Home About Us Services Awards Team Insights Career Contact Us TÜRKÇEENGLISH Devin Patent — Istanbul
Regulatory/Insights

Official Gazette Weekly Update — 5–11 October 2026: The Regulation on Age Verification on Social Networks, the Resolution of Principle on the Monitoring of Corporate E-mail and Electronic Notification in Tax Matters

Resmî Gazete Haftalık Gelişmeler — 05.10–11.10.2026: Sosyal Ağlarda Yaş Doğrulama Yönetmeliği, Kurumsal E-Posta Denetimine İlişkin İlke Kararı ve Vergide Elektronik Tebligat
Published12 October 2026
Reading time15 min
PDF
← All Insights
CategoryRegulatory
Published12 October 2026
Contents01Introduction02Decisions and Legislation of the Week03Conclusion
Devin Law & IP

This subject falls outside trademark and patent attorneyship. Legal services in this field are provided by our law firm, Devin Law & IP.

Go to devinlaw.com.tr →
SummaryÖzet

This legal update presents a selection of the regulations, communiqués, board decisions and Constitutional Court decisions published in the Official Gazette issues Nos. 33391 to 33397 between 5 October 2026 and 11 October 2026. No duplicate issue was published between these dates. The update covers one new regulation, one resolution of principle, four amendments to regulations, two communiqués and ten individual application decisions.

01
Introduction

In the executive and administrative section of the week, the Cybersecurity Presidency’s Regulation on the Provision of Differentiated (Child-Specific) Services by Social Network Providers and on Age Verification was published in the Official Gazette dated 10 October 2026. The Regulation will enter into force on 1 November 2026. Under the Regulation, a social network provider may not provide services to children who have not attained the age of fifteen. For existing accounts opened before the date of entry into force, age verification must be carried out by 31 March 2027.

The Personal Data Protection Board’s decision No. 2026/2035 dated 16 September 2026 on the monitoring of corporate e-mail accounts and of communication channels used for the performance of work was published in the Official Gazette dated 8 October 2026. In the same week, the amounts set out in certain articles of the Regulation on Measures Regarding the Prevention of Laundering Proceeds of Crime and Financing of Terrorism were amended, the date in the provisional article of the communiqué on the application of Article 376 of the Turkish Commercial Code (Law No. 6102) was changed to 1 January 2028 (1/1/2028), and the procedures and principles concerning the electronic notification system were redetermined by the Tax Procedure Law General Communiqué (Serial No. 596). In the judicial section, ten individual application decisions of the Plenary of the Constitutional Court were published. No instrument was identified in the indices of the issues covered by this update amending the legislation on industrial property, intellectual and artistic works or competition.

Under the Regulation entering into force on 1 November 2026, a social network provider may not provide services to children below the age of fifteen; existing accounts are to be age-verified by 31 March 2027.
02
Decisions and Legislation of the Week
Regulation on Age Verification on Social Networks and Differentiated Child-Specific Services

Reference, Legal Basis and Scope

The Regulation, issued by the Presidency of the Republic (the Cybersecurity Presidency, “the Presidency”), was published in the Official Gazette dated 10 October 2026 and numbered 33396. The Regulation was prepared on the basis of the seventh, twentieth and twenty-fifth paragraphs of Additional Article 4 of Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed through Such Publications. The Regulation covers domestic or foreign-based social network providers accessible from Türkiye and users, as well as the acts and procedures concerning the differentiated (child-specific) services to be provided to children who have attained the age of fifteen, age verification, parental control tools and objection mechanisms.

The legislation provides: Under the first paragraph of Article 5 of the Regulation, “A social network provider may not provide services to children who have not attained the age of fifteen.” Under the third paragraph of the same Article, the protection of personal data is the governing principle in age verification processes, and methods that allow only the age threshold to be determined, rather than identification, are used.

Age Verification Token

Under Article 6 of the Regulation, a social network provider must verify the user’s age status by means of an age verification token at the account creation stage. Account opening requests of children who are found, as a result of age verification, not to have attained the age of fifteen are refused. The accounts of children found to have attained the age of fifteen are made subject to the differentiated service principles set out in Article 8. Where there is reasonable suspicion that a verified account is being used contrary to the determined age range, the account is suspended, and age verification by means of an age verification token is required for the account to be used again.

Under Article 7 of the Regulation, age verification is carried out through the e-Government Gateway. The token is generated, at the user’s request, by using the online service provided by the Presidency and is uploaded by the user to the platform of the relevant social network provider. The token contains only the information as to whether the user has attained the age of fifteen and, if the user has attained the age of fifteen, whether the user has attained the age of eighteen. A social network provider may not use the age verification token for any purpose other than age verification. Users who are not resident in Türkiye and are present there temporarily are exempt from the control mechanisms relating to age verification. For these users, an exceptional token is created, upon their application, by using passport information.

