Internet Law in Turkey (Law No. 5651)

Law No. 5651 on the Regulation of Publications on the Internet is the central framework of Turkish internet law. It defines the actors – content providers, hosting providers, access providers and social networks –, regulates their obligations and contains the procedures for content removal and access blocking. Since the 2020 and 2022 amendments, large social networks have been subject to a separate, strict regime of obligations, including the appointment of a representative in Turkey. For companies, the law is relevant in two directions: as an instrument against unlawful online content – and as a catalogue of duties for their own platform and hosting offerings.

Table of contents