How Will Age Verification on Social Media Work, Technically?

As of 1 November 2026, opening a social-media account in Turkey is no longer a matter of an email address and a password alone. Everyone opening a new account, whatever their age, must produce an "age-verification token" through e-Devlet and give it to the platform. For existing accounts the deadline is 31 March 2027. In this piece we first give a short summary, then open the process step by step as it will work technically: who sees what, which data flows where, what a token can be, how the limits on accounts aged 15-17 are applied in software, and how the bandwidth throttling foreseen as a sanction is carried out. At the end we ask the usual three questions: in whose hands, under whose control, for whose benefit?

This piece continues The Child-Protection Excuse of Those Who Begrudge Children a Single Meal, and the Surveillance Gate on Social Media, which we wrote on 17 October, Thirty-One Points: The Freedom on the Net 2026 Report and the Screen Tied to Identity of 28 October, and The Wallet Is Ours, Whose Is the Key? of 1 November. There we set the political frame. Here we look inside the machine.

---

Summary: age verification in ten points

1. The basis. By a provision added to Internet Law no. 5651 by Law no. 7578 (adopted on 22 April 2026, Official Gazette of 1 May 2026), social-network providers were forbidden to offer a service to children who have not turned 15. The detail of the application was set by the regulation prepared by the Cybersecurity Presidency of the Presidency and published on 10 October 2026. It came into force on 1 November 2026.
2. Everyone will verify. The ban is on those under 15, but the duty to verify is on everyone. A worker of 40 and a pensioner of 70 will both produce a token.
3. The timetable. From 1 November new accounts cannot be opened without verification. Existing accounts must be verified at least once by 31 March 2027 at the latest. The rumour that accounts would be closed en masse on 1 November is not true.
4. The mechanism. The user enters e-Devlet, produces a digital token from the age-verification service of the Cybersecurity Presidency, and enters it in the verification field on the platform. The platform checks the token and places the account in an age group.
5. What is in the token? According to the regulation, only two threshold facts: has the person passed 15, and has the person passed 18? There is no name, surname, date of birth, Turkish identity number or username.
6. The real problem is not in the content. It is in the process. The technical structure of the token was left to a guide that the Presidency will share only with the platforms. What record the state keeps at the moment of production, and what the platform asks the state during verification, is not public.
7. Three age groups. Under 15: no account, and no exception with a parent's permission. 15-17: a private account, no live broadcast, no infinite scroll, no profiling and no personalised advertising, messages only from accounts that are followed. Over 18: everything as before.
8. The platform may also use its own method. In the case of "reasonable suspicion" the account is suspended and verification is requested again. "Reasonable suspicion" is not defined.
9. The sanction falls on the platform. An administrative fine of up to 3 per cent of global turnover, an advertising ban, and, by a judge's order, bandwidth throttling first of 50 per cent and then of 90 per cent. There is no fine for the ordinary user who does not verify. The sanction is the closing of the account.
10. The class result. On the grounds of protecting children, the social-media presence of the whole of society is tied to an identity key held by the state. Anonymity, especially for the organising worker, the dissident and the journalist, becomes in practice subject to the state's permission. The surveillance-based business model of the platforms, for adults, is left untouched.

---

The detail

The legal skeleton: what does the statute say, and what does the regulation add?

To understand the technical process one first has to know who is authorised to do what, because in this regulation an important part of the technical architecture comes not from the statute but from the regulation.

Article 22 of Law no. 7578 changed the seventh paragraph of additional article 4 of Law no. 5651. In the old text the provider "takes the necessary measures" for children. In the new text the provider "may not offer a service to children who have not completed the age of fifteen" and must take an age-verification measure for this. The statute stops there.

e-Devlet, identity verification by the hand of the state, and the verification of adults as well, are in the regulation. In the words of the Freedom of Expression Association (İfade Özgürlüğü Derneği, İFÖD): "The statute mentions neither e-Devlet, nor identity verification by the hand of the state, nor the verification of adults." Because, under articles 13 and 20 of the Constitution, the limitation of fundamental rights and the processing of personal data must be done by statute, İFÖD announced that it will go to the Council of State for the annulment of the regulation. The time for a direct case against the regulation runs out on 9 December 2026.

