The Social Media Age Limit of 15 and e-Devlet Age Verification: What to Do If My Child's Account Is Closed, and What Happens to the Data?

Last updated: 01.11.2026 · Author: Attorney Coşkun Genç, Istanbul cybercrime lawyer

The social media age limit of 15 and e-Devlet age verification have been put into practice by the regulation of the Cyber Security Directorate (Siber Güvenlik Başkanlığı) of the Presidency of the Republic, published in Official Gazette No. 33396 dated 10.10.2026. Below, the closure of the account, the objection and the fate of the data are explained point by point for parents and for young people aged 15–17.

Whom and which platforms does the social media age limit of 15 cover?

The age limit of 15 covers all social network providers of domestic or foreign origin that are accessible from Türkiye, and their users (Article 2 of the Regulation). A social network provider is a natural or legal person that enables users to create, view or share content such as text, images, sound or location for the purpose of social interaction (Article 4(1)(e); Article 2(1)(s) of Law No. 5651). The Regulation does not list platforms by name; whether a service falls within its scope is determined according to this definition.

Certain obligations under Additional Article 4 of Law No. 5651, such as appointing a representative or responding to applications within 48 hours, apply only to providers with more than one million daily accesses from Türkiye. The seventh paragraph concerning children and the Regulation, however, contain no such user threshold; small platforms are also within the scope.

Under the Regulation, a child is a person who has not completed the age of 18, even if he or she has attained majority at an early age (Article 4(1)(ç)). Accordingly, two groups emerge: children who have not completed the age of 15 may not open an account, while young people who have completed 15 but not 18 may use the platform with an account provided under what is called a differentiated service, that is, with security, privacy, content and communication rules appropriate to their age and level of development (Article 4(1)(a)). The authority implementing the rules is the Cyber Security Directorate (Siber Güvenlik Başkanlığı), pursuant to the current definition in Article 2 of Law No. 5651 and Article 4(1)(c) of the Regulation.

This paragraph was amended by Article 22 of Law No. 7578 and, pursuant to Article 27 of the same Law, entered into force six months after its publication, on 01.11.2026; the Regulation also entered into force on the same day (Article 13). The current text of the Law is available on the Law No. 5651 page.

How is age verified through e-Devlet, and what information is shared with the platform?

Age verification is carried out through the e-Government Gateway (e-Devlet Kapısı) by means of an age verification token generated at the user's own request (Article 7(1)). The provider is obliged to verify the user's age with this token when an account is opened (Article 6(2)). The process works as follows:

1. Logging in to e-Devlet: The user completes identity authentication on the e-Government Gateway and enters the token generation service provided by the Directorate (Article 7(1)(a)).
2. Generation of the token: The system generates a token that shows only the age group (Article 7(1)(b)).
3. Uploading to the platform: The user personally uploads the token to the platform of the relevant social network provider (Article 7(1)(c)).
4. Confirmation: The provider first confirms that the token was generated by the Directorate through e-Devlet, and then determines the user's age group (Article 7(1)(ç)).
5. Outcome: The account opening request of a person who has not completed the age of 15 is rejected; the account of a child who has completed 15 is made subject to the rules of the differentiated service (Article 6(4)).

What information does the token contain, and what does it not contain?

The token carries only two items of information: whether the user has completed the age of 15 and, if so, whether he or she has completed the age of 18. No other personal data, no username on the platform and no information that renders the person identified or identifiable vis-à-vis third parties is placed in the token (Article 7(1)(b)); accordingly, the name, Turkish identity number (T.C. kimlik numarası) or date of birth is not transferred to the platform by this means. The provider may not use the token for any purpose other than age verification (Article 7(1)(ç)).

The fundamental principle of the Regulation is the same: age verification aims not at establishing identity but solely at determining the age threshold (Article 5(3)). The methods must be resistant to manipulation, consistent and not such as to produce discriminatory results (Article 5(4) and (6)).

The technical structure of the token and the process to be followed by the provider are determined by a guide to be prepared by the Directorate and shared with providers (Article 12(1)).

What happens to my child's existing account if he or she is under 15?

For accounts opened before the entry into force of the Regulation and not verified by token, the provider is obliged to carry out age verification by token at least once by 31.03.2027 (Provisional Article 1(1)). The existing account of a child who is found in the verification not to have completed the age of 15 is closed after the user is informed (Provisional Article 1(1)(a)).

