Preparing for Türkiye Law 7578 Webinar Recap

1:13What counts as a social network provider

Beatrice Cavicchioli, k-ID: But I will say, let's start Miray, tell us more a little bit on what do we mean by social media company.

Miray Muratoğlu Ekici, BTS & Partners: What we mean social media companies actually define as social network providers under our internet law. It was first regulated in 2020. Before that, the social network providers, we can say social media platforms, were already regulated under our legislation as hosting providers, for the content they host, and also in certain cases they were considered content providers if they themselves published certain content on their platforms. But in 2020, our government decided to specifically regulate social network providers so that they can introduce a more accountable regime for their services in Türkiye. And in terms of social network providers, we can define it as a platform where users create, view or share content such as text, images, audio and locations over the internet.

And for the critical point is that for the purpose of social interaction. So the critical issue whether you fall within this social network provider is whether you allow social interactions open to the internet. And with that new regime they also introduce certain obligations which are attached to the daily access thresholds from Türkiye. First we have over 1 million threshold, it requires to appoint a local representative in Türkiye. And then they introduced another more enhanced local representative regime in 2022. With that, they increased the liability of the local representation. But now with these new rules, we have certain obligations which are not attached to any kind of threshold.

So under age of 15 ban, age verification requirements and differentiated services for specific age groups are newly regulated under our legislation.

3:14What is out of scope: the secondary-or-ancillary test

Beatrice Cavicchioli, k-ID: Thank you so much for this overview. Again, like we're seeing that like the application of the law is expanding regardless of the thresholds of users. But is there any indication about services that are excluded? Melis, can you tell us about the actual scope of this definition that seems so broad?

Melis Mert, BTS & Partners: Yeah, exactly. You're absolutely right when we talk about internet, social interaction, and the content viewing, sharing, et cetera, the ones you can see from the definition. Well, they are very, they can, if one want to interpret, so there many companies can fall within the scope. As we all know, a lot of websites and platforms, they have these social interaction features. So, gladly, the regulator back then published the decision saying that, okay, there are certain rules here where we can maybe not consider certain companies as social network providers. So the main rule here is that if the content intended for this social interaction feature is only a certain part of the online publication, then it's fine.

We're not within the scope. So what we should look at is the main part or only a certain part. Of course, this is a bit open to interpretation, but at least we have that kind of criterion here. And especially this was an issue for personal websites, for e-commerce websites, and news websites, because as we all know, they all have some commentary sections, users can see that the content the other one is putting there. So that regulatory decision also stated that in these website types, let's say, the social interaction part is offered as a secondary or ancillary service. So as long as it is secondary or ancillary, then it's also fine. These platform providers will not be considered as social network providers.

But of course, it's not always black and white. For example, now we will come to that, but now since the game platforms are also regulated, there are this question because, for example, in the game-related platforms, we see that it's very important that the users interact actually because it's a community that's sometimes even a part of the game, etc. But in those questions, of course, it must be a case by case assessment. So I can't say yes or no. But apparently, pursuant to the current decision of the old regulator, it says that you should check whether it's secondary or ancillary, or is it your main feature when we look at your platform? for the game platforms at the moment, the general understanding is that they won't be qualified as a social network platform and therefore provider because it's not the main objective there in these platforms.

But of course, this is only just what we see at the moment when we look at the regulator's radar and how they see things.

6:13What existed before, and what changed

Beatrice Cavicchioli, k-ID: Yeah, absolutely. And as Miray mentioned at the beginning, we also know that this is just the new regime, but we have some previous regulation. So in the next slide, we're going to actually see what existed and what actually changed right now. Miray, over to you.

Miray Muratoğlu Ekici, BTS & Partners: Yes, we already actually regulate how social network providers should provide services to children. With the 2020 amendments, they introduced the regime where social network providers will be required to take necessary measures to provide differentiated services for the children. What we mean by children back then was all users under the age of 18. So with also a secondary regulation by the Information Technologies and Communication Authority, which was the internet authority before this year, and they introduced certain also specific rules which social network providers should look at when providing differentiated services. For example, you should consider child's age, best interest of the child, their economic like the psychological or general development, that kind of things were already regulated, but they are also present in this new legislation that was published in October.

So we will keep all these rules, but now we have more prescriptive rules for social network providers. Now we have age of 15 ban, any users, regardless of any other like the threshold issues or other kinds of criteria, they cannot access to the social network provider if they're under the age of 15. For the ages between 15 and 17, social network providers will be required to provide differentiated services. Now we have all these previous rules, but also additional ones that that we will discuss later, and we have now to be able to implement all these new rules, age verification requirements, and now the government has mandated e-government age verification mechanisms for age verification at least.

