming and scrolling feeds.

In Short

Turkey has written the rules for how its ban on social media for children under 15 will actually work, and they start on November 1, 2026. Every user will have to prove their age with a code from the government's e-Government website, and teenagers aged 15 to 17 will get a stripped-down version of each platform with no targeted ads, no live streams and no endless feeds. Platforms have until March 31, 2027 to check all existing accounts and close the ones belonging to under-15s.

What the regulation says

The text, issued by the Presidency of Cybersecurity and printed in Official Gazette Issue No. 33396 dated Saturday, October 10, 2026, carries a long title: the Regulation on the Provision of Child-Specific, Segregated Services by Social Media Providers and Age Verification. It runs to 14 articles and one transitional provision. Its stated purpose is to set "the procedures and principles regarding age verification for access to services provided by social media providers, the provision of age-restricted services specifically designed for children who have reached the age of fifteen, and parental control tools."

The scope is broad. According to Article 2, the rules cover "domestic and foreign social media providers accessible from Turkey and their users." The definition of a social media provider in Article 4 is equally wide: "Any natural or legal person that enables users to create, view, or share content such as text, images, audio, and location on the internet for the purpose of social interaction." Nothing in the text sets a user-count threshold, names specific platforms or exempts smaller services.

The legal footing is the seventh, twentieth and twenty-fifth paragraphs of Article 4 of the Annex to Law No. 5651, Turkey's 2007 internet law, according to Article 3. Turkey's parliament passed legislation restricting social media for children under 15 in April 2026, according to Al Jazeera. Today's regulation is the operating manual for that legislation, and it contains far more detail on product design than the headline age limit suggests.

Article 5 states the core rule in a single line: "A social media provider may not provide services to children under the age of fifteen." Article 4 defines a child as "a person who has not yet reached the age of eighteen, even if they attained legal adulthood at an earlier age." The regulation therefore creates three tiers: under-15s, who are excluded; users aged 15 to 17, who receive what the text calls an "age-restricted service"; and adults.

How the age verification token works

The mechanism at the centre of the regulation is the age verification token, defined in Article 4 as "a technical verification tool that indicates the user's age threshold." Turkey has chosen a state-run system rather than leaving the method to platforms.

According to Article 7, "Age verification is conducted through the e-Government Portal." The process runs in four steps. A user logs in to the e-Government Portal, passing its identity verification. The user then requests a token through an online service run by the Presidency. The user uploads that token to the social media platform. Finally, the platform checks that the token was generated by the Presidency and reads the user's age group from it.

The token is deliberately thin. Article 7 states that it "contains only information regarding whether the user has reached the age of fifteen and, if so, whether the user has reached the age of eighteen." It "contains no personal data or information other than the matters specified above regarding the user's age," and does not include usernames or "any other information or data that identifies or makes the user identifiable by third parties." Platforms "may not use the age verification token for any purpose other than age verification."

This design sits behind one of the basic principles in Article 5: "methods that allow for the determination of the age threshold alone, rather than identity verification, shall be used." The identity check happens at the government portal. The platform receives a yes or no on two thresholds.

There is an obvious tension here, though the regulation does not address it. The platform learns nothing about identity, but the state-run portal processes an identity login for every token request tied to a social media signup. The text says nothing about whether the Presidency logs which users requested tokens, how long such records are kept, or whether a token can be linked back to the person who requested it.

Visitors and continuous checks

Foreign visitors receive a separate route. According to Article 7, users "who are not resident in Turkey but are temporarily present in the country are exempt from the age verification control mechanisms." To use services in Turkey, however, they need "an exceptional token," generated "using an online service accessible without identity verification and solely based on passport information." The text does not explain how a passport-based token avoids the same misuse risks that the main system is built to prevent.

Verification does not end at signup. Article 6 requires a token check "during the account creation process," after which the provider "shall implement single-step or multi-step age verification methods of its own choosing for the duration of service provision." If there is "reasonable suspicion" that a verified account is being used "in a manner inconsistent with the age range," the provider must suspend it, and a fresh token check is required before reactivation. Platforms will therefore run their own age assurance systems on top of the government token, a combination that PPC Land's explainer series describes as covering any method of checking, estimating or inferring whether a user is above or below a threshold.

