The 15-Year Age Limit on Social Media and the Era of Age Verification via e-Devlet

The Regulation on the Provision of Differentiated Services Specific to Children by Social Network Providers and on Age Verification, published in the Official Gazette (Resmî Gazete) dated October 10, 2026 and numbered 33396, determines how social network providers will apply the age limit and with what measures they will protect child users. The regulation affects how platforms operate, from account opening to advertising systems, from messaging to the review of objections. As of October 13, 2026, the regulation has been published but has not yet entered into force. [1]

Publication, entry into force and transition dates

March 31, 2027 is not a date to which all obligations are postponed. The transitional provision concerns the verification of certain existing accounts. The entry into force of the regulation on November 1, 2026 must be kept separate from the date by which the verification of old accounts will be completed. Nor can it be concluded from the text that all existing accounts will be closed together on November 1. (Regulation Art. 13 and Provisional Art. 1.) [1]

Which users the age limit will apply to

For the purposes of the regulation, a child is a person who has not reached the age of 18, even if the person attains majority earlier. Reaching the age of 15 therefore does not give a right to use all the features of an adult account. There are three separate situations:

• Those who have not reached 15: The social network provider cannot provide the service; if age verification shows this result, the opening of a new account is refused.

• Those who have reached 15 but not 18: The differentiated service specific to children applies. Privacy, communication, advertising and interface restrictions are built into the operation of these accounts.

• Those who have reached 18: The child-specific restrictions do not apply, because of the definition of a child in this regulation; however, the rule of age verification at account opening continues.

The regulation contains no general exception that would exclude a child under 15 from this prohibition with parental consent. Parental control tools cannot be interpreted as a permission mechanism that lifts the age limit. (Regulation Arts. 4–6 and 9.) [1]

In assessing scope, the real function of the service matters. Services that enable users to create, view or share content for the purpose of social interaction are the basis. Not every website, educational application or digital game falls into the same category automatically because of its name or because it is online. The provision added to Law No. 5651 for gaming platforms should be assessed separately. (Regulation Arts. 2 and 4; Law No. 7578 Arts. 21–23.) [1] [2]

How age verification via e-Devlet will work

The process under the regulation has four stages:

1. The user verifies identity through the e-Devlet Gateway and accesses the service of the Cyber Security Presidency (Siber Güvenlik Başkanlığı) for generating an age verification token.
2. At the user’s request, a technical token is generated showing whether the required age thresholds have been met.
3. The user uploads this token to the relevant social network platform.
4. The platform verifies that the token was generated by the Presidency and applies the service appropriate to the user’s age group.

The token only states whether the person has reached the age of 15 and, if so, whether the person has reached 18. It cannot contain any personal data, username or information that allows third parties to identify the person. The platform cannot use the token for any purpose other than age verification. (Regulation Art. 7.) [1]

In this model, identity verification is carried out at the e-Devlet stage; the content of the token transferred to the social network is limited to the age thresholds. It cannot be said that identity verification is not carried out at all or that the whole process is anonymous. Likewise, no general authority for platforms to collect the user’s T.C. identity number, an image of the identity document or the e-Devlet password can be derived from the regulation.

Merely entering a date of birth does not replace the mandatory token verification at account opening. If reasonable suspicion arises that a verified account is being used contrary to its age group, the account is suspended; token verification is required for it to be used again. Additional methods to be applied while the service continues must also comply with the principles of personal data protection, reliability, accessibility and non-discrimination. (Regulation Arts. 5–6.) [1]

A guide to be prepared by the Presidency is envisaged for the technical format of the token and the procedural steps platforms will apply. The text of the regulation does not show that the same application screen is open on all platforms today. For account security, users are advised to follow official service and platform announcements and not to give their e-Devlet password in response to messages sent under the pretext of verification. (Regulation Art. 12.) [1]

Exception for those temporarily in Türkiye

An exemption from the ordinary age-check mechanisms has been provided for users who are not residents of Türkiye and are present only temporarily. For these persons to be able to use the service, it is envisaged that, upon their application, an exceptional token will be generated through a service accessed with passport information only, without identity verification via e-Devlet.