8:26Q: does a gaming company still need age verification?

Beatrice Cavicchioli, k-ID: That's amazing, Miray, and we started receiving actually like some questions in the chat, so I will love to address immediately one of those in the sense that we have a gaming company that says that this law doesn't seem to affect them, but are they still required to put a system in place to verify age? Is this covered under the previous framework where still there were requirements for companies or can they avoid thinking about this headache right now?

Miray Muratoğlu Ekici, BTS & Partners: Yes, first we can think about whether they fall within the scope of the SNP definition. When they are falling that scope, Melis also mentioned what we should look at when assessing this situation. They will be also subject to all these rules. We have a specific regime for gaming platforms and for the gaming platforms we only see age rating requirement and we will discuss the details in a bit, yeah.

Beatrice Cavicchioli, k-ID: Perfect, thank you so much.

9:32Under 15: an absolute ban

Beatrice Cavicchioli, k-ID: So let's go back to this prohibition for under 15. Melis, what does it actually mean?

“It’s not subject to how big you are, how active you are in the Turkish market, your daily access or daily users, the revenue you generate. None of them, they don’t matter.”

Melis Mert, BTS & Partners: Yeah, it is exactly 100% as you summarized because it's an absolute ban. Unfortunately, or fortunately, depends on where you look at, but when we look at this new rule, it's not subject to how big you are, how active you are in the Turkish market, your daily access or daily users, the revenue you generate, none of them, they don't matter. And this ban is for all social media companies who fall under the definition Miray just mentioned. And since this is an absolute ban, if someone is under the age of 15, then there is no way for them to benefit from the social media services. So this is not just about direct messaging. It's not about only ads. Like generally it's social media services that are being prohibited for the underage, I mean under the age of 15.

So this is the ban and social network companies now should take all the necessary measures to ensure that the services are not provided to those kids. So we will talk about in a second, There's even a more regulated procedures to ensure this, but also it is not just that companies, social media companies should always look out for the age of the user. So it is an absolutely like a first step kind of obligation, but also a continuous one. And let's say, of course, at the moment and before we have this regulation, this new rule, There are, of course, users under the age of 15 with the social media accounts. So the new rule says that those already existing accounts will be checked to see if the user is above 15.

And when let's say someone wants to open up a new account, then the same age verification will be happening. And if that person doesn't pass this age threshold, then there's no way of opening up an account. So, this is for all social media companies irrespective of what they do.

11:43Age verification through e-Devlet: how the token works

Beatrice Cavicchioli, k-ID: All right. So, this is like crystal clear, but I guess the question that everyone is asking is how do we do that? So, what is the age verification method that we need to use? How do we ensure continuous compliance? Do we have any requirements that supports this?

Melis Mert, BTS & Partners: Exactly. So, the thing is that, as I mentioned, of course, social media companies having their own measures, own product solutions like the ones k-ID is providing. There should be an ongoing monitoring for the age, but the Turkish regulation, which has even more recently came out, it states that it should go via our e-government, the Turkish e-government system. So this system is, as one can imagine, it's governed by the state, so it is not privately owned, and it is just one single platform. Until now, the social media companies didn't have anything with this e-government system. It was for Turkish citizens to do numerous transactions, and there are certain functions, but none of them are social media related.

Now what will happen? Of course, there are so many technical steps there, but I'm not going to bore anyone here. But basically, the user goes to the social media company's platform website, and let's say they want to create a new account. So, they will get a user ID from a social media company. That user ID will allow that person under the e-government system, that code will be used with the social media company's name, and the system will recognize, okay, this is a social media company's code, which operates in Türkiye, and which is doing the age verification stuff. So, it checks, of course, the e-government systems know how old that person is. so it checks and it generates a token.

This token is not about the ID, it's not about the governmental records, it's only about the age, as in below or above 15. So after the user, potential user, gets that token, they go back to the social media company's interface again and enter it. After the checks by the social media company, if everything goes well, I mean, the token is valid, etc. When all the checks are being done, the company, the social media company will understand the age of as in whether that person is below or above 15 and the decision about opening up a new account or rejecting that person to use any services, then that would be the decision. So it's not up to the social media company's own process.

It's not prohibited. They can do their own age-related processes. But this initial check must be done via this process I've just mentioned, via e-government system. And this is not just only for the new users. Of course, there are a lot of current users who need to be going through the exact verification step. So what I mentioned will be also applied to all existing users. So it sounds like a one-time check, but it is not just that.

14:51Getting a code from the regulator: be proactive

Beatrice Cavicchioli, k-ID: Amazing. And if I understand correctly, in order for this e-government token to work, companies need to have a code from the authorities. So what can you tell us about that? If a company, have companies been contacted by the authorities, what happens if a company hasn't? Should they be proactive and ask a code? How does it work?