The data of a closed account are deleted according to two scenarios: if the objection mechanism has been used, after the objection has been concluded; if no objection has been lodged, without delay. If the age was determined incorrectly, an objection should be lodged immediately; if the child is in fact under 15 and there are photographs or correspondence that are to be kept, any data download tools offered by the platform should be used before deletion.

The Regulation does not separately govern the fate of accounts that have not been verified by 31.03.2027; the provider's practice and the procedures and principles to be determined by the Directorate (Article 12(2)) should be followed. For new accounts, by contrast, there is no transition period: from 01.11.2026, a token is mandatory when an account is opened (Article 6(2)).

After the initial verification, the provider continues age checks using single or layered methods that it determines itself. If there is reasonable suspicion that a verified account is being used contrary to the established age range, the account is suspended, and a new verification by token is required before it can be used again (Article 6(3)). For this reason, a child under 15 generating a token through another person's e-Devlet account is both contrary to the purpose of the Regulation and gives rise to the risk of the account being suspended.

Which settings are mandatory for accounts of 15–17-year-olds, and what can a parent control?

The account of a child who has completed the age of 15 is provided by default with high-level privacy settings and with minimal data processing; the terms of service, user settings and data policies are explained in a manner the child can understand, and filtering and recommendation settings that reduce exposure to harmful content are applied (Article 8(2)–(4)). The Regulation also makes the following rules mandatory (Article 8(5)):

• No addictive services: No service that may have the effect of developing addiction may be provided.
• Private account: The account is private by default; no option to make it public may be offered.
• Follow lists: Information on followers and followed accounts may be seen only by the child who holds the account.
• Messages: Only accounts that the child follows may send messages to the child; read receipts are not shown in messages.
• No contact matching: The phone contacts, e-mail address book and friend lists in other applications may not be synchronised with the account; data obtained in breach of this rule, and the matching, inference and recommendation records generated from them, are deleted without delay.
• No account recommendations: The child's account may not be recommended to others for following, nor may other people's accounts be recommended to the child.
• Screenshot blocking: Technical measures are taken to prevent others from taking screenshots of the profile photo, the account, posts and images.
• No live streaming or infinite feed: There may be no feature for starting a live stream; an interface in which visual content is presented successively by scrolling or automatically may not be used.
• No profiling: The account may not be customised according to the child's behaviour; the child's data may not be subjected to profiling or personalised commercial advertising.

These rules and the other measures taken by the provider are published on the provider's own website (Article 8(6)).

The importance of the screenshot and visibility restrictions stems from the risk that information concerning the child becomes permanent on the internet. In its judgment finding that an access ban imposed on news websites in relation to a child victim of crime violated freedom of expression and of the press, the Constitutional Court emphasised as follows that the obligation to protect the child's identity gains even greater importance in online news reporting:

"Indeed, where the necessary sensitivity is not shown, considering that information concerning the identity of the child will spread much faster than in the traditional press, there arises the danger of such information continuing to exist on the internet independently of the concept of time and of rendering meaningless the efforts to prevent the minor from being recognisable."

Constitutional Court, Second Section, App. No: 2019/20812, 11.12.2024, § 29

What do parental control tools cover?

The provider is obliged to offer parental control tools that can be used by persons legally authorised to take decisions concerning the child, such as the mother, the father or a guardian (Article 9(1) and (2); Additional Article 4(20) of Law No. 5651). At a minimum, these tools include control of account and feature settings; making purchases, rentals and paid memberships subject to parental approval and setting a spending limit; monitoring and limiting usage time; and mechanisms relating to location sharing (Article 9(3)).

The tools are offered in Turkish, are easy to find, work on different devices and, when activated, are clearly notified to the child. The child cannot switch off the controls without the parent's knowledge and the same security verification; the tools, in turn, are designed so as not to eliminate the child's privacy disproportionately and to be based on communication and empowerment rather than surveillance (Article 9(4)). The provision of parental tools does not relieve the provider of its obligation to provide a differentiated service (Article 9(1)).

How can an objection be lodged if the account is closed or suspended?

The provider is obliged to establish an application and objection mechanism, in Turkish, free of charge and accessible, against the result of age verification, the suspension or closure of the account and the measures taken under the differentiated service. The objection is lodged by the person in respect of whom the action was taken (Article 10(1) and (2)). The mother and father may also apply on the child's behalf; under Article 342 of the Turkish Civil Code (TCC), the mother and father are the legal representatives of their children vis-à-vis third parties within the scope of their parental custody (velayet).