In technical terms this means the following: the structure of the token, the most critical piece of the system, will be set not by the statute but by a guide that the Presidency will prepare under article 12 of the regulation. That guide is not public.

The actors of the system

There are three actors in age verification. Knowing what each holds is the key to understanding who can see what.

Actor	What they hold	What they can see
The user	An e-Devlet password or an e-signature/mobile signature, and a platform account	Their own token
The Cybersecurity Presidency (through e-Devlet)	The population record (date of birth), and the key that produces and signs the token	Who produced a token, and when; and, depending on the design, for which platform it was produced and where the token was used
The social-network provider (Instagram, TikTok, X, YouTube and so on)	The account, the device, the IP address, behavioural data; the Presidency's verification key, or access to a verification service	Whether the token is valid, and the age group; and everything it collects itself

The phrase "depending on the design" in the last column of the table is the real subject of this piece. Because systems with very different levels of privacy can be built with the same regulation text.

The flow, step by step

The flow described in the press and in articles 6 and 7 of the regulation is this:

1. Entry. The user logs in securely to turkiye.gov.tr or to the e-Devlet mobile application (by password, e-signature, mobile signature, or through a bank).
2. The service. They enter the Cybersecurity Presidency's service for "creating an age-verification token".
3. The calculation. The system looks at the date of birth in the population record and answers two questions: has the user turned 15, and has the user turned 18?
4. Production. A token carrying these two facts, digitally signed by the Presidency, is produced. It is given to the user as a code or as a text that can be copied.
5. Delivery. The user enters this code in the field on the platform's account-opening or verification screen.
6. The check. The platform checks that the token really came from the Presidency, that it has not expired, and that it has not been used before.
7. Classification. The account is placed in one of three groups: refused (under 15), a child's account (15-17), an adult account (18+).
8. The record. The platform stores the date on which the account was verified and the group it was placed in. It is forbidden to use the token for anything other than age verification.

Users who are not resident in Turkey and are there temporarily (tourists) cannot enter e-Devlet, so they will receive a separate token based on passport information. How this will work has also been left to the discretion of the Presidency.

What can the token be, technically? Three possible architectures

Because the guide has not been published, we cannot speak with certainty. But there are three basic approaches used in the world for this work, and which one is chosen changes everything. Let us open them in plain language for our young comrades.

The first architecture: a signed token, verified offline. The Presidency produces a small data package containing over_15: yes, over_18: no, a random number (a nonce) and an expiry date, and signs it with its own private key. This resembles the JWT/JWS form that is common on the web. The platform checks the signature on its own server with the Presidency's public key. It does not ask the Presidency anything further.

• The gain: at the moment of verification the state does not see on which platform, and on which account, the token was used.
• The loss: at the moment of production the state knows to whom the token was given. If it stores the random number in the token against the Turkish identity number in its own records, the account holder is found the moment it later asks the platform "with which token was this account verified?". The absence of a name in the token does not mean that the link cannot be made.

The second architecture: an online verification service. The platform sends the code the user entered to a verification service (an API) of the Presidency. The service replies "valid, age group 18+".

• The gain: the code can be short, and easy for the user; revocation and the single-use check are easy.
• The loss: at every verification the state sees which platform asked, at which moment, about which token. Joined with the production record, the information "Ahmet Yılmaz opened an account on X on 2 November at 14:32" comes into being in the state's hands. This is the architecture most friendly to surveillance.

The third architecture: privacy-preserving cryptography. With methods such as a blind signature or a zero-knowledge proof, the state signs the token but cannot see the content of the token it signed, and the platform sees only the proof that "this person is over 18". The European Union's age-verification plan, and the mobile driving-licence design in the ISO 18013-5 standard, are moving in this direction under the name "selective disclosure".