Principles Applicable to Accounts of Children Who Have Attained the Age of Fifteen

Under Article 8 of the Regulation, a social network provider applies high-level privacy settings by default for the purpose of protecting the personal data of a child user who has attained the age of fifteen, and enables data to be processed at a minimum level. The fifth paragraph of the same Article lists the principles to be applied to these accounts. Accordingly, no service capable of producing an addiction-forming effect may be provided. Accounts are provided as private accounts by default and may not be offered with the option of being public. Only the accounts that the account follows may send messages to it, and “seen” information may not be displayed in messages. The account may not include a live broadcasting feature. No interface, design or function may be provided that enables visual content to be presented consecutively through scrolling, touching, clicking or similar user actions, or automatically.

The legislation provides: Under subparagraph (h) of the fifth paragraph of Article 8 of the Regulation, “Accounts of children who have attained the age of fifteen may not be customised according to the child’s behaviour; personal data belonging to the child may not be made the subject of profiling or personalised commercial advertising activities.” Under subparagraph (d) of the same paragraph, a social network provider may not synchronise the child’s account with telephone directories, contact and user lists, e-mail address books and similar sources. Under the same subparagraph, data obtained in breach of the paragraph and the matching, inference and recommendation records generated from such data are deleted without delay.

Parental Control Tools and Objection Mechanism

Under Article 9 of the Regulation, parental control tools include, as a minimum, mechanisms for controlling account and feature settings, for making fee-based transactions such as purchases, rentals and paid subscriptions subject to parental permission or approval and setting a spending limit for such transactions, for monitoring, setting and limiting usage time, and for location sharing. These tools are offered with a Turkish language option and, when activated, the child is expressly notified.

Under Article 10 of the Regulation, a social network provider is obliged to establish a free and accessible application and objection mechanism, with a Turkish language option, for objections concerning the age verification result, the suspension or closure of an account, and the measures applied within the scope of the differentiated service. Applications and objections may not be examined by fully automated systems and are subject to meaningful human review.

Sanctions, Transitional Provision and Entry into Force

Under Article 11 of the Regulation, where the obligations are not fulfilled, the relevant provisions of Additional Article 4 of Law No. 5651 apply to matters concerning the imposition, notification and lifting of sanctions and the objection procedures. Before a sanction is imposed, the social network provider is notified of the non-compliance and is granted a reasonable period, according to the nature of the non-compliance, to remedy it.

Under Provisional Article 1, for existing accounts that were opened before the date of entry into force of the Regulation and have not been verified by means of an age verification token, verification by means of an age verification token must be carried out by the social network provider, at least once, by 31 March 2027. Existing accounts of children found not to have attained the age of fifteen are closed after information is given. The Regulation enters into force on 1 November 2026.

Dates relating to the Regulation (Subject · Date · Source)

  • Publication in the Official Gazette — 10 October 2026 — OG issue 33396
  • Entry into force — 1 November 2026 — Regulation
  • Deadline for age verification of existing accounts — 31 March 2027 — Provisional Article 1
Resolution of Principle No. 2026/2035 of the Personal Data Protection Board

The Personal Data Protection Board’s (“the Board”) decision No. 2026/2035 dated 16 September 2026 was published in the Official Gazette dated 8 October 2026 and numbered 33394. The decision concerns the procedures and principles to be observed in the monitoring of communication channels used for the performance of work, in particular corporate e-mail accounts allocated to employees by employers. The decision states that the fact that the means of communication belongs to the employer or is used in the workplace does not confer on the employer an unlimited power of monitoring over employees’ communication activities.

The Board announced that, where non-compliance with the obligations is established, action will be taken against the relevant data controllers pursuant to Article 18 of Law No. 6698 on the Protection of Personal Data (“PDPL”). The details of the decision are set out in the legal update on the Decisions of the Personal Data Protection Board dated October 2026.

Prevention of Money Laundering and Terrorist Financing: Amendment to the Regulation on Measures

The Regulation Amending the Regulation on Measures Regarding the Prevention of Laundering Proceeds of Crime and Financing of Terrorism was put into effect by Presidential Decision No. 11845 dated 6 October 2026 and was published in the Official Gazette dated 7 October 2026 and numbered 33393. The amendment entered into force on the date of its publication.

