Starting from November 1, 2026, in Turkey, a new social media account cannot be created without an age token from the e-Devlet government portal. Social media access will be completely restricted for children under 15 years old, while a limited version will be available for teenagers aged 15 to 17. Existing accounts must be verified by March 31, 2027, or they will be closed or switched to a restricted mode. This rule applies not only to Turkish schoolchildren but also to SMM agencies managing Turkish brands, arbitrageurs with accounts targeting the Turkish market, and anyone registering profiles from Turkish IP addresses. We will analyze what is stated in the regulation, what is missing, and what changes need to be made in work processes in advance.
What has been adopted and when it will take effect
The legal basis is Law No. 5651 on the Internet from 2007. The parliament approved amendments regarding restrictions for children in April 2026. The regulation "On Providing Certain Services for Children by Social Networks and Age Verification" was published in the Official Gazette on October 10, 2026 (issue No. 33396). It was prepared by the Cybersecurity Authority under the presidency's administration (Siber Güvenlik Başkanlığı), which also oversees its implementation. The document consists of 14 articles and one transitional provision.
Key dates:
- November 1, 2026 — the token is mandatory for registering new accounts; registrations for users under 15 will be rejected;
- March 31, 2027 — the deadline for verifying all existing accounts that have not yet been confirmed (approximately 150 days).
The scale is significant: according to DataReportal, in October 2025, there were 62.3 million social media user identities in Turkey, which is 70.9% of the population. All of them must go through e-Devlet within five months.
Who it applies to: the wording is broader than it seems
Article 2 of the regulation refers to "domestic and foreign social network providers accessible from Turkey and their users." There is no user threshold, no list of platforms, and no exceptions for small services. The definition of a social network is very broad: any service where people create, view, or publish content for communication.
Daily Sabah and subsequently The Next Web specify particular platforms: Instagram, Facebook, X, TikTok, Snapchat, YouTube, WhatsApp, Telegram, Discord, and Reddit. However, the text of the regulation does not mention any names. This means that even a niche forum with comments could formally fall under this rule.
How the e-Devlet token works
Age verification occurs through the government portal in four steps:
- The user logs into e-Devlet (turkiye.gov.tr or the official app) and undergoes identity verification.
- Requests an age token through the online service of the Cybersecurity Authority.
- Uploads the token to the platform.
- The platform verifies that the token was issued by the government and reads the age group.
The token contains only two facts: whether the owner is 15 years old and whether they are 18. There is no name, exact date of birth, or login information. The Disinformation Combat Center (DMM) under the presidency has stated that identification data is not shared with the platforms. Another question remains open: does the government record who and when requested the token? The regulation is silent on this, and critics point out that linking accounts to government infrastructure gives authorities a powerful surveillance tool.
For non-residents who do not have access to e-Devlet, an "exceptional token" based on their passport is provided. The document does not specify how it is issued or how it is protected from abuse.
What changes for 15–17-year-olds: a loss of target audience
Verified teenagers aged 15–17 will receive a separate service (Article 8):
- the account will always be private, and it cannot be made public;
- subscriber and following lists are hidden;
- only those whom the teenager follows can send messages;
- live broadcasts are prohibited;
- profiling and personalized advertising are prohibited;
- infinite scrolling feeds, swiping, and autoplay are prohibited. A literal interpretation removes short videos and Stories carousels from the teenage product, and the technical guidance for Article 12 is currently without a release date.
For marketers, this means that the audience of 15–17-year-olds in Turkey will effectively disappear from targeting and influencer reach. Campaigns that relied on youth (games, mobile apps, fast food, streaming) will need to be recalibrated by November.
What is missing from the regulation — and why it matters for working with proxies
None of the publications we reviewed found an answer to the key practical question in the text: how does the platform determine that the user is in Turkey? There is no mention of IP addresses, VPNs, or geolocation in the document. There are also no specified fines: Article 11 refers to the sanction procedure under Law No. 5651. The Next Web reports fines of up to 3% of global revenue, advertising bans, and bandwidth reductions, but other analyses did not find these figures in the text of the regulation. Before applying sanctions, the platform will receive a notification and a "reasonable period" for correction.
