Turkey Social Media Ban for Under-15s From 1 November 2026: Do Foreigners and Tourists Need e-Devlet Age Verification?

Article numbers in this guide refer to the regulation unless another law is named. The guide describes the legal text; how it applies to a particular account depends on the facts.

What Changes on 1 November 2026?

On 10 October 2026, Turkey's Official Gazette (Resmî Gazete, issue 33396) published a regulation prepared by the Cyber Security Presidency (Siber Güvenlik Başkanlığı). Its Turkish title is "Sosyal Ağ Sağlayıcı Tarafından Çocuklara Özgü Ayrıştırılmış Hizmet Sunulmasına ve Yaş Doğrulamaya İlişkin Yönetmelik": the regulation on separate services for children and age verification by social network providers. It enters into force on 1 November 2026 (Art. 13).

The regulation covers social network providers that can be reached from Turkey, whether they are based in Turkey or abroad, and their users (Art. 2). Its central rule is one sentence: a social network provider may not provide its service to children who have not reached the age of 15 (Art. 5(1)). To apply that rule, the platform must verify the user's age with an age verification token (yaş doğrulama belirteci) when the account is created (Art. 6(2)).

The rule rests on Law No. 5651, Turkey's internet law. Law No. 7578, published in the Official Gazette on 1 May 2026, rewrote the relevant paragraph of that law; the change also takes effect on 1 November 2026 [L1]. Since Law No. 7590 of 24 July 2026, the authority for the social network rules in Law No. 5651 has been the Cyber Security Presidency, which took over this role from the Information and Communication Technologies Authority (BTK) [L2].

Which apps are covered?

The regulation does not list any app. It applies to every "social network provider": a person or company that lets users create, view or share content such as text, images, sound and location for the purpose of social interaction (Art. 4(1)(e)). The text sets no minimum number of users, so the rule is not limited to the largest platforms. Instagram and TikTok are built around sharing photos and videos for social interaction, but the regulation itself names no platform, and it does not say whether a particular service, such as a messaging app, falls within the definition. Online game platforms have their own new rules in Law No. 5651 (Additional Article 5, in force from the same date), which deal with age ratings and parental controls [L1].

How does the e-Devlet age token work?

e-Devlet (turkiye.gov.tr) is the Turkish government's portal for online public services; it is managed by the Cyber Security Presidency [E1]. The regulation says that age verification is carried out through e-Devlet and describes these steps (Art. 7(1)):

1. The user logs in to e-Devlet, which verifies the user's identity, and opens an online service offered by the Cyber Security Presidency.
2. At the user's request, the service generates an age verification token.
3. The user uploads the token to the platform.
4. The platform first confirms that the token was created by the Presidency through e-Devlet, and then reads the user's age group from it. It may not use the token for any purpose other than age verification.

The check does not end there. For as long as the account is used, the platform runs single or layered age checks of its own choosing. If there is reasonable suspicion that a verified account is being used outside the age range set by the regulation, for example by a younger child, the platform suspends the account, and the account can be used again only after a new check with a token (Art. 6(3)).

What does the token show about me?

The token carries only two pieces of information: whether the user has turned 15 and, if so, whether the user has turned 18 (Art. 7(1)(b)). It contains no other personal data. In particular, it does not contain the user names shown on the user's profile or any other information that would make the user identifiable to third parties. The regulation also says that age checks should establish only the age threshold, not the person's identity, and that personal data protection is the starting point (Art. 5(3)).

Some points are not covered by the text: what records the Presidency keeps when it issues a token, whether one token can be used for several platforms, and whether a token expires. The token's format is left to a technical guide that the Presidency prepares and shares with platforms (Art. 12(1)); the regulation does not require it to be published, and we have not seen a public version.

Who Must Do What: Resident Foreigners, Temporary Protection, Tourists and Children

The table sets out how the regulation applies to each group. Where the text is silent, the table says so.