Article 5 also sets quality standards for those in-house methods. They must be "technically robust and reliable to prevent false declarations and manipulation attempts," "consistent over time and across different users," and must "produce verifiable results." They must be presented to users, parents and the Presidency in a way that is "transparent, understandable, auditable, and testable," and must not "result in systematic discriminatory outcomes" on grounds including age, gender, race, disability, language, religion and physical appearance.

The segregated service for 15 to 17-year-olds

Article 8 is the longest provision in the regulation and the one with the most direct consequences for product teams and advertisers. Providers must "separate" the services offered to verified users aged 15 to 17, and the list of what that separate service may not contain is specific.

According to Article 8(5), on accounts of children who have reached 15:

  • "Services that could lead to the development of addiction may not be provided." The term is not defined.
  • Accounts are private by default and "may not be offered with the option to be public."
  • Follower and following lists cannot be viewed by anyone other than the account holder.
  • Only accounts the child has followed may send messages, and messages "may not include a 'seen' notification."
  • The account "may not include a live streaming feature."
  • Providers must take "the necessary technical measures to ensure that others cannot take screenshots" of the child's profile photo, account, posts and images.

The most far-reaching item concerns feeds. Article 8(5)(ğ) states that "no interface, design, or feature may be provided that enables visual content to be presented sequentially through scrolling, tapping, clicking, or similar user actions, or automatically." The provision "applies to the application, website, and all other interfaces through which the service is provided."

Read literally, that clause covers the vertical scrolling feed, tap-through Stories, swipe-based short video and autoplay. Each of those formats presents visual content in sequence through a user action or automatically. The regulation gives no indication of what an acceptable alternative would look like. Article 8(7) authorizes the Presidency "to determine the procedures and principles regarding the implementation of this article," which suggests further guidance may follow. Regulators elsewhere have targeted similar features through narrower routes: the European Commission's preliminary finding against Meta in July 2026 examined infinite scroll and autoplay under the Digital Services Act, and California's Assembly Bill 1709 bars addictive features such as algorithmic feeds for users under 16. Turkey's text goes further by prohibiting sequential presentation outright rather than restricting the algorithm that orders it.

Discovery, contacts and recommendations

Article 8 also cuts off the growth mechanics that platforms use to connect users. A provider "may not synchronize an account belonging to a child who has turned fifteen" with phone contacts, email address books, or "contact, friend, and follow lists on other applications and platforms." It "may not access such sources or process data obtained from them." Parental contact data used for account creation, recovery, security and parental control is excluded.

The deletion requirement is notable. Data obtained in breach of the rule, "along with any matching, inference, and recommendation records generated from such data, shall be deleted without delay." That reaches beyond the raw contact list into derived records.

Recommendation runs in neither direction. The child's account "may not be recommended for following to other accounts, nor may other accounts be recommended for following to the account of a child." The provider may not match third-party contact data "regardless of which account or source the data was transferred from," and may not make the child's account "searchable, locatable, or recommendable through such data." It also may not nudge users toward enabling these functions "through interface design, default settings, notifications, or repeated permission requests." That last phrase reads as a ban on what PPC Land's explainers call a dark pattern, applied to a specific function.

What changes for advertising

For marketers, Article 8(5)(h) is the provision that matters most. It states: "Accounts for children who have reached the age of fifteen may not be customized based on the child's behavior; the child's personal data may not be used for profiling or personalized commercial advertising activities."

That is a prohibition on ad personalization for every verified user aged 15 to 17 in Turkey, with no consent option and no parental override written into the text. The first half of the sentence also bars behavioral customization of the account itself, which would cover content ranking based on engagement history.

Advertising appears elsewhere in Article 8 too. Article 8(1) requires that the child's age, best interests, development, and the "prevention of the risks of sexual abuse and commercial exploitation of the child" be taken into account "regarding the content, advertisements, and other services provided by the social media provider" to users aged 15 to 17. Article 8(2) requires "high-level privacy settings by default" and processing "only to the minimum extent necessary."