• The gain: even if the state and the platform join the records they hold, the token does not match a person.
• The loss: because the token is not bound to a person, a token produced by an adult can be given to a child. Preventing this requires extra measures such as binding it to a device, and that brings traceability back.

What İFÖD calls an "unresolvable dilemma" is exactly this: if the token does not make a link to a person, it is easily transferred and the regulation remains ineffective; if it is strengthened so that it cannot be transferred, it turns into an infrastructure that can track who verified, when and where. In İFÖD's concise sentence: "This regulation will either remain ineffective or turn into an instrument of surveillance."

We do not know which architecture was chosen, because the guide will be shared only with the platforms. In İFÖD's words: "The guarantee of privacy has been entrusted to a document that those who ought to inspect it cannot see."

A comparison of the three architectures

Question	Signed token (offline)	Online verification service	Privacy-preserving cryptography
Does the state know to whom it gave the token?	Yes	Yes	No (in a blind signature)
Does the state see on which platform it was used?	No (yes later, if the records are matched)	Yes, at the moment	No
Does the platform see the identity?	No	No	No
Can the token be transferred to someone else?	Partly, within a time limit and a single use	Hard	Easy (if there is no extra measure)
Is public inspection possible?	If the guide is published	If the guide is published	If the guide is published

The last row has the same condition in every column. That is why the first demand of the technical argument is simple: let the guide be published.

What will happen on the platform's side?

The token is only the first gate. The regulation loads three separate jobs onto the platforms.

An additional age check. During the service the platform may also check age by its own methods. The common forms of this in the world are these: an age estimate by artificial intelligence from a face photograph or a short video, an age estimate from behavioural data (at which hours, with which content, and with which style of writing the person interacts), and information from the device and the app store. When "reasonable suspicion" arises, the account is suspended and a new token is requested. Because "reasonable suspicion" is not defined, this leaves a wide field of discretion to the platform's own algorithm. Beside the state's identity key, the platform's analysis of the face and of behaviour is added.

Deciding who is in Turkey. The regulation covers providers "accessible from Turkey". For the platform to apply these rules to a user, it has to understand that the user is in Turkey: the IP address, the country code of the SIM card, the region of the app store, the telephone number. A VPN changes only one of these signals (the IP address). Once an account has been verified, the age group stays bound to the account, so a VPN does not take an existing account out of its age group. But showing an account as if it had been opened from another country, in order never to see the verification screen, began to be discussed among young people from the first day. This will be made a ground for tightening the "reasonable suspicion" check.

An appeal system. For a wrong classification or a suspension, an appeal path in Turkish, free of charge and accessible, is obligatory. The result cannot be given by an automatic system alone. A "meaningful human review" is required. While the appeal continues, the content and the data cannot be deleted. Every year the platforms will disclose the number of appeals, the rate of acceptance and the average time. This article is one of the positive sides of the regulation. The same principle should also be demanded for decisions that remove content in general.

How are the accounts of those aged 15-17 limited in software?

Article 8 of the regulation sets a series of rules for children's accounts. Each of these means a different intervention in software, and some of them cannot be fully applied technically.

Rule	Its counterpart in software	A technical note
The account must be private	A "child" flag on the account record; the profile-visibility setting is locked	Easy to apply
The follower and following lists are private	The list endpoints (the API) return empty for children's accounts	Easy
Not shown as a recommendation	Children's accounts are removed from the candidate pool of the recommendation algorithm	Medium; recommendation systems are fed from more than one channel
Messages only from accounts that are followed, and no read receipt	A permission check on the sender, on the message server	Easy
No live broadcast	The function that starts a broadcast is switched off according to the account flag	Easy
No matching of contacts or email	The feature that uploads a contact list is switched off	Easy
A block on screenshots	On Android it can be blocked with a secure mode at the window level; on iOS it can only be detected and reported; in a web browser it cannot be blocked	It cannot be fully applied; a photograph with a second phone is always possible
No infinite scroll and no automatic consecutive play	The feed is split into pages, and autoplay is switched off	Easy, but it changes the core of products of the Reels/TikTok type
No profiling and no personalised commercial advertising	Children's accounts are not fed with behavioural data in the advertising and recommendation line	The rule that is hardest to inspect; it cannot be verified from outside
Parental control (time, spending, location)	A separate management panel linked to a parent's account	Location sharing is not in the statute. The regulation added it