The amendment replaced, in subparagraph (b) of the first paragraph of Article 5 of the Regulation, the amount “TRY 185,000” with “TRY 370,000” and the amount “TRY 15,000” with “TRY 30,000”, and, in subparagraph (c) of the same paragraph, the amount “TRY 15,000” with “TRY 30,000”. The amounts “TRY 15,000” in the first and second paragraphs of Articles 24 and 24/A of the Regulation were also replaced with “TRY 30,000”.

The legislation provides: Under the provision added to the first paragraph of Article 16 of the Regulation, “Where verification is carried out by financial institutions through internet or mobile service channels, or by means of a one-time verification code sent by short message service (SMS OTP) to the customer’s mobile telephone number registered with the obliged party and previously verified, a specimen signature need not be obtained.” Under the third paragraph added to Article 38 of the Regulation, only an obligation compliance audit report is prepared in respect of obliged parties other than those falling under subparagraph (f) of the first paragraph of Article 3. Where a breach of obligation is identified during the audit, this report also takes the place of a breach of obligation examination report.

Amendment to the Communiqué on Article 376 of the Turkish Commercial Code

The Ministry of Trade’s Communiqué Amending the Communiqué on the Procedures and Principles Regarding the Application of Article 376 of the Turkish Commercial Code (Law No. 6102) was published in the Official Gazette dated 10 October 2026 and numbered 33396 and entered into force on the date of its publication. The amendment replaced the date “1/1/2027” (1 January 2027) in Provisional Article 1 of the Communiqué, published in the Official Gazette dated 15 September 2018 and numbered 30536, with “1/1/2028” (1 January 2028). Article 376 of the Turkish Commercial Code governs loss of capital and over-indebtedness.

Tax Procedure Law General Communiqué (Serial No. 596): Electronic Notification

Scope and Obligation to Join the System

The Communiqué of the Ministry of Treasury and Finance (Revenue Administration) was published in the Official Gazette dated 11 October 2026 and numbered 33397 and entered into force on the date of its publication. The Communiqué sets out the procedures and principles for the application of Article 107/A of the Tax Procedure Law (Law No. 213), as amended by Article 9 of Law No. 7587 dated 24 June 2026. The Communiqué repealed the Tax Procedure Law General Communiqué (Serial No. 456), published in the Official Gazette dated 27 August 2015 and numbered 29458.

Under Article 5 of the Communiqué, corporate income tax payers, income tax payers taxed on an actual basis on account of their commercial, agricultural and professional earnings, general partnerships and ordinary limited partnerships, and persons in whose name registration is made upon the first acquisition of those goods in List (II) annexed to the Special Consumption Tax Law (Law No. 4760) that are subject to recording and registration are obliged to join the electronic notification (e-notification) system and to use that system.

Time Limits and Date of Notification

Under Article 7 of the Communiqué, corporate income tax payers, income tax payers taxed on an actual basis, general partnerships and ordinary limited partnerships that had not joined the system before the date of publication of the Communiqué and are obliged to use the system must join it by the end of the month following the publication of the Communiqué. For those whose tax liability is established after the date of publication of the Communiqué, the time limit is 15 days following the date of commencement of business. Under Provisional Article 1, those who joined the system before 1 July 2026 continue to use the system with their existing user codes and passwords, without making a new application.

The legislation provides: Under the third paragraph of Article 9 of the Communiqué, “An electronically signed notification document is deemed to have been served on the addressee at the end of the fifth day following the date on which it reaches the electronic notification system.” Under Article 10 of the Communiqué, the fact that the information messages to be sent to the mobile telephone number or e-mail address could not be sent for any reason does not affect the notification period or the validity of the notification.

Individual Application Decisions of the Plenary of the Constitutional Court

Ten individual application decisions of the Plenary of the Constitutional Court were published in the Official Gazette dated 6 October 2026 and numbered 33392. The Hakan Şimşek decision dated 12 May 2026 (Application No. 2022/102726) concerns the allegations that the freedoms of expression and of the press were violated on account of a conviction for the offence of knowingly and willingly aiding an organisation established for the purpose of committing crime, without being a member of it. The Court unanimously held that the freedoms of expression and of the press, guaranteed under Articles 26 and 28 of the Constitution, had not been violated, and found the allegation that the right to a fair trial had been violated inadmissible for being manifestly ill-founded.