In practice, platforms will determine whether a user is "Turkish" based on their signals. Typically, this includes IP at registration and login, phone number, app store region, interface language, and geolocation history. This is our conclusion based on how platforms are already implementing similar laws, rather than a requirement of the regulation. As we discussed in the article about the Utah court ruling on IP geolocation accuracy, determining a country by address is probabilistic and prone to errors in both directions.
There is also another norm to consider: platforms are required to continue their own age verification after registration and suspend accounts with "reasonable suspicion" until re-verification. What constitutes suspicion is not defined. A sudden change in the country of access or behavior atypical for an adult could easily trigger such a response.
Practice: what to do before November 1 and by March 31
SMM agencies with Turkish clients
- Conduct an inventory. Create a list of all accounts registered in Turkey or linked to Turkish numbers. For each, determine who the actual owner is and who has access to e-Devlet.
- Verify business accounts in advance. The token is obtained by an individual through their access to e-Devlet. The client's responsible employee must be ready to verify the account themselves; the agency cannot do it for them. Do not postpone until March: with 62 million users, the load and failures in the last weeks before the deadline are quite likely.
- Maintain a single geo-history for each account. If the account is Turkish, manage it through a Turkish IP that resembles a regular subscriber. Mobile proxies with addresses from local operators are better suited here. Sudden jumps from "Istanbul to Frankfurt and back" in one day are exactly what anti-fraud systems might consider suspicious.
- Register new accounts for Turkey only with the real owner. From November 1, registration without a token will simply not go through, and "gray" methods to obtain a token involve using someone else's government identity.
For those working with the Turkish market from abroad
- If you are not a resident and do not manage Turkish accounts, do not register new profiles using Turkish IPs. The platform may determine that the user is in Turkey and require a token that you do not have. Choose an IP from the country where you and your business are actually located for registration.
- For monitoring Turkish search results, prices, and advertising, an account is often not needed at all: public pages and searches can be accessed through residential proxies with Turkish geo without logging into a profile. More about geo scenarios can be found in our proxy guide for Turkey.
- Checking advertising targeted at teenagers in Turkey loses its meaning: personalized ads for 15–17-year-olds are prohibited.
For everyone: be cautious of phishing "confirm your age"
On October 23, DMM warned about scammers already exploiting the new rules. The schemes include: SMS, emails, and messages on social media with threats like "Your account will be closed" and "Urgently confirm your age," calls, and fake websites asking for payment for verification or to enter card details and passwords. The official route is one: turkiye.gov.tr or the official e-Devlet app. If the agency has access to clients' accounts, warn them separately. A leak of the e-Devlet password is worse than a leak of the Instagram password.
What past blocks in Turkey teach us
Turkey has a rich history of social media blocks. On August 2, 2024, the regulator BTK blocked Instagram without explanation and without a deadline. Proton VPN reported a ninefold increase in usage in the country on the very first day and a 4500% surge in registrations. The Freedom of Expression Association IFÖD counted 27 VPN services experiencing interruptions or blocks, although some providers disputed this.
The situation is different now. The new regulation does not block anything for adults; it builds a permanent age identification infrastructure. Australia's experience with a ban for those under 16 showed that the main problems there were not with VPNs but with inaccurate age assessments and weak checks on the platform's side: the eSafety regulator opened investigations against Meta, YouTube, TikTok, and Snapchat. The Turkish variant with a government token is stricter. Circumventing it with a "smart" IP address will not work because the token is a cryptographic confirmation from the government, not a guess based on geolocation.
Conclusion
Starting November 1, Turkish social networks will transition to a model where "account = verified adult through e-Devlet." For businesses, this is not a disaster but also not a formality. Real owners must verify their accounts by March 31, 2027, the geo-history of each Turkish account must be stable and plausible, and registering new profiles through Turkish IPs without a Turkish owner is no longer allowed. Clean local mobile and residential IPs are still needed, but now as a way to avoid raising "reasonable suspicion" with anti-fraud systems, rather than as a means to bypass verification. Proxies will not help circumvent it, and it is not worth trying.