Melis Mert, BTS & Partners: Yeah, exactly. I think this is like one of the most important part of it, so that's a great question because the thing is that, as Miray mentioned, social media companies are not just regulated. So some of them, they already have a local representative in Türkiye, like some of them, they were already like, ensured that they've been in, conducting necessary engagements with the regulatory. So, of course, this is not like a brand new framework for us, for them. So we know that regulator has contacted certain social media companies and they have already, like not just now, it's been a while, they've been working on this whole new framework. But there might be a misunderstanding there because the companies, the social media companies who are already having a Turkish subsidiary or who already have a local representation or who already have the code, it doesn't mean that they're the only ones within the scope.

So let's say you are working at a social media company, you don't have any of those, no token generating code, nothing. It doesn't mean that these rules won't apply to you. When we look at how the regulator is approaching to this matter, what we see is that, of course, they say, OK, then come and ask for a code. So this is one thing to answer your question. And also, they really, really appreciate the show of effort for compliance and not just waiting to see how things would work out. Because of course, like the last thing I said, it might be a compliance approach for certain organizations depending on their risk appetite, but for this thing, the whole age verification I mean, since it's very tied to the e-government process, it's very tied to the technical infrastructure necessities, it is something to work on with the appropriate teams within the company.

So that's what the regulator means by social media companies trying to be compliant, be proactive, go and engage with the authorities, so all of that would be appreciated and unfortunately the lack thereof would not be so great.

“Let’s say you are working at a social media company, you don’t have any of those, no token generating code, nothing. It doesn’t mean that these rules won’t apply to you.”

17:20How k-ID supports the e-Devlet integration

Beatrice Cavicchioli, k-ID: That's like quite a telling statement. But yeah, if anyone at the end of the call or who's watching the recording needs some support with the integration. Obviously, k-ID acts as a facilitator for this integration. So we do allow you and support you with the e-Devlet, the e-government token, as well as any additional age assurance method that can support you. This works both for the verification and ongoing monitoring. But as we're seeing on this slide here, It works also for the differentiated services.

17:59Ages 15–17: differentiated services and parental controls

Beatrice Cavicchioli, k-ID: Miray, can you walk us through what are the main, you know, features that are concerning for the regulator and what to do about it?

Miray Muratoğlu Ekici, BTS & Partners: Yeah, sure. As I also mentioned in the beginning of the webinar, there were already some rules regarding differentiated services and now we have more additional and very prescriptive actually rules for social network providers to implement. There are several rules, I will not discuss all of them because it will take an hour to discuss all of them. So I will just categorize them in certain groups so we can have some kind of idea what we expect. First of all, there were some rules, new requirements, providing more higher, like higher privacy settings for children. We also have some discoverability related measures and they respond to the need for reducing the discoverability of the children's accounts on the platform.

We have also very extensive content and design related issues. Basically, the government expects that you have to ensure that the children are protected from harmful content on your platform and also your platform should be designed in a way that it will not create any addiction towards children. And we now also have very strict rules regarding data use of children and also how we should provide advertisements to them. I will discuss content and design related issues a little bit more because most of these rules actually can be met in practice by disabling certain features on the platform. But when we look at the content and design section, we will see more strict rules in that sense.

For example, we have no addictive feature requirement in this legislation. And what we mean, what the authority means by addictive feature is not clear yet. So we expect further guidance from the Cybersecurity Presidency, or we will see how they interpret these addictive features by their certain decisions or certain contacts with the social network providers. But to complete this no addictive feature requirement, we now have a specific rule regarding how social network providers should display content on the platform. In a classical and traditional social media sense, we have certain features that we can see the content in a sequential sense in a continuous space.

We have scrolling, touching or clicking options so that our excitement in the platform, how we enjoy the platform is not disturbed by certain other distractions in the platform. But now, the authority says with this new legislation, you cannot provide any kind of scrolling, touching, clicking, or automatic playback kind of features in your platform. Which means that if the child wants to access certain content, it should search for it. So they have to show some effort to be able to reach that content. and the authority expects this rule to reduce digital addiction on social media. And we have also some content filter obligation to prevent harmful content and also recommender settings to limit also exposure to harmful content on the platform.

“The authority says with this new legislation, you cannot provide any kind of scrolling, touching, clicking, or automatic playback kind of features in your platform.”

And to like complete all these differentiated services requirements, we have also some parental control requirements in the legislation. We didn't have any kind of rule that imposed social network providers to provide such kind of control to parents, but now we have. Basically, the social network providers should enable parents to have some control over the settings of the children account. And what we mean by parent is either a real parent or a guardian that gives some interest to children. So other than the control of settings, we have also some kind of fee-based transaction issue here. So whenever a child is want to buy something or rent something or get some paid subscription on the platform, they will have to get either parents' permission or approval before doing that.