Several practical questions follow, none answered in the text:

  • Contextual delivery. The regulation does not ban ads to teens. It bans profiling and personalization. Contextual advertising, placed according to the content on screen rather than the viewer's data, appears to remain available, but ad formats that live inside scrolling or tap-through feeds may have nowhere to run if those surfaces are switched off for teen accounts.
  • Customer list matching. The ban on matching "third-party contact data in its possession" with a child's account, "regardless of which account or source the data was transferred from," could be read to cover advertiser-uploaded customer lists. The text is framed around contact discovery rather than advertising, so this reading is an inference, not a stated rule.
  • Measurement. If behavioral data from 15 to 17-year-olds cannot be used for profiling, attribution and lookalike modelling built on those signals would need to exclude teen accounts. The regulation does not mention measurement directly.

Parental control tools in Article 9 add a commercial dimension as well. They must allow parents to make "fee-based transactions - such as purchases, rentals, and paid subscriptions - subject to parental permission or approval," and to set spending limits. That affects in-app purchases, creator subscriptions and any paid feature sold to teen accounts.

Parental controls

Article 9 sets a minimum feature list. Tools must allow control of account and feature settings, parental approval and spending limits for paid transactions, and "mechanisms for monitoring usage time, allowing parents to set and limit this time, and controlling location sharing." They must be offered in Turkish, be "easily located and activated," work across devices and operating systems, and notify the child "clearly" when switched on.

Two design principles stand out. The tools must prevent the child from disabling or changing parental authority "without the parent's knowledge and the same security verification." Yet they must also be "designed in a way that does not disproportionately compromise the child's privacy and is based on the principles of communication, learning, and empowerment rather than mere monitoring." The text does not explain how these two requirements are to be balanced in practice.

Article 9 also closes a loophole platforms might otherwise use. According to the text, "The provision of parental control tools does not relieve the social media provider of its obligation to offer services specifically tailored for children who have reached the age of fifteen." Parental supervision is an addition to the segregated service, not a substitute for it.

Appeals and reporting

Article 10 requires a free appeal mechanism, available in Turkish, covering age verification results, account suspensions or closures, and measures applied under the segregated service. Appeals "may not be reviewed entirely by automated systems and must be subject to meaningful human review." Account content and personal data "shall not be deleted until the application and/or objection is resolved."

Providers must tell appellants that a complaint can be filed with the Presidency and that legal action is possible. Every year, they must report the number of appeals, the acceptance rate and the average resolution time to the Presidency, and publish the same figures on their own websites. That produces a public dataset on how often platforms get age decisions wrong, at least as measured by successful challenges.

Sanctions and deadlines

The regulation does not set its own penalty amounts. Article 11 refers back to Article 4 of the Annex to Law No. 5651 for "the imposition, notification, appeal procedures, and lifting of sanctions." Before any sanction, the provider "shall be notified of the violation and granted a reasonable period of time to remedy it." The severity of a sanction is to reflect "the severity of the violation, its duration, the number of children affected, and the social media provider's good-faith efforts to comply."

Two dates govern compliance. Article 13 states: "This Regulation shall enter into force on November 1, 2026." That is 22 days after publication. From then, new accounts must pass a token check at creation.

Existing accounts get longer. According to the transitional provision, accounts "opened prior to the effective date of this Regulation and not yet verified" must be checked with the token "at least once by March 31, 2027," which gives providers 150 days from entry into force. Accounts of under-15s "shall be closed after notification," and their data "deleted immediately if no appeal procedure is initiated," or after any appeal concludes. Verified 15 to 17-year-olds move into the segregated service.

Article 12 requires the Presidency to publish a technical guide covering "the technical structure of the age verification token, the format of the information it contains, and the process that social media providers must follow." The regulation does not say when that guide will be shared. With entry into force three weeks away, the timing of that document will determine how much engineering time platforms actually have.