The criterion is not foreign citizenship alone; both non-residence in Türkiye and temporary presence matter together. This provision cannot be extended to mean that all foreign users are unconditionally exempt or that the age limit of 15 is generally lifted. (Regulation Art. 7/1-d.) [1]

Which features will change in child accounts

The differentiated service to be offered to children who have reached 15 is an obligation that is reflected across the whole application. Contracts and data policies the child can understand, high privacy by default, minimal data processing and settings that reduce exposure to harmful content must be provided together. (Regulation Art. 8.) [1]

Privacy, messaging and live streaming

• The child account will be private; a public account option cannot be offered.

• Information on followers and followed accounts will not be shown to accounts other than the child who owns the account.

• Only accounts the child follows will be able to send the child messages; messages will carry no read receipts.

• The child account will not include the ability to start a live stream.

• Technical measures will be introduced to prevent others from taking screenshots of the profile photo, the account, posts and images.

Assessed technically, the obligation concerning screenshots does not create a practical guarantee that content can never be copied under any circumstances. For example, the fact that an image can be recorded with another device shows that deliberate sharing remains important alongside technical protections. (Regulation Art. 8/5.) [1]

Contact lists, account suggestions and advertising

Child accounts cannot be synchronized with the phone directory, an email address book, contact lists in online storage, or friend and follow lists on other platforms. Making a child account discoverable or suggestible by using the contact data of third parties is also prohibited. A child account cannot be suggested to other accounts for following, and other accounts cannot be suggested to the child.

There is a narrow exception: the processing of the parent’s contact information only for the purposes of account creation, verification, recovery, security and parental control is not counted as synchronization for the purposes of this provision. This exception does not provide a basis for collecting the contact information of other persons. Contact data obtained in breach of the rule, and the matching, inference and suggestion records generated from it, must be deleted without delay.

Child accounts cannot be customized according to the child’s behavior; the child’s personal data cannot be used for profiling or for personalized commercial advertising. This provision should not be conveyed as a complete prohibition of all advertising; the prohibited activity and data use must be described accurately. (Regulation Art. 8/5-d, e and h.) [1]

Visual content feeds and designs that may create addiction

The regulation prohibits services that may have an addiction-forming effect. It also imposes a broad restriction on interfaces and functions that present visual content in succession by scrolling, tapping, clicking or automatic advancement. Explaining this provision merely as turning off automatic video playback narrows its scope. The rule must be taken into account in all interfaces, including applications and websites. The compliance of specific designs should be determined by assessing the scope of the provision and the Presidency’s implementation principles together. (Regulation Art. 8/5-a and ğ.) [1]

Scope and limits of parental control

The control tools will be provided for persons such as the mother, father or guardian who have the legal authority to make decisions about the child. These tools will include mechanisms for managing account settings, making paid transactions subject to permission or approval, setting spending limits, monitoring and limiting usage time, and location sharing.

The tools must have a Turkish option, be easy to activate and work with different devices. When they are activated, the child must be clearly informed. Measures are also required to prevent the child from removing the control authority or the changes made without the parent’s knowledge and the same security verification.

Parental control cannot disproportionately eliminate the child’s privacy. The regulation is based on communication, learning and empowerment. In addition, offering parental tools does not end the platform’s responsibility to provide a safe service to children. (Regulation Art. 9.) [1]

What will happen to existing accounts and account data

For accounts opened before November 1, 2026 and not verified by a token, verification will be completed by March 31, 2027 at the latest. If the verification shows that the child has not reached 15, the child’s existing account will be closed with notice. The accounts of children who have reached 15 will be moved to the differentiated service.