And also the parents now will be able to set some spending limits for their children on the platform for fee-based transactions, but they can also limit how much their children can spend time on their platform. So all these parental controls actually have to be implemented by the social network providers and the thing is that providing such controls for the parent does not mean that there will be no requirement for providing differentiated services. So they should just complete each other in that sense.

Beatrice Cavicchioli, k-ID: Yeah. And so, I mean, we have like so many requirements. So I'm also conscious of time.

23:19Key dates: 1 November 2026 and 31 March 2027

Beatrice Cavicchioli, k-ID: So in the next slide, can you tell us very briefly what are the key dates and what do we have to do?

Miray Muratoğlu Ekici, BTS & Partners: Yeah, sure. Actually, the deadline was November 1st, so it actually passed. But the thing is that as you also mentioned in the webinar, the authority, the Cybersecurity Presidency, published the secondary regulation which details all these obligations on October 10th which means that the social network providers didn't have any time to prepare for all kinds of new requirements including age verification and especially for the age verification side we need some input from the Cybersecurity Presidency because they are also governing the e-government system. They have full control over it in terms of design and how social network providers can integrate their system with the e-government system.

So now we have obviously all social network providers are under the risk because they cannot comply with these all new obligations in practice because of lack of time and also lack of input from the Cybersecurity Presidency, but the thing is that the Cybersecurity Presidency is now contacting with the major social network providers which already have some kind of local representation in Türkiye. And so we have some kind of de facto interim period, but the thing is that you should not just feel safe that the Cybersecurity Presidency will not enforce anything on you because of failing to the failing of complying with this new legislation.

Beatrice Cavicchioli, k-ID: And so we can see that they should enjoy a little bit of like this, this moment, but at the same time have a plan and show that they are still putting in the effort. And yeah, sorry, go ahead.

Miray Muratoğlu Ekici, BTS & Partners: Especially for the social network providers, which did not have any contact with the Cybersecurity Presidency, we can always say that, OK, you have to have some kind of internal plan. You may be within the scope and you may have some kind of letters or any kind of notifications from the Cybersecurity Presidency, so you should be ready for that during this period. And as Melis also mentioned, you may think about proactively approaching the Cybersecurity Presidency for compliance. And now we also have another deadline and which is March 31st. This is for the existing accounts. As Melis mentioned, now new accounts are under the obligation to go over all these e-government based age verification system.

But for the existing accounts, the social network providers have time until the end of March. So before that, they have to ensure all accounts, all existing accounts, regardless of their age, are verified at least once by the e-government system.

26:20Gaming platforms: who is covered

Beatrice Cavicchioli, k-ID: Awesome. So this is everything that is changing for social media. And also I would say, you know, like we've seen with the definition, it's a broad definition. So focus like if your service has a non-ancillary interactive feature, just be mindful of all of this. But the law also provided information on new requirements for gaming companies. Melis, what are these? What gaming companies? And we have like quite a few on the webinar today, so what kind of requirements and what shall they be doing?

Melis Mert, BTS & Partners: Yeah, sure. Just to give the main summary, the things that if there are some participants who have already followed up to like the previous drafts of this legislative works, they might have seen it. The thing is that the first plan, it was to regulate game distributors, developers, and platforms. Then, in time, things have changed. Now, we have these three definitions under the law. So they're technically within the scope, like defined under the internet law of Türkiye. The thing is that the distributors and developers, they are not subject to specific obligations yet. So of course, they might have some liabilities irrespective of these new definitions as hosting provider, content provider, et cetera, or generally speaking, under any legal framework, but under this gaming-related rules, let's say, they are not regulated.

So developers are a bit regulated, but I'll come to that. So the main regulation came for game platforms. And when we look at what is a game platform, this is the first time it's ever been defined under the Turkish laws, and it is, which is not going to be surprising, it's quite broad. So just to just to break down, first of all, we should be talking about a digital game or a related additional content over the internet. So if your company is not doing any of those, it's the gaming you understand is not this, then you're off the hook within the scope of these new rules. So if you are in this business, we look at two things like the things that this company should be doing to be considered as a platform.

So one is that company should be providing the software or other technical infrastructure so that or which works as in display, sale, distribution, downloading or playing of these digital contents and games. So any of those would work to check the first box. After that, so the company provides this type of software or technical infrastructure, the actual activity should be enabling or coordinating users' access to the game or the content, license management, or interaction between users. So the reason that is super broad is that, for example, your platform may have nothing to do with access to the game. You don't make people play it via your platform.