Inconsistencies in the published text

The English text supplied for this report contains several drafting irregularities. Article 4 lists two definitions under the letter "d)": one for "Child" and one for "Parental control tools." Article 8(5) does the same, with two items lettered "d)" covering messaging and contact synchronization. These are likely translation artifacts of the Turkish alphabet sequence, which runs c, ç, d, but they make cross-referencing awkward.

The authority is named three different ways. Article 4 defines the "Presidency" as "The Presidency of Cybersecurity" and the "President" as "The President of the Cybersecurity Board." The header names the issuer as the "Cyber Security Directorate," and Article 14 states that the regulation "shall be enforced by the Head of Cybersecurity." Article 9(3), which lists minimum parental control features, ends with item c) followed by a stray full stop on a line of its own, which may indicate a dropped item. None of these alters the core obligations, but they will matter to lawyers drafting compliance memos from an English version.

Where this sits internationally

Turkey joins a growing group of jurisdictions setting 15 or 16 as a floor for social media. Australia's ban on under-16s took effect on December 10, 2025, with penalties of up to AU$49.5 million and a prohibition on forcing users to rely on government ID. Meta removed access to 756,000 under-16 accounts in Australia between December 1, 2025 and June 30, 2026. France approved an under-15 ban in July 2026 but dropped the platform age verification duties from the final text. The European Commission's EU KIDS Act proposal of September 17, 2026 would give platforms six months to disable existing under-15 accounts.

Turkey's approach differs on three points. First, it mandates a single state-issued token, which Australia explicitly avoided. Second, it does not leave room for parent-supervised accounts below 15, unlike the European Commission proposal, which allows guardian-controlled accounts for 13 and 14-year-olds. Third, its segregated service for 15 to 17-year-olds is considerably more restrictive than voluntary industry models. Reddit's EU teen settings, in force since June 24, 2026, disabled ad personalization for all teen accounts, but nothing in that rollout removed feeds or live streaming.

Turkey's data protection authority has also been active on how consent is collected. In March 2026, the KVKK Board required consent texts and clarification texts to be separate documents, a ruling that already forced changes to data collection flows for businesses operating in the country.

The age token model also echoes an argument from the industry. When it published its Australian enforcement figures, Meta argued for one reliable age signal delivered by the operating system or app store. Turkey has built a single signal, but at the level of the state rather than the device.

Why this matters for the marketing community

For advertisers running campaigns in Turkey, the most immediate effect is on audience composition. From November 1, new under-15 sign-ups end, and by March 31, 2027 every remaining account will carry a verified age tier. Users aged 15 to 17 will be reachable only through non-personalized delivery, and possibly not at all in feed-based placements if those surfaces are removed for teen accounts. Campaigns that include 15 to 17-year-olds through broad age targeting, or that rely on signals generated by those users, will see that segment's inventory change shape.

For platforms, the engineering scope is wide: token ingestion, continuous age assurance, a separate product surface without feeds, live streaming or contact sync, screenshot blocking, parental tools, and a human-reviewed appeals process with annual public reporting. The sanctions framework under Law No. 5651 already applies to foreign providers operating in Turkey. The open question is whether providers build a full Turkish teen product or decide that the restrictions make the 15 to 17 tier commercially unviable, which the text does not prevent.

Timeline

Summary

Who: Turkey's Presidency of Cybersecurity, which issued the regulation, and all domestic and foreign social media providers accessible from Turkey, along with their users, parents and advertisers.

What: A regulation barring social media services to under-15s, requiring age verification through a government-issued e-Government token, and imposing a segregated service on 15 to 17-year-olds with no profiling or personalized advertising, no public accounts, no live streaming, no contact sync and no sequential scrolling or tap-through content.

When: Published today, October 10, 2026, in Official Gazette Issue No. 33396. It enters into force on November 1, 2026, and existing accounts must be verified by March 31, 2027.

Where: Turkey, applying to any social media provider accessible from the country, with a passport-based exceptional token for non-resident visitors.

Why: The regulation implements Article 4 of the Annex to Law No. 5651 and states its aim as protecting children's best interests and their "physical, mental, psychological, social, and emotional development," while limiting the personal data processed for age checks to the age threshold alone.