One thing has to be underlined here. The ban on profiling, the ban on infinite scroll, not appearing in the recommendation system, the ban on addictive design: these are good things for children. But we know that the same designs harm adults too. The platform companies will go on exploiting the adult worker's attention, sleep and data with the same mechanisms. The regulation accepts the harmful design, but leaves it free after the age of 18.

The sanction: how is bandwidth throttled?

If the platform does not obey the rules, a notice is given first and time is allowed for correction. If it continues, an administrative fine comes (up to 3 per cent of global turnover), an advertising ban, and bandwidth throttling by a judge's order.

Bandwidth throttling is carried out technically through the service providers (Türk Telekom, Turkcell, Vodafone and so on). The operators understand which domain the traffic is going to from the SNI information at the start of the connection, or from DNS queries, and they drop the speed allocated to that traffic by 50 per cent or by 90 per cent. This is the same method Turkey has applied before in extraordinary situations. The important point is this: bandwidth throttling punishes not the company that breaks the rule, but everyone who uses that platform. The sanction of a child-protection rule has been designed as the slowing of the channel through which millions of adults get news and communicate.

The situation in the world: where does Turkey stand?

• Australia brought a ban on social media for those under 16 into force on 10 December 2025. But its statute bans platforms from demanding an official identity document or a state-approved digital identity, unless a reasonable alternative is offered.
• The United Kingdom, with the Online Safety Act, has since July 2025 required age verification for certain content. It leaves the method to the platform and to private verification companies. In the first weeks of the application, VPN use rose quickly.
• The European Union, in its digital-identity wallet and age-verification plan, aims at privacy-preserving methods such as selective disclosure and zero-knowledge proofs.

In İFÖD's assessment, Turkey joins the strictest model of prohibition (an absolute ban under 15, without even an exception for a parent's consent) to an e-Devlet obligation for which there is no alternative. What is more, the institution that holds the token key is the same institution that conveys access-blocking decisions to the platforms and that is the body for complaints. According to İFÖD, in September 2026 alone the Presidency conveyed the decisions that led to the blocking of at least 1,270 accounts on X.

Fraud: the real danger of the first day

The weakest link of the technical system is, as always, the link a person clicks in a hurry. SMS messages and emails headed "your account will be closed, verify your age" began to spread from the first day. The rule is simple:

• The e-Devlet password is entered only at the address turkiye.gov.tr, or in the official e-Devlet application.
• No platform asks for your e-Devlet password. It asks only for the code you produced on e-Devlet.
• Someone who knows the e-Devlet password can produce a token in your name. The password should be shared with no one, not even inside the family.

---

In Whose Hands, Under Whose Control, for Whose Benefit?

In whose hands? The key is in the state's hands. The institution that produces the token, signs it, can revoke it, writes the technical guide, and is also the referee in part of the appeals, is the same: the Cybersecurity Presidency. There is no name in the token, but the key is the state's. The question we asked about the digital identity wallet in The Wallet Is Ours, Whose Is the Key? found a concrete answer here.

Under whose control? No one's. The guide is closed to the public. Public opinion was not taken. The role of the KVKK, the personal-data authority, in this process was not defined. An independent security audit was not foreseen. We do not know which records the state keeps at the moment of production, how long it stores them, and with whom it can share them. Without source code that is open to the public, an independent audit, and a commitment not to keep records, saying "there is no name" is not a guarantee. It is a promise.