Who	What the regulation provides	New account from 1 November 2026	Existing account (check by 31 March 2027)
Resident foreigner (residence or work permit; foreigner ID number usually starting with 99)	Not covered by the visitor exception; the main e-Devlet route applies (Art. 7(1)(a)).	A token created on e-Devlet after logging in, uploaded to the platform at sign-up (Arts. 6(2) and 7(1)).	The platform must check the account with a token at least once (provisional Art. 1).
Temporary protection holder	Not mentioned in the regulation. Holders live in Turkey, so the visitor exception does not obviously fit; the only other route in the text is e-Devlet.	As for residents, as far as the text goes. e-Devlet's Turkish FAQ accepts a valid temporary protection document for a password [E4]. A separate route for people who cannot use e-Devlet has not been announced.	The same deadline as for everyone else.
Tourist or other short-term visitor	Exempt from the age-verification checks in the regulation (Art. 7(1)(d)).	To use services in Turkey: an "exceptional token", on application, created from passport details only, without identity verification (Art. 7(1)(d)).	The text does not deal separately with visitors' existing accounts; platforms have not said how they will treat them.
Child under 15 (any nationality)	Platforms may not provide their service (Art. 5(1)). There is no parental-consent exception.	The sign-up is refused (Art. 6(4)(a)).	Closed after notice; data deleted once any objection is decided, or without delay if none is made (provisional Art. 1(1)(a)).
Teenager aged 15–17	Allowed, but only under the separate rules for children (Art. 8).	Token at sign-up; the account is set up under the teen rules (Art. 6(4)(b)).	Moved to the teen rules after the check (provisional Art. 1(1)(b)).

"Resident" is not defined in the regulation. The table follows the wording of Article 7(1)(d), which exempts users "not resident in Turkey and there temporarily". A residence permit is the clearest sign that someone lives in Turkey, and a holiday is the clearest example of a temporary stay. Where the table places temporary protection holders is our reading of the text, not a rule the regulation states.

Do I Need e-Devlet to Use Instagram or TikTok in Turkey From 1 November 2026?

If you live in Turkey, the route in the regulation is e-Devlet. The text says that "age verification is carried out through the e-Devlet Gateway" (Art. 7(1)), and the only other route it describes is the passport-based token for visitors. For a platform that falls within the definition of a social network provider, the rules work like this:

• New account from 1 November 2026: the platform must verify age with a token when the account is created (Art. 6(2)). For a resident, the token comes from the e-Devlet service after logging in (Art. 7(1)(a)).
• Existing account: the regulation does not require any step from the user on 1 November itself. The platform must check each existing account with a token at least once by 31 March 2027 (provisional Art. 1).

The regulation also requires age-verification methods to be fair and neutral, not to produce systematically discriminatory results based on characteristics such as language, ethnic origin, religion or disability, and to be accessible to all users, including people with disabilities (Art. 5(6)).

How do foreign residents get into e-Devlet?

e-Devlet's help page for non-citizens says that foreigners can use its services after applying to a PTT centre (the Turkish post office) with the residence permit document showing their foreigner identification number. That number has 11 digits and generally starts with 99. The same page lists three ways to log in to services that require identity checks: a password, an e-signature or a mobile signature [E1]. A resident with none of these cannot use the main route until one of them is set up.

The regulation does not distinguish between types of residence permit. Short-term, family, student and long-term permit holders all live in Turkey in the same sense; our guide to permanent residence in Turkey explains the long-term permit. The regulation also does not explain how a teenager who has no e-Devlet login of their own obtains a token.

I Am a Tourist: How Does the Passport-Based Exception Work?

Article 7(1)(d) has two sentences. The first says that users who are not resident in Turkey and are there temporarily are exempt from the age-verification control mechanisms in the regulation. The second says that, so that these users can use the services offered by social network providers in Turkey, the Presidency creates an "exceptional token" for them, on their application, through an online service on e-Devlet that can be reached without identity verification and using passport details only.