1. Record the notification: Keep a screenshot of the closure or suspension notification showing the date and time.
2. Identify the ground: Establish whether the action is based on the result of verification by token or on a suspension based on reasonable suspicion.
3. Generate a new token: For a suspended account to be used again, verification is carried out with a new token from e-Devlet (Article 6(3)).
4. Lodge the objection in writing: Use the platform's Turkish-language objection channel and request meaningful human review (Article 10(3)).
5. Stop the deletion: State expressly in the objection that the content and personal data may not be deleted while the objection is pending (Article 10(4)).
6. Challenge the outcome: If the objection is rejected, use the complaint to the Cyber Security Directorate or the judicial remedy indicated in the notification of the outcome (Article 10(5)).

Where the age has been determined incorrectly, the strongest evidence is a new token based directly on the e-Devlet record. If the decision taken by the provider through its own methods is based solely on an automated analysis, the right to object under Article 11(1)(g) KVKK and the right to request rectification of incomplete or inaccurate data (Article 11(1)(d)) may also be exercised separately.

Is there a time limit for the objection?

The Regulation sets neither a time limit for lodging an objection nor a response time in days for the provider; it requires objections to be concluded promptly (Article 10(1)). Additional Article 4(3) of Law No. 5651, on the other hand, provides that providers with more than one million daily accesses must respond to individuals' applications within 48 hours, with reasons if the response is negative; the limitation in this provision, "with respect to content falling within the scope of Articles 9 and 9/A", was removed by Law No. 7578 with effect from 01.11.2026. Whether this time limit will apply to objections concerning age verification will become clear in practice.

What should be prepared for the objection and the KVKK application?

• ✓A dated screenshot of the closure or suspension notification
• ✓The username of the account and the e-mail address or telephone number linked to the account
• ✓In the case of suspension, a newly generated age verification token from e-Devlet
• ✓If a parent is applying, a civil registry record or a decision showing parental custody or guardianship
• ✓Copies of the objection sent to the platform and of the responses received
• ✓A record showing the date on which the KVKK application was sent

What happens to the content and personal data in a closed account, and how are KVKK rights exercised?

Until the objection has been concluded, the content and personal data belonging to the account may not be deleted (Article 10(4)). If the objection is rejected or is never lodged, the data of existing accounts found to belong to persons under 15 are deleted (Provisional Article 1(1)(a)). For this reason, the objection is a means not only of recovering the account but also of stopping the deletion.

With regard to the personal data in the account, the platform is the addressee of applications under the Personal Data Protection Law (KVKK, Law No. 6698). Under Article 11 KVKK, everyone has the right, by applying to the data controller, to learn whether personal data relating to him or her are processed, to request information if they have been processed, to learn the purpose of the processing and the third parties to whom the data are transferred, and to request the rectification of incomplete or inaccurate data and, subject to the conditions of Article 7, their erasure. A person who suffers damage due to unlawful processing may also claim compensation for the damage (Article 11(1)(ğ)).

Under Article 7 KVKK, data for which the reasons requiring processing have ceased to exist are erased, destroyed or anonymised ex officio or upon request. Since the KVKK contains no separate right under the name of data portability, the platform's download tools and the request for information under Article 11 should be used together to obtain a copy of the data.

The application is made in writing or by other methods determined by the Board; the data controller concludes the request free of charge within 30 days at the latest, and if the action additionally entails a cost, the fee set out in the Board's tariff may be charged (Article 13 KVKK). If the application is rejected, the response is insufficient or no response is given in time, a complaint may be lodged with the Personal Data Protection Board within 30 days from the date the response is learned and, in any event, within 60 days from the application; applying to the data controller first is a prerequisite (Article 14 KVKK).

In its judgment finding that the failure to conduct an effective investigation into a complaint concerning images of a child published on the internet violated the right to request the protection of personal data, the Constitutional Court explained the purpose of this right as follows:

"The right to the protection of personal data, as a special form of the protection of a person's human dignity and of the right to develop his or her personality freely, aims to protect the rights and freedoms of the individual during the processing of personal data."

Constitutional Court, First Section, App. No: 2017/16849, 19.10.2023, § 50

The takeover of the account by another person or the use of the child's images in the production of fake content is not the subject of this article; for these, see the guides on social media account takeover and deepfake. The criminal law aspect of unauthorised dissemination of data is addressed in the article on Articles 135–136 TPC, and the removal of old content on the internet in the article on the right to be forgotten.