For whose benefit? There are three who benefit:

• The state, for the first time in its history, ties the social-media presence of the whole of society to its own identity infrastructure. Today only an age threshold. Tomorrow, by "the widening of the purpose", other things. The history of Law no. 5651 over the last ten years is the history of this widening.
• The big platforms keep the surveillance-based business model over adult users. What is more, because they are the only actors who can meet the cost of compliance, the way is closed still further for small, local, cooperative or federated alternatives. What will a server run by volunteers, such as Mastodon, do in the face of a fine calculated on turnover and of compliance with a technical guide?
• The verification industry, above all the companies that estimate age by face analysis, finds a new market through the "reasonable suspicion" article.

Those who lose are also clear. The worker who carries on union organising through anonymous accounts so that the boss does not see it; the journalist who has to protect a source; the young person who tries to express themselves away from the pressure of the family; and the child who, because they are under 15, and because the family is poor, cannot even see a school bus, and is now also wholly excluded from the digital public space. Let us repeat what we said in The Child-Protection Excuse of Those Who Begrudge Children a Single Meal, and the Surveillance Gate on Social Media: the child-protection ground of those who find a single school meal too much for the budget protects not the child but the control.

Two ways of looking

The official account	From the window of class
We are protecting children from digital dangers	The children are the pretext; everyone is verified
There is no identity information in the token	The danger is not inside the token. It is in the process in which it is produced and verified
The platforms are being held responsible	The platforms' model of surveillance aimed at adults stands as it was
The technical detail is in the guide	The guide is closed to the public; an unaudited key
There is no penalty for the user	The penalty is the closing of the account, and, by throttling, it falls on everyone
Parents are being strengthened	Location tracking was added to the parent panel without a statute; surveillance inside the family is normalised
It is being done in the world too	Australia banned the state's identity; the EU is moving towards privacy-preserving cryptography

---

Concrete tasks

1. Let us demand that the guide be disclosed. The technical structure of the token, the signature algorithm, and the periods for keeping and storing records should be disclosed to the public. The source code should be opened to the inspection of independent security researchers. Computing workers, professional chambers and unions can put this demand in a technical language, in a text open to signatures.
2. Let us use the right of information and the application path to the KVKK. After producing a token on e-Devlet, it is everyone's right to put to the Presidency, under article 11 of the KVKK, the question "which record was kept about me, how long will it be stored, with whom can it be shared?". A collective application is the way to document the silence.
3. Let us follow the Council of State case, and support it. Let us follow the case İFÖD will bring, and the other cases that can be brought until 9 December. Let us call on the bar associations and the professional organisations to intervene.
4. Let us not tie organisational communication to a single platform. For union and political organising, let us learn and teach tools that are encrypted end to end and that run on our own server (Matrix, Signal, our own email lists). The screen tied to identity cuts the voice not of the organised but of the scattered.
5. Let us hold workshops for young people on fraud and password safety. Even a half-hour account, around a school, in a youth organisation, in a union branch, saves dozens of e-Devlet accounts.
6. Let us want the protections for everyone. The ban on profiling, the ban on infinite scroll, and the ban on addictive design should not stay limited to the ages 15-17. Let our demand be not age verification, but the banning, for everyone, of the surveillance-based business model.

---

Dear Young Comrades,

The greatest lie of this regulation is that it says to you "we are protecting you". Those who want to protect you put a meal in your school, give your family a humane wage, and open the park, the library and the youth centre. They do not fit the state's key to your screen.

But let us not ignore a truth either: the platform companies really are selling your attention, your sleep and your anxiety. The state has also accepted that the infinite scroll, the profiling and the addictive design which the regulation bans for the ages 15-17 are harmful. Our struggle is therefore on two fronts: no to the state's identity key, and no to the companies' model of surveillance. We do not have to choose one and surrender to the other.

The machine is new, the chain is old. What will break the chain is the meeting of technical knowledge with organised solidarity. Learn how the token works, and teach it. Ask for the guide to be disclosed. Build your communication with your own common tools. Knowledge belongs to everyone.

---