13 October 2026
The Regulation on the Provision of Segregated Services Specific to Children and Age Verification by Social Network Providers, prepared by the Cyber Security Presidency (SGB), was published in the Official Gazette of 10 October 2026 and will enter into force on 1 November 2026. The Regulation does not stop at banning children under 15 from using social media. It requires every user, whatever their age, to be verified when opening an account by means of an “age verification token” generated through the e-Government Gateway (e-Devlet). Existing accounts must also be verified by 31 March 2027.
We warned against this danger in our statement of 6 April 2026, Logging into Social Media with Your ID. The day we warned of has come.
The Regulation Goes Beyond the Law
Paragraph 7 of Additional Article 4 of Law No. 5651 requires social network providers to take “the necessary measures, including age verification” so as not to provide services to children under 15. The Law makes no mention of e-Devlet, of identity verification by the State, or of the verification of adults. Under Articles 13 and 20 of the Constitution, fundamental rights may be restricted, and personal data processed, only by law. Introducing by regulation a requirement that makes the exercise of freedom of expression conditional on State identity verification is a clear breach of the principle of legality. Adding location sharing, which is not provided for in the Law, to the parental control tools is likewise ultra vires.
The Regulation goes further still, handing the Presidency a blank cheque with no basis in the Law. Article 8(7) and Article 12(2) empower the Presidency to set the procedures and principles for segregated services, to “determine strategies”, to “resolve uncertainties” and to “regulate procedures and principles for implementation where necessary”. The Regulation thereby builds the danger of function creep, which we warned of in our statement of 6 April, into its own text.
Even Australia, which has banned under-16s from social media, prohibits platforms from collecting government-issued identification or using accredited digital ID services unless a reasonable alternative is offered (section 63DB of the Online Safety Amendment (Social Media Minimum Age) Act 2024). Türkiye, by contrast, combines the strictest ban model with a mandatory age verification system based on identity verification through e-Devlet, with no alternative.
Either Ineffective or a Tool of Surveillance
On the one hand, the Regulation states that “methods that only allow the age threshold to be determined, rather than identity,” will be used (Article 5(3)). On the other, it requires the token to be generated through identity verification on e-Devlet (Article 7). The statement that the token will not contain a username may give the impression of a step back, but the danger lies not in the content of the token but in the process through which it is generated and verified. The Regulation is silent on the records the State will keep in this process.
The Regulation contains an irresolvable dilemma. If the token establishes no link to the individual, nothing can prevent a token generated by an adult from being handed to a child. If the token is made “robust against manipulation”, as the Regulation requires, an infrastructure will have been built that makes it possible to track who verified on which platform and when. The Regulation will either be ineffective or become a tool of surveillance.
The Cyber Security Presidency holds the key to this gate. It is the same institution that transmitted to platforms the Article 8/A decisions behind the blocking of at least 1,270 X accounts in September alone. This means the end of anonymity, one of the last refuges of critical expression, at a time when the accounts of İFÖD, EngelliWeb and Prof. Dr. Yaman Akdeniz have been withheld in Türkiye.
Exclusion from the Public Sphere, Not Protection
An absolute ban is imposed on under-15s, without any graduated option such as parental consent. The accounts of children aged between 15 and 18 cannot be public, cannot use live streaming and cannot use interfaces that present visual content sequentially through “scrolling, tapping or clicking”. These provisions push young people out of public debate instead of protecting their rights to expression, association, access to information and participation guaranteed by the UN Convention on the Rights of the Child.
The Regulation requires filtering against content that “may harm the development” of the child, but does not define such content. There is a serious risk that this vague criterion will be used to restrict young people’s access to LGBTI+ and political content, given that LGBTI+ organisations have been blocked in the so-called “Ailem Güvende” (My Family Is Safe) operations and T24 has been blocked on the grounds of publications “aimed at weakening the Turkish family structure”.
An Identity Regime Built Behind Closed Doors
No public consultation was held on the Regulation, and the technical structure of the token has been left to a “guide” that will be shared only with platforms (Article 12). The guarantee of privacy has been entrusted to a document hidden from those who should scrutinise it. The complaints authority is, once again, the Cyber Security Presidency. Sanctions for non-compliant platforms range from administrative fines of up to three per cent of global turnover to advertising bans and bandwidth throttling of up to 90 per cent.
Conclusion and Our Call
İFÖD will file an action before the Council of State seeking the annulment of the Regulation and a stay of its execution. Accordingly, we call for the following.
- The Regulation must be withdrawn before it enters into force on 1 November 2026.
- Access to social media must not be made conditional on e-Devlet identity verification, and methods that do not require identification and that protect privacy must be recognised.
- The guide and all documents relating to the token system must be made public.
- The rights of children aged between 15 and 18 to expression and participation must be protected, and the criterion of “harmful content” must be clearly defined.
- Social network providers must pursue legal remedies rather than act as intermediaries in the identification of their users.
Freedom of Expression Association (İFÖD)