But if there is an interaction, if you allow or coordinate the interaction between the users, then the definition also works for you. So this is why these layered definition and the interpretation thereof would be very important. At the moment, of course, I believe many of you think of what about this platform or this service type? So the thing is that as we've just discussed, because maybe it's better to do the first, do the social network provider check. If you're off the hook there, then it's great because it's more regulated, more on the radar, et cetera. After that, if your company checks out these boxes, I think, again, a case-by-case interpretation might be necessary because as you might get, like we keep referencing to it, the regulators' understanding and the regulators' current radar, like where do they look at and what's the aim of these regulations.

I think it's quite important. And at the moment with this game platform definition, we mostly, I mean from the regulatory perspective, we mostly understand more traditional game platforms and stores.

30:38Q: is a game publisher a gaming platform?

Beatrice Cavicchioli, k-ID: All right. So we indeed have some questions in the chat around this definition. So would a game publisher qualify as a gaming platform under this law? And you know, if you can give a little bit more of examples to give a little bit of life to this very broad definition.

Melis Mert, BTS & Partners: Yeah, exactly. Exactly. Well, I think, again, from a regulatory perspective, I think the first thing to do is that do you operate like are you the company behind a specific platform? So for example, with before these definitions came out, there were even some confusion between in the distributors and the platforms because from certain points of view, which are not really correct, they both provide games to users, but that's not it. So I think that one of the most important thing is that, of course, you might be managing relationship with the sale channels, or you're in the delivery of these digital games, or you coordinate the license key management, stuff like that.

But these would mainly make you a distributor under our law, which is again not regulated, which is good in that case. But therefore, doing those stuff might feel like getting a bit closer to being the platform. But I think the silver lining there is you should be the one who is controlling what's going on with this access to the game, what's happening with the users, et cetera. Of course, this is not written under the law. The law just says this. But when we know where this came from, this was the main aim behind this whole new definition.

32:21Local representative, age ratings and parental controls

Beatrice Cavicchioli, k-ID: Awesome. Thank you so much. And so this is the definition of gaming platforms, but we also have new requirements around ratings and parental controls. What can you tell us?

Melis Mert, BTS & Partners: Maybe Audrey, if you'd be so kind to go back to the last one, because I forgot to mention that, okay, so game platforms are regulated, but a bit similar to the social media side, we have a threshold, like two types of game platforms. So maybe I should start by there. The thing is that there we have big foreign game platforms, and not so big or foreign game platforms. So we can like separate it as such too. Because the new law says that if you're a foreign-based gaming platform with more than 100,000 daily access from Türkiye, I mean, then there should be a local representative in Türkiye. So that the communication with the regulator, the access provider associations, or other administrative authorities, so those bodies can have a direct contact in Türkiye.

So this was the biggest, let's say, obligation if you are passing these thresholds, of course, And just to underline it, as it says, it's daily access, not daily users, or interaction. Like even someone goes into your platform and gets out in a minute, that also counts. So while calculating this, while checking these numbers, I think it would be important to remember that it's just access from Türkiye. So this was actually the major one for game platforms to have certain game platforms, to have local representative in Türkiye. But then again, this is something that we do. We have other local representation requirements in different various legislations.

So now game platforms, certain game platforms are part of it. But as you mentioned, this is only for big foreign ones. When we generally look, the aim is again about protecting the kids. So what we have is just to, I know I'm a bit short with that. So just to very quickly summarize, all games under these platforms, they should be rated age rated. And of course this can be done by the game developer or distributor, however they decide, but the thing is that if the game's not age rated properly at all, then the game platform is under the obligation to rate it as 18 plus. So, rating became important, it is something that the companies are already doing, but now it's important because if not, kids cannot play our game.

And we have parental controls, which is also under the liability of the game platforms. But we do not have the secondary legislation there, so we do not have the same level of details on how to do it as Miray described for social media companies. So at the moment, we have these obligations, they're in force, but we do not yet have the details there.

35:21What is next for gaming: secondary legislation

Beatrice Cavicchioli, k-ID: Amazing. And earlier you mentioned that we don't have details yet. So I think like this is like a nice segue to our next slide on what are the enforcement requirements and, again, should gaming company expect a regulation similar to what we've seen for social media?

Melis Mert, BTS & Partners: Exactly. So I'm going to respond to that and then you can talk about the whole big picture that's waiting for us. So as to answer your question, the law says that the regulator will come up with the secondary legislation about the gaming side as well. So normally, it's again, the same deadline, November the first, normally, it should have been that like by then that time, we should have got the regulation, but it didn't go as well. So now we do know that there's going to be secondary regulation, it might be a bit like social media one, because like the aim is not 100% but it's similar. So maybe we can look at there, like what the regulator decides for social media companies to have a better insight or foresight for the gaming side, but there is no indication that they're going to be the same.