In closed accounts, the deletion of data depends on whether an objection is made. If the objection mechanism has been used, its conclusion is awaited; if it has not been used, the data is to be deleted without delay. For this reason, a person who receives an incorrect age determination or a closure notice should keep the notice and the application record and use the platform’s objection channel without delay. The preservation of data during the objection does not mean that the account will be reopened automatically. (Regulation Art. 10 and Provisional Art. 1.) [1]

The provisional provision does not expressly regulate that all accounts that do not verify their age will be deleted automatically in the same way on March 31, 2027. Failing to determine age and determining that the user is under 15 are different situations; the platform’s action should be examined on the basis of its own grounds and the rules that apply.

How to object to an incorrect age determination or an account closure

The platform is obliged to establish a free, accessible application system in Turkish for the age verification result, for suspension or closure actions, and for measures applied to a child account. The review cannot consist merely of an automatic rejection message; meaningful human review must be carried out. The notice of the result must state the possibility of complaining to the Cyber Security Presidency and of applying to the courts. (Regulation Art. 10.) [1]

In practice, the following information can be brought together for an application:

• Information that identifies the account and the date on which the action was notified.

• The content of the age verification, suspension or closure notice.

• An explanation of the error and the correction requested.

• The numbers of earlier applications and the platform’s responses.

• An express request for the account contents and personal data to be preserved until the objection is concluded.

Unnecessary copies of identity documents or account passwords should not be attached. The information requested for the review should be assessed in terms of its purpose and the method of secure transmission. This list is not a mandatory form set by the regulation; it is a suggestion to make the application clear.

Article 10 of the regulation asks that applications be concluded quickly; it sets no numerical application or response period for all these objections. A period of 48 hours, 7 days or 30 days belonging to another procedure cannot be carried over to this mechanism automatically. The judicial route, the competent authority and the time limit for bringing an action are determined separately according to the nature of the act objected to.

If there is a personal data breach, the application route is assessed separately

A problem such as the unnecessary collection of identity data or the use of data outside its purpose may also call for a KVKK application. The time limits of this route are separate from the platform’s account objection. The data controller must conclude the request as soon as possible and within 30 days at the latest. A complaint may be made to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) against a response given on time within 30 days of learning of the response, taking into account the limit of 60 days from the first application in any case. If no response is given, the complaint route can be used within 60 days from the first application, after the 30-day response period ends. A late response does not extend the 60-day period. It should not be assumed that an account objection on the platform suspends these time limits. [4]

Platforms’ compliance and sanction liability

Platforms need to address the verification integration together with all the functions of the child account, data security, the verification of parental authority and human review. The same protection must be provided in the application, on the web and in other interfaces; accessibility, including for users with disabilities, must be maintained and systematically discriminatory results must be prevented. The scope and use of the measures for children and of the parental tools must be explained on the website.

The number of applications, the acceptance rate and the average time to conclusion will be reported annually to the Presidency and published on the platform’s website. These records show that the obligation is not fulfilled merely by adding an application button. (Regulation Arts. 5 and 8–10.) [1]

Article 11 of the regulation refers to additional Article 4 of Law No. 5651 with regard to sanctions. A violation will first be notified to the provider, and a reasonable period appropriate to its nature will be given for it to be remedied. In the assessment, the seriousness of the violation, how long it continues, the number of children affected and good-faith compliance efforts will be taken into account.

When the statutory conditions are met, an administrative fine, an advertising ban and the narrowing of bandwidth by a judge’s decision may come into question. These are not consequences that arise automatically and simultaneously from a single notice of violation; the relevant obligation and the graduated procedure must be examined separately. It cannot be concluded from the platform sanctions in the regulation that a child or a parent will automatically be fined for this reason. (Regulation Art. 11; Law No. 7578 Art. 22; Law No. 7590 Art. 27.) [1] [2] [3]

Priorities for preparation in practice

For families and users: It will be useful to review the accuracy of account information, follow official verification announcements, assess together with the child the services the child uses, and discuss paid transactions and usage time settings. In the event of an incorrect action, notification and application records should be kept; the request for data preservation should be stated expressly.

