Preparing for Türkiye's Law 7578. In force 1 November.

Law No. 7578 amends Türkiye's Internet Law No. 5651. It passed on 23 April 2026, was published in the Official Gazette on 1 May 2026, and is in force from 1 November 2026.

It applies to social network providers regardless of how many Turkish users they have, and introduces separate obligations for game platforms.

Need a more detailed answer sourced from human regulatory experts? Try neimo free (now a connector in Claude).

The definition of “social network provider” is quite broad and covers services that enable users to interact, create, view, or share content; which could sweep in other companies that pose similar risks/harms to children.

If you have social features and Turkish minors on your service, the prudent working assumption is that you are in scope, and the question to take to local counsel is whether you are outside it.

Need a more detailed answer sourced from human regulatory experts? Try neimo free (now a connector in Claude).

Age-rating obligations apply to game developers and distributors. A game without a valid age rating is automatically treated as 18+ — a live operational risk. Pending an official Turkish rating scheme, PEGI is the de facto standard.

Game platforms above a Turkish access threshold must also appoint a local representative (see question 9).

The gaming provisions contain no general age-assurance requirement, but see question 6 before concluding that nothing applies.

Need a more detailed answer sourced from human regulatory experts? Try neimo free (now a connector in Claude).

Law 7578 prohibits providing social network services to under-15s. There is no parental-consent override. This is a prohibition, not a consent gate.

The obligation is far-reaching and extends beyond account creation to unregistered user access.

Need a more detailed answer sourced from human regulatory experts? Try neimo free (now a connector in Claude).

The Regulation on the provision of differentiated services specific to children by social network providers and on age verification was published on 10 October 2026. It is the detail the law left open, and it landed recently enough that most readers will not have seen it.

It sets when age assurance must happen (at account creation, and again where there is reasonable suspicion an account belongs to a minor, in which case the account is suspended and must be re-checked), the principles it must satisfy (data protection, technical accuracy, robustness, reliability, fairness, accessibility, transparency), the method accepted, and a prohibition on dark patterns. It binds social network providers. Because that term is defined broadly (see question 2), a game with social features should not assume the regulation leaves it out. Accounts opened before 1 November must be verified with the e-Devlet token by 31 March 2027.

Need a more detailed answer sourced from human regulatory experts? Try neimo free (now a connector in Claude).

More than a self-declared age gate. A date-of-birth field or a checkbox will not satisfy it: social network providers must check age with the e-Devlet age-verification token when an account is created, keep running their own age checks after that, and meet the accuracy and robustness principles set out in the October regulation

In the past, Türkiye's data protection authority has already fined a major platform over an age restriction stated in its own terms but not enforced. A policy without a mechanism behind it is itself a compliance failure.

Need a more detailed answer sourced from human regulatory experts? Try neimo free (now a connector in Claude).

This is the most operationally complex part of the law, and it is not a ban: 15–17 year olds may use the service, but measures must be put in place to protect them from inappropriate content, interactions and excessive use risks.

You need to confirm the user is in that band, implement age-appropriate measures as outlined in the October implementing regulation (e.g. by disabling profiling and setting minors’ accounts to private by default), provide parental control tools, and require parental approval before a user in that band can pay for anything.

A 13+ parental-consent flow built for COPPA or another regime will not transfer unchanged.

Need a more detailed answer sourced from human regulatory experts? Try neimo free (now a connector in Claude).

For social media, the October implementing regulation points to e-Devlet, Türkiye's e-government identity system.

Worth knowing alongside that: Turkish data protection guidance treats methods involving biometric or government-ID data as higher risk. Method choice is a privacy decision as much as a compliance one.

Need a more detailed answer sourced from human regulatory experts? Try neimo free (now a connector in Claude).

Possibly. It depends on which obligation catches you.

Existing Internet Law rules require foreign social network providers above one million daily accesses from Türkiye to designate a local representative. 

The new amendments introduce a similar obligation for game platforms at a lower threshold, one hundred thousand daily accesses from Türkiye.

Need a more detailed answer sourced from human regulatory experts? Try neimo free (now a connector in Claude).

The obligations apply from that date. Accounts opened before 1 November have until 31 March 2027 to be verified with the e-Devlet token, but new accounts must be checked from day one. Secondary regulation may still add detail; it does not move the effective date.

Penalties for violations of the new social network providers duties include fines of up to 3% of the previous year's global turnover, then a ban on advertising your service. Before any sanction, the regulator must tell you about the breach and give you a reasonable time to fix it. Additionally, non-compliance may carry progressive bandwidth throttling: first 50%, then up to 90% of your traffic in Turkey. That's a meaningful operational risk, not just a financial one. Gaming companies separately face penalties for any breach of their new duties starting with ₺1–10M, then ₺10–30M for continuous non-compliance, and up to 30%-50% of bandwidth throttling for the most serious cases.

Partway is materially better than nowhere. Document what you have assessed, what you have shipped, and what is scheduled. A defensible record of work in progress is a different conversation with a regulator than silence.

Need a more detailed answer sourced from human regulatory experts? Try neimo free (now a connector in Claude).

They share a direction of travel (establish age, differentiate the experience by age, give parents control, keep a record), but they differ on thresholds, on accepted methods, and on who enforces.

The practical consequence is that building a Türkiye-specific stack in isolation is the expensive path. One internal control set, mapped to each regime, is what keeps the roadmap from forking.

Need a more detailed answer sourced from human regulatory experts? Try neimo free (now a connector in Claude).

k-ID: age assurance, routing users into an age-appropriate experience, parental consent and permissions, and the record-keeping behind those decisions.

Your team: legal interpretation of whether and how you are in scope, the risk assessment itself, content moderation and response obligations, and any local representative or registration requirement.

Need a more detailed answer sourced from human regulatory experts? Try neimo free (now a connector in Claude).