At this moment, for example, with age rating, you know, there are a lot of like internationally recognized standards to do so. At the moment they're valid in Türkiye, but in the near future, not so far away, maybe Türkiye might have its own age rating system, which might come as a burden for platforms. But yeah, it is on the agenda. So it is not our interpretation. It's literally on the agenda. And therefore, I think for especially game platforms, but also distributors and developers, I think it's very important to monitor this because this is not the only rule that we're going to have. More details will come.

37:14The enforcement environment: a new regulator

Beatrice Cavicchioli, k-ID: And if I recall correctly in one of our previous chat, we discussed that there are actually different regulators, but also ministries that have a say on what is essentially the same service, right? They can take like different angles. So what do you think about their cooperation or interactions? like you know like if you're a company how can you prepare for that and you know how strict would they be, how broadly will they interpret the law, what is the feeling right now in Türkiye?

Miray Muratoğlu Ekici, BTS & Partners: Yeah I can start with that but before going into details of other ministries and other regulators we can first discuss the change in our regulators in terms of internet law because until the end of July this year, actually the Internet law was enforced by the Information Technologies and Communication Authority. It was a telco authority, but also it has some kind of Internet related powers. But then we have a new authority called Cybersecurity Presidency. Actually, it was also published in last year, so it is actually a very quite new authority. Now it has all these internet-related powers in our legislation. The critical point here is that the Information Technologies and Communication Authority was a sectoral authority.

So it had more regulatory approach to all the implementation of the rules. For example, when we discussed about the differentiated services rules, they are also aware that this is also written in their own legislation but they were not strictly enforcing all these rules and they had some kind of already established engagements with the social network providers. But now we have Cybersecurity Presidency and Cybersecurity Presidency is actually established as a national security authority. It just does not cover the internet rules but it also covers cybersecurity related matters. It also deals with all kinds of issues regarding the use of AI in government authorities, they are also handling e-government systems.

So it is an authority which is directly related to the presidency of the Turkish Republic and they have huge control over the internet right now. With all the talks with the Cybersecurity Presidency, we may now expect stricter scrutiny over the internet platforms in the future. It will cover both social network providers but also gaming platforms as well and since it is a new authority we will now have to establish all the engagements from the start. So this can be a challenging environment for the social network providers and also gaming platforms. But other than the Cybersecurity Presidency we have also very strong policy maker in the picture which is Ministry of Family and Social Services.

“With all the talks with the Cybersecurity Presidency, we may now expect stricter scrutiny over the internet platforms in the future.”

When we first I just started discussing about these new rules. The Ministry of Family and Social Services actually was one of the key regulators in the picture. So they also oversee all this implementation of these rules, and they also get into contact with other countries, stakeholders, NGOs, to make sure that these rules are strictly enforced in practice. And they are also working quite closely with the Cybersecurity Presidency right now. But we also have other authorities, for example, the Ministry of Trade recently introduced some rules about targeted advertising, and they banned all kinds of targeted advertising towards children under the age of 18.

So they will also have to work with the Cybersecurity Presidency because under the differentiated services section, we also have some rules about how social network providers can display the advertisements. We also have other authorities, for example, the Information Technologies and Communication Authority is still responsible for regulating OTT services. So if your platform has some kind of messaging tools, it can also be impacted by these OTT rules. They are also in force, but we are awaiting some new secondary regulation in that part as well, so they may also face additional questions, queries from that authority as well.

41:43Fines and service blocking

Miray Muratoğlu Ekici, BTS & Partners: And in terms of fines, we can also briefly mention for the social network providers, the fines can be up to 3% of their global turnover. And for the gaming platforms, it can be up to 30 million Turkish liras. So it can be huge fines, but the problematic thing is here that they may also face some bandwidth reduction in the country so basically their services may be inaccessible in Türkiye and maybe you are also aware Roblox is currently blocked in Türkiye, Discord is currently blocked in Türkiye and also we are aware that X and also Instagram and YouTube previously were subject to that kind of measures in practice so it is also a quite critical risk for the gaming platforms and social network providers.

42:37Q&A: how quickly do regulators act on complaints?

Beatrice Cavicchioli, k-ID: Wow, I mean, it's clearly a heavily regulated country. So if you need a little bit of guidance, you have your expert here, don't be shy, contact with them. And I'll still pick up like a couple of questions from the Q&A. So there is a question around, you know, like if a regulator receives a complaint about a particular video game or service, you know, like how quickly will they enforce this, how quickly they will, you know, get in touch with the with the service provider. How will they, again, you know, assess if the social media rules apply, and if they don't apply, what would be the approach you know how active is or better are your regulators.