Read together, the two sentences mean that a visitor is not put through the identity-based check and does not need an e-Devlet password or a Turkish ID number. The route offered to visitors is a separate token created from passport details. How platforms will ask visitors for this token, for example at sign-up, when an account is used from Turkey or only when an account is flagged, has not been announced.

What is still unclear for visitors?

• The service itself: when we checked e-Devlet on 29 October 2026 at 23:56 Turkey time, the Cyber Security Presidency's page listed no age token or passport token service, and a site search for "belirteç" (token) returned no results [E2] [E3]. The regulation enters into force on 1 November 2026 but sets no date for the service to open.
• The details: which passport details are needed, whether the exceptional token shows an age band, how long it is valid and whether it covers several platforms.
• Accounts opened abroad: how platforms will recognise a visitor whose account was opened at home.
• In-between cases: someone who has applied for a first residence permit and is waiting for the card, or someone on a long stay without a permit. The text does not deal with these situations.

Temporary Protection and Other In-Between Cases

The regulation does not mention temporary protection, international protection or humanitarian residence. Its visitor exception is written for users "not resident in Turkey and there temporarily". People under temporary protection live in Turkey, often for years, so the exception does not obviously describe them. This is our reading; the text does not address the point. The only other route the regulation describes is the e-Devlet route.

e-Devlet's English help page for non-citizens describes applying at a PTT centre with a residence permit [E1]. e-Devlet's Turkish FAQ goes further: for holders of a foreigner ID number, it lists a valid temporary protection document, an international protection document, a stateless person document, and a work permit with passport among the documents accepted for a password [E4]. Whether a separate route will be offered to people who still cannot log in has not been announced.

What Happens to My Existing Account If I Do Not Verify by 31 March 2027?

Provisional Article 1 deals with accounts opened before 1 November 2026 that have not been verified with a token. The platform must verify each of them with a token, under Article 7, at least once by 31 March 2027. The duty is placed on the platform, but the check cannot be completed without the user: the token is generated at the user's request on e-Devlet and uploaded by the user (Art. 7(1)(a) and (c)).

The regulation states two outcomes of the check:

• if the account holder is found to be under 15, the account is closed after the holder is informed, and the account's data is deleted once any objection has been decided, or without delay if no objection is made (provisional Art. 1(1)(a));
• if the account holder is found to be 15, 16 or 17, the account is moved to the separate rules for children (provisional Art. 1(1)(b)).

The regulation does not say what happens to an adult's account that is still unverified after 31 March 2027. It sets a deadline for the platform, not a penalty for the user. What platforms will do with such accounts has not been announced.

If an account is suspended or closed, the objection route described below applies, and the account's content and personal data may not be deleted while an objection is pending (Art. 10(4)).

My Child Is Under 15: What Changes?

For children under 15 the text is categorical: a social network provider may not provide its service to them (Art. 5(1)). The regulation contains no exception for parental consent, and it does not distinguish between Turkish and foreign children.

• New accounts: from 1 November 2026, if the age check shows that the child is under 15, the request to open the account is refused (Art. 6(4)(a)).
• Existing accounts: when the platform carries out the check, which it must do by 31 March 2027, an account found to belong to a child under 15 is closed after the holder is informed (provisional Art. 1(1)(a)).
• Data: the data of a closed account is deleted once any objection has been decided, or without delay if no objection is made (provisional Art. 1(1)(a)). While an objection is pending, the account's content and personal data are not deleted (Art. 10(4)).
• Another person's token: the token reflects the age of the person who generated it. If the platform reasonably suspects that a verified account is being used by someone outside its age range, it suspends the account until a new check with a token (Art. 6(3)).

These duties fall on platforms. The regulation does not set fines or penalties for children or parents, and it does not deal with downloading photos or messages from an account before it is closed.

Families visiting Turkey

For a family on holiday in Turkey, the visitor exception covers the age-verification checks (Art. 7(1)(d)). The regulation does not say how the under-15 rule in Article 5(1) is applied to a visiting child whose account was opened abroad, and no platform has announced its approach.