Among the other decisions published in the same issue, the Melda Soyugüzel decision dated 2 July 2026 (Application No. 2021/29752) concerns the allegations that the right to a fair hearing and the presumption of innocence were violated in a reinstatement action brought by a person employed as a security guard, following the termination of the employment contract on account of the cancellation of that person’s security card. The Pınar Gül decision dated 2 July 2026 (Application No. 2022/75743) concerns the refusal of a request for transfer to a permanent worker post, and the Mahmut Kaçan decision dated 8 January 2026 (Application No. 2021/56755) concerns the right to hold meetings and demonstration marches, on account of the administration’s decision banning all events throughout the province. The other six decisions bear application Nos. 2019/789, 2020/9501, 2021/24997, 2023/31244, 2023/91027 and 2025/57667. The operative parts of the nine decisions other than the Hakan Şimşek decision are not examined in this update.

Other Publications of the Week

The Regulation Amending the Regulation on the Rights of Passengers Travelling by Rail, published in the Official Gazette dated 10 October 2026, replaced the phrases “180 days” (“180 günden”) in Articles 48 and 49 of the Regulation with “90 days” (“90 günden”), and set at TRY 9,473, in the first paragraph of Article 63, the administrative fine to be imposed where matters contrary to the Regulation are identified. In the Official Gazette dated 8 October 2026, the definition of futures contract was amended in two regulations concerning specialised commodity exchanges.

The Official Gazette dated 10 October 2026 also contained the Decision on the Cancellation of the Operating Permission of Parakolay Elektronik Para A.Ş. The content of this decision is not examined in this update.

Publications of the week (5–11 October 2026) (OG date / issue · Decision / instrument · Outcome / entry into force)

  • 6 Oct 2026 / 33392 — Constitutional Court Plenary: ten individual application decisions — Hakan Şimşek: freedoms of expression and press not violated
  • 7 Oct 2026 / 33393 — Amendment to the Regulation on Measures (Decision No. 11845) — Effective on publication
  • 8 Oct 2026 / 33394 — Personal Data Protection Board decision (No. 2026/2035) — Decision dated 16 September 2026
  • 8 Oct 2026 — Amendments to two regulations on specialised commodity exchanges — Definition of futures contract amended
  • 10 Oct 2026 / 33396 — Regulation on age verification and differentiated services on social networks — In force 1/11/2026; existing accounts 31/3/2027
  • 10 Oct 2026 / 33396 — Amendment to the Communiqué on Article 376 of the Commercial Code — Effective on publication; provisional article date 1/1/2028
  • 10 Oct 2026 — Amendment to the Regulation on rail passengers’ rights — “180 days” → “90 days”; administrative fine TRY 9,473
  • 10 Oct 2026 — Cancellation of operating permission of Parakolay Elektronik Para A.Ş. — Not examined in this update
  • 11 Oct 2026 / 33397 — Tax Procedure Law General Communiqué (Serial No. 596) — Effective on publication; Serial No. 456 repealed
03
Conclusion

In the week of 5 October 2026 – 11 October 2026, the Regulation on the Provision of Differentiated (Child-Specific) Services by Social Network Providers and on Age Verification was published. The Regulation will enter into force on 1 November 2026, and age verification for existing accounts will be carried out by 31 March 2027. Pursuant to the Regulation, a social network provider may not provide services to children who have not attained the age of fifteen. Accounts of children who have attained the age of fifteen are subject to the principles listed in Article 8 of the Regulation.

The Personal Data Protection Board’s decision No. 2026/2035 on the monitoring of corporate e-mail and work communication channels was published on 8 October 2026. In the Regulation on Measures, the amount “TRY 185,000” was replaced with “TRY 370,000” and the amounts “TRY 15,000” with “TRY 30,000”. The date in Provisional Article 1 of the Communiqué on Article 376 of the Turkish Commercial Code became 1 January 2028 (1/1/2028). Pursuant to the Tax Procedure Law General Communiqué (Serial No. 596), taxpayers within scope that had not joined the system before the date of publication of the Communiqué are required to join the electronic notification system by the end of the month following the publication of the Communiqué. Ten individual application decisions of the Plenary of the Constitutional Court were published on 6 October 2026; in the Hakan Şimşek decision, it was held that the freedoms of expression and of the press had not been violated.

Full briefing noteDownload the bilingual PDF version of this briefing note.
Download PDF

Related reading

RegulatoryOfficial Gazette Weekly Update — 12–18 October 2026: Extension of the Minimum Capital Deadline, the Muhammet Babur Decision on an Advertisement Board Fine and the Machinery Safety Regulation19 October 2026RegulatoryOfficial Gazette Weekly Update — 28 September–4 October 2026: Annulment of the Phrase “Indefinitely” in Poverty Alimony, Real Estate Trade and the Distilled Spirit Drinks Communiqué5 October 2026RegulatoryTürkiye’s First Climate Law Adopted by the Grand National Assembly14 June 2026