Miray Muratoğlu Ekici, BTS & Partners: I can start with it, and you can also add some points as well. First of all, for example, our authorities actually want to have some kind of complaints and requests from the citizens. We have a specific platform designated for receiving complaints from citizens. It is called CİMER in Turkish, and anyone, any Turkish citizen can access that platform and raise their complaints and questions to any kind of issue. under the relevant authority. This is one of the channels for accessing authorities and also Ministry of Family and Social Services has specific channel to receive any kind of complaints regarding online content. So it may cover both gaming side and also social network provider side.

And the thing is that they can be quite active when they receive that kind of request because the The whole idea is in the government agenda is providing more protection for children online. So they will handle all these issues in a very strict sense and they can actually easily move on and impose some sanctions or require certain obligations to be implemented by these companies. We see that examples a lot in practice, so it is an actual risk for Türkiye. Yeah, exactly.

Melis Mert, BTS & Partners: And I mean, this is not gonna make things more colorful, but I'm gonna add something. So I think when a company is doing, of course, like no one can put all the attention and capacity to the Turkish market, but to assess the risk in practice, like what's going on there, how exposed I am to such communication from a regulator kind of risk, maybe a thing to bear in mind is also the social media, not as in the regulated companies, but the platform that people use, the social media part is very, very important. Like, you know, sometimes one of your product service, something you do, whatever, something about your company, sometimes it makes the news, it goes viral in the social media, rightfully or very super wrongfully, like sometimes, for example, this game affects children horribly, parents to the rescue, like stuff like that.

So although it might be even a ridiculous this thing, if it goes a bit like out in a social media or news level, then our authority is generally they're kind of proactive in these sense, especially if it's harmful for kids, harmful for moral values or security of the company and stuff like that. So if there is some sort of presence in the online content way, which is about one of your product or services, then there is actually a of regulator practically reaching out to you saying basically, what's up? So that is also very much like without even a formal complaint to a regulator or government. That is also very much seen in practice. And the regulatory enforcement appetite actually is pretty much shaped around it as well.

Is it a huge thing or is it something that we might be a bit more understanding about? Of course, this was the old regime because with this new presidency, maybe everything might be super important. We can't say anything yet, but the general understanding also includes such sensitivities.

Beatrice Cavicchioli, k-ID: So, key takeaway, don't make the news, don't go viral. Just kidding.

Melis Mert, BTS & Partners: Exactly. Good PR is important now.

47:07Q&A: can you use your own age verification?

Beatrice Cavicchioli, k-ID: So, let's go back a little bit on the age verification side of things. So, we've seen that there is specific requirements for social media companies to use e-Devlet, so the e-government token for the initial verification. But I would love to explore a little bit more because we have questions around this on, you know, can you use your own age verification system? And the second side of the question is like, even if I don't fall under this requirement, Is there any benefit of implementing something similar for other services? Because I'm referring especially on the new requirement of do not target users under 18. So in that case, under their rule, it's purely on the advertising rules.

It simply says you should not be targeting kids, but there is no age verification requirement. So how can a company go about it?

Melis Mert, BTS & Partners: Exactly. I can take the first part, and Miray can go with the general, how much should we pay attention to the user's age thing. So for the age verification part, as I mentioned, like the e-government one is technically not always, but it's a one-time thing and it must be from this whole procedure. But the thing is that let's say a company said that, okay, I'm doing everything 100% correctly via the e-government thing, and that's it. So it is also not possible. So let alone having it as a good practice is also a must. So what I'm trying to say is that there should be an age verification process, the e-government one I mentioned. But after that, social media companies should implement, like proactively implement age verification methods of their own choosing, by the way.

This is not the e-government token one. So they should have their own methods. And whenever they have a reasonable suspicion, They don't even have to be sure, by the way, whenever they have a reasonable suspicion that a verified account, which means that plus 15, if that account is being used inconsistently, like a kid using a grandpa's account kind of thing, if that is the case about the age again, then that social media company must suspend the relevant account, like not even if something goes wrong or anything. If there's a reasonable suspicion, via these age verification methods of your own, you should be suspending the relevant account, and then redo the age verification token thing to make sure that is it, are we still talking about the right age user, et cetera.

So actually, of course you can use your own methods. You should use your own methods. You should be in a place to be able to understand if there's a reasonable suspicion or not. So it is an ongoing monitoring and ongoing obligation. It doesn't lift the e-government side, but it brings a continuous requirement for all social media providers, network providers.

50:07Age assurance beyond the mandate, and targeted ads

Beatrice Cavicchioli, k-ID: Thank you very much. And Miray, what can you tell us about, you know, like a general approach to age assurance?