My Child Is 15, 16 or 17: What Is Different?

Teenagers aged 15 to 17 can keep or open accounts, but platforms must give them a separate version of the service designed around the child's interests and physical, mental, psychological, social and emotional development (Arts. 5(2) and 8(1)). The regulation lists concrete rules for these accounts (Art. 8(5)):

• the account is private by default and cannot be offered with a public-account option;
• follower and following information in the teenager's posts is visible only to the teenager;
• only accounts the teenager follows can send messages, and "seen" receipts are not shown;
• there is no live-streaming feature;
• there is no interface, design or function that presents images or videos one after another through scrolling, tapping or clicking, or automatically; this applies in the app, on the website and in every other interface;
• the account is not personalised according to the teenager's behaviour, and the teenager's personal data cannot be used for profiling or personalised commercial advertising;
• the account is not suggested to others and other accounts are not suggested to it, and it is not synchronised with phone contacts, address books or contact lists from other apps;
• the platform takes technical measures against screenshots of the teenager's profile photo, account, posts and images;
• no service that may create addiction is offered.

Platforms must also apply high privacy settings by default, process as little data as possible, present contracts, settings and data policies in a way the teenager can understand, and use content filtering and recommendation settings that reduce exposure to harmful content (Art. 8(2)–(4)). Each platform must publish these measures on its own website (Art. 8(6)).

Parental control tools

Platforms must provide clear, understandable and easy-to-use parental control tools (Art. 9(1)). These are used by mothers, fathers, guardians and others who are legally entitled to make decisions about the child (Art. 9(2)). At a minimum, the tools must allow the parent to:

• control account and feature settings;
• require parental permission or approval for paid transactions such as purchases, rentals and subscriptions, and set spending limits;
• monitor usage time, set and limit it, and manage location sharing (Art. 9(3)).

The tools must include a Turkish-language option, be easy to find and switch on, work on different devices and operating systems, and tell the child clearly when they are switched on. They must stop the child from switching them off without the parent's knowledge and the same security check, and they must be designed around communication, learning and empowerment rather than surveillance, without disproportionately removing the child's privacy (Art. 9(4)). The regulation requires a Turkish option and does not mention other languages.

For separated or divorced parents, who has the right to make decisions about the child is a custody question. Our guide to child custody in Turkey for foreign parents covers how custody works.

Can I Object If My Account Is Restricted?

Yes. Every platform must set up an application and objection channel (Art. 10(1)). It covers:

• the result of an age check;
• the suspension or closure of an account;
• the measures applied to teenagers' accounts under the separate rules for children.

The regulation sets these minimum standards:

• the channel must have a Turkish-language option, be accessible and cost nothing to use, and objections must be decided quickly (Art. 10(1)); no fixed number of days is set;
• the person affected by the platform's decision can apply (Art. 10(2));
• an objection cannot be decided by fully automated systems; it must receive meaningful human review (Art. 10(3));
• the account's content and personal data are not deleted until the objection is decided (Art. 10(4));
• the platform's notice must state that a complaint can be made to the Cyber Security Presidency against the outcome and that the courts can be approached (Art. 10(5)).

Each year, platforms must also report the number of applications and objections, the acceptance rate and the average time taken to decide them to the Presidency, and publish these figures on their websites (Art. 10(6)).

Complaint to the Cyber Security Presidency and the courts

The regulation does not explain how a complaint to the Presidency is filed or which court hears a dispute; it only requires the platform's notice to mention both routes. The Cyber Security Presidency is based in Ankara [E2]. Which court is competent depends on whose decision is challenged, the platform's or the Presidency's, and on the facts; a lawyer in Turkey would look at the notices and their dates in the specific case. Foreign residents who spend long periods abroad sometimes act through a lawyer under a power of attorney; see how to hire a lawyer in Turkey from abroad.

What Happens to Platforms That Do Not Comply?