What sanctions apply if a social network provider fails to comply with the rules?

The Regulation provides for no sanctions against the user or the parent; the obligations rest with the provider. The relevant provisions of Additional Article 4 of Law No. 5651 apply to the imposition and notification of sanctions, the objection procedures and the lifting of sanctions (Article 11(1)).

Under the paragraph that became the twenty-fourth paragraph as a result of the insertion of four paragraphs by Law No. 7578, a provider that fails to fulfil the listed obligations, including those in the seventh (age limit of 15 and differentiated service) and twentieth (parental control tools) paragraphs, may be subjected by the President of the Directorate (Başkan) to an administrative fine of up to three per cent of its global turnover in the preceding calendar year. If compliance is not achieved within 30 days from the notification of the fine, taxpayers in Türkiye are prohibited from placing new advertisements with that provider. If compliance is still not achieved within three months from the advertising ban, the President of the Directorate may apply to the criminal judgeship of peace for the internet traffic bandwidth to be narrowed by fifty per cent and subsequently by up to ninety per cent.

Under the Regulation, before a sanction is imposed, the provider is notified of the non-compliance and given a reasonable period to remedy it. In determining the sanction, the gravity and duration of the non-compliance, the number of children affected and the provider's good-faith compliance efforts are taken into account (Article 11(2) and (3)).

What are the common mistakes and the exceptions?

Common mistakes

• Waiting without recording the notification: If no objection is lodged, the data of a closed account of a person under 15 are deleted without delay (Provisional Article 1(1)(a)).
• Generating a token with another person's e-Devlet account: In the event of reasonable suspicion, the account is suspended and a new verification is required (Article 6(3)).
• Settling for an automated rejection: An objection may not be examined entirely by automated systems (Article 10(3)).

Exceptions

• Persons temporarily in Türkiye: Persons not resident in Türkiye are exempt from age checks; upon their application, an exceptional token is generated using only passport information, without identity authentication on e-Devlet (Article 7(1)(d)).
• Parental contact information: Processing only the parent's contact information for the creation, verification, recovery and security of the account and for parental supervision does not count as contact synchronisation (Article 8(5)(d)).
• Persons who have completed the age of 18: As they fall outside the definition of a child, the rules of the differentiated service do not apply to them; the token also shows the threshold of 18 (Articles 4(1)(ç) and 7(1)(b)).

Account Closure Objections and KVKK Applications with an Istanbul IT Law Lawyer

In this process, the course of the matter is often determined by three points: recording the closure notification and the objection together with their dates, expressly reminding the platform of the rule that data may not be deleted while the objection is pending (Article 10(4)), and using the complaint to the Directorate, the KVKK application and the judicial remedy in the correct order against the outcome of the objection. Av. Coşkun Genç Law Office provides legal support in Istanbul to young people whose accounts have been closed or restricted, and to their parents, at the stages of preparing platform objections, Article 11 KVKK applications, complaints to the Personal Data Protection Board and, where necessary, judicial proceedings. In the work carried out as an Istanbul IT law lawyer, the legal basis of the action and the age verification record are examined first.

Parents and young people wishing to obtain the support of an Istanbul personal data lawyer may request a preliminary assessment together with the closure notification, the objection correspondence and the platform's responses. For situations with a criminal law dimension, such as the takeover of an account or unauthorised sharing of content, the cybercrimes practice area page may be consulted. The office's contact details are available on the contact page.

Sources

1. Regulation on the Provision of Differentiated Services Specific to Children by Social Network Providers and on Age Verification (Cyber Security Directorate of the Presidency of the Republic; Official Gazette 10.10.2026, No. 33396), Articles 1–14, Provisional Article 1 – Official Gazette · mevzuat.gov.tr
2. Law No. 5651 on the Regulation of Internet Publications and Combating Crimes Committed by Means of Such Publications, Article 2, Additional Article 4 – mevzuat.gov.tr
3. Law No. 7578 Amending the Social Services Law and Certain Laws (Official Gazette 01.05.2026, No. 33240), Articles 22, 27 – mevzuat.gov.tr
4. Personal Data Protection Law (KVKK, Law No. 6698), Articles 7, 11, 13, 14 – mevzuat.gov.tr
5. Turkish Civil Code (TCC, Law No. 4721), Article 342 – mevzuat.gov.tr
6. Constitutional Court, First Section, App. No: 2017/16849, 19.10.2023
7. Constitutional Court, Second Section, App. No: 2019/20812, 11.12.2024