Miray Muratoğlu Ekici, BTS & Partners: Yeah, we can say that the age assurance thing is actually quite related with about all platform related rules. We mentioned some differentiated services, for example, And we have to also ensure that all our contents or all our advertisements are published on the platform in a way compatible with the legislation. And age assurance can be a key point here to ensure that you also comply with the social network provider. You also comply with all these new rules, but also you have some kind of commercial interest here. For example, when a certain child account reaches the age of 18, the new system, the e-government system will not trigger automatically that, okay, you are not any more under this radar, so you can freely use the social network provider.

The social network provider or the user itself should be able to determine that and take the action to re-verify their own age. So age assurance can be also a very good point for the social network providers in that sense, so that they can also access more users who are now under, above the 18 years old, so they can have a more free space for their users in that.

Beatrice Cavicchioli, k-ID: Can I just double click on that? Because you use as an example, like social network providers. But if I, again, like, you know, you obviously are the expert, My understanding is that, for instance, the requirement of targeted ads is a general requirement. So is what you said also applicable to any company?

Miray Muratoğlu Ekici, BTS & Partners: Yeah, sure. Also, in terms of content removal and access blocking decisions can also be a very critical point here because we have a very general rule, our internet law regarding protecting children and also the students in a general sense. So whenever there is the content which can be harmful to children, they can also be fall within the scope of like preventing like protecting public order, preventing any kind of harm to children, that kind of legislation. So if you have that kind of age assurance in your platform, so you can also have more control over the content and how these contents reach out to children. Because as we also mentioned, there are so many complaints mechanisms in available for the parents.

So whenever they see some harmful content or targeted advertising that is incompatible with the legislation, they can also raise this issue. If you are using very robust age assurance systems in your platform, you can also easily comply with all the other rules applicable to your platform.

Melis Mert, BTS & Partners: And maybe we can also add with the targeted advertising thing. So the law, it's under the consumer protection, by the way, like not this internet law. It says that, it's again, a new rule. It says that if you know that the other, like the person of which you're collecting the data and then afterwards use it for targeted ads, if you know that it's a kid, like under 18, then you should not do it at all and the second rule says that if you would reasonably know that that person is a minor then don't do it either. So in cases where we know it's a kid maybe it's fine because like it's for sure but if there is the second option is I think very important about like what you just said Beatrice.

If there is a reasonable ground for you to know that that person is under 18, then first you shouldn't be using the data for targeted ads. But maybe more importantly, if you can know that that is not a minor, then it means that you can use the data, and you can do the targeted ads, and you can generate the value you're seeking there. So again, as you mentioned, using those kinds of tools allows you to obviously comply with these bans about targeted ads thing, but also allows you to do the targeting ads if you can know, reasonably know, that that is not a minor. So I think companies, I'm not sure, like, the market is there yet. But I think we should look at this rule from a more holistic perspective with the tools you mentioned.

54:45Wrap-up: what to assess now

Beatrice Cavicchioli, k-ID: Thank you so much. So we have just a couple of minutes left. Just like wrapping up, there are many questions in the Q&A that ask, you know, like, my situation is this, is it correct, if I think so and so. So very briefly, you know, do your assessments, document them, so that, you know, as Miray says, like, just think like, first about if you're an internet provider, and you're caught under the legislation. The second assessment is like, do you fall under the definition of social media? So look at your features? Like, are they interact? Like, allow, do they allow interaction? Are they, you know, akin to what social media provides. If you're a gaming platform, just again, remember about the threshold.

If you need to appoint a legal representative. And finally, just review your service. Do you need age assurance? Would it be useful, even if not strictly required, just to allow more business? And what other measures could be implemented to support safer internet for kids? So we are at time and hand it over to Audrey before she scolds me.

55:58Closing and where to go next

Audrey Deng, k-ID: Thank you Beatrice. Thank you, Melis and Miray. If we didn't get to your question, we will follow up with you by email. So that's all the time we have for today. A big thank you to Melis and Miray from BTS & Partners and to Beatrice. The recording will be in your inbox shortly. You can also download the Türkiye Law 7578 one-pager from our event page. And before you go, take a look at the slide on screen. If more questions come up after today, try neimo. It is our regulatory research tool. It's free to start and you can ask it how Türkiye Law 7578 applies to your product. And if you'd like to follow up with Melis and Miray or with us at k-ID, you can also find that information on the slide as well.

And finally, save the date for our next webinar, US Kids Privacy Developments on Wednesday, December 16th. And you can sign up for it by scanning the QR code. That's it. Thanks again for joining and have a great rest of your day. Take care. Bye-bye.

Melis Mert, BTS & Partners: Thank you. Thank you all.