The sanctions are aimed at platforms, not users. Article 11 refers to Additional Article 4 of Law No. 5651. Before a sanction is imposed, the platform must be told of the breach and given a reasonable time to put it right (Art. 11(2)). The sanction takes into account how serious the breach is, how long it lasted, how many children were affected and the platform's good-faith efforts to comply (Art. 11(3)).

Under Additional Article 4 of Law No. 5651, as amended by Law No. 7578 with effect from 1 November 2026 [L1] [L2]:

• a platform that breaches the under-15 and age-verification duty or the parental-control duty can be fined up to 3% of its worldwide turnover for the previous calendar year;
• if it still has not complied 30 days after the fine is notified, individuals and companies that are taxpayers resident in Turkey are banned from placing new advertising with it;
• if it still has not complied three months after the advertising ban, the President of the Cyber Security Presidency can ask a criminal judgeship of peace to reduce the platform's internet bandwidth by 50%;
• if it still has not complied 30 days after that order is put into effect, a further application can seek a reduction of up to 90%; the judge may set a lower rate, but not below 50%;
• once the platform complies, the advertising ban is lifted and the court orders lapse automatically.

The regulation itself does not ban any platform. For users, the visible effect of a bandwidth reduction would be a slower service.

What Has Not Been Announced Yet?

When this guide was prepared (29–30 October 2026), our checks of e-Devlet and of published news found none of the following:

• the e-Devlet service for generating the age verification token, and the passport-based service for visitors (neither appeared on e-Devlet on 29 October 2026 at 23:56 Turkey time) [E2] [E3];
• how and when each platform will ask new and existing users for a token;
• what platforms will do with adult accounts that are still unverified after 31 March 2027;
• whether a token expires, and whether one token works on several platforms;
• how teenagers without their own e-Devlet login, and people who cannot use e-Devlet, will obtain a token;
• a public version of the technical guide for platforms (Art. 12(1)) and any procedures the Presidency issues under Articles 8(7) and 12(2).

Under the regulation, the token is generated at the user's request inside e-Devlet and uploaded by the user to the platform; the regulation does not provide for tokens or "verification links" sent by SMS or e-mail. This guide reflects the Official Gazette text of 10 October 2026 and will be updated when the Presidency or the platforms publish their procedures.

Sources

Code	Source	Subject
R1	Regulation on separate services for children and age verification by social network providers (Sosyal Ağ Sağlayıcı Tarafından Çocuklara Özgü Ayrıştırılmış Hizmet Sunulmasına ve Yaş Doğrulamaya İlişkin Yönetmelik), Official Gazette, 10 October 2026, No. 33396 (issue index)	Arts. 1–14 and provisional Art. 1: under-15 rule, e-Devlet token, visitor exception, teen rules, parental controls, objections, sanctions; in force 1 November 2026
L1	Law No. 7578, Official Gazette, 1 May 2026, No. 33240 (adopted 22 April 2026), Arts. 22, 23 and 27	Amends Law No. 5651, Add. Art. 4: under-15 rule and age verification, parental controls, fine of up to 3% of global turnover, advertising ban, bandwidth reduction; adds Add. Art. 5 (game platforms); in force 1 November 2026
L2	Law No. 5651 on internet publications, consolidated text (mevzuat.gov.tr)	Art. 2 definitions of the Cyber Security President and Presidency (Law No. 7590 of 24 July 2026); Add. Art. 4 as in force before 1 November 2026
E1	e-Devlet, Help for Non-Citizens	PTT application with residence permit; foreigner ID number (11 digits, generally starting with 99); password, e-signature, mobile signature; e-Devlet managed by the Cyber Security Presidency
E2	e-Devlet, Cyber Security Presidency page	Services listed on 29 October 2026 at 23:56 (no age token service); address in Ankara
E3	e-Devlet site search for "belirteç"	No results on 29 October 2026 at 23:56
E4	e-Devlet, Frequently Asked Questions (Turkish)	Documents accepted for a password; read on 31 October 2026