For platforms: Token verification, failed verification and account recovery processes should be designed together. Default settings for children, advertising and recommendation systems, contact data and the deletion of existing records should be reviewed. A team for human review and annual report records should be set up; technical measures should be tested together with data security obligations. [5]

Legal assessment: The effective application of the age limit depends on a wrongly classified user having access to a route for correction and on the data collected for verification being kept limited. The protection objective should be turned into verifiable obligations at every stage of the account. As the technical guide and the Authority’s practices develop, new assessments may be needed, particularly regarding incorrect verification, the exception for temporary users and the interfaces offered to children.

Conclusion

The new regulation establishes a system of responsibility on social networks that differs according to age and extends to the product design of platforms. The entry-into-force date of November 1, 2026 and the verification date of March 31, 2027 for existing accounts must be followed together. The age limit of fifteen, the child account rules, the token containing limited data and the safeguard of an effective objection must be applied as a whole. For families, conscious account management comes to the fore; for providers, documentable technical and administrative compliance preparation.

This content is for general information purposes. A specific account action, data processing activity or sanction requires a separate legal assessment.

Frequently Asked Questions

Has the 15-year age limit on social media started to apply today

As of October 13, 2026, this regulation is not yet in force. The regulation’s entry-into-force date is November 1, 2026; the final date by which verification will be completed for the existing accounts concerned is March 31, 2027.

Can an account be opened for a child under 15 with parental consent

The regulation does not provide parental consent as a general exception that lifts the prohibition on the service. Parental control tools do not replace this prohibition.

Will adults also have to verify their age

Yes. Token verification at account opening is envisaged for users in general. The child-specific account restrictions, on the other hand, apply to the relevant age group that has not reached 18.

Will an identity card or an e-Devlet password be given to the social media company

Under the regulation, the instrument passed to the platform is the age verification token. The token contains only information on the age thresholds of 15 and 18. This process does not require the e-Devlet password to be given to the platform.

Will a child who has reached 15 be able to use a public account and live streaming

For a user who has reached 15 but not 18, a public account option and the ability to start a live stream cannot be offered.

Will all existing accounts be closed on November 1, 2026

No. The regulation provides until March 31, 2027 for the verification of the existing accounts concerned. The account of a child found during verification not to have reached 15 is closed with notice.

Can the data in my account be deleted when I object

The account contents and personal data cannot be deleted until the application or objection under the regulation is concluded. This protection does not result in the account being reopened automatically.

Which authority is competent to review the applications

The initial account objection is made through the platform’s mechanism. The notice of the result must explain the complaint to the Cyber Security Presidency and the judicial route. For requests concerning the protection of personal data, the KVKK procedures and time limits are assessed separately.

References

[1] Regulation on the Provision of Differentiated Services Specific to Children by Social Network Providers and on Age Verification, Official Gazette, October 10, 2026, No. 33396, Arts. 1–14 and Provisional Art. 1. Full text published by the Edremit District Directorate of National Education (MEB).

[2] Law No. 7578 on Amendments to the Social Services Law and Certain Other Laws, particularly Arts. 21–23 and 27; amendments concerning additional Article 4 of Law No. 5651. Text of the law as adopted by the Grand National Assembly of Türkiye (TBMM).

[3] Law No. 7590 on Amendments to Certain Laws and Decree Laws, particularly Art. 27; amendments to the duties and references concerning the Cyber Security Presidency. Text of the law as adopted by the Grand National Assembly of Türkiye (TBMM).

[4] Personal Data Protection Board, Decision No. 2019/9 of January 24, 2019; time limits for applications and complaints under Arts. 13–14 of Law No. 6698. The Authority’s official announcement.

[5] Personal Data Protection Authority, Obligations Regarding Data Security under Art. 12 of Law No. 6698.

[6] Initial publication on the subject: Atty. Nurdan Peksak, “A New Era in Social Media: The 15-Year Age Limit, Mandatory Age Verification and the Obligations Imposed on Platforms,” Hukuki Haber, October 12, 2026. Related article. The legal explanations in this update have been prepared on the basis of the official texts above.

Date of source access and legislative research: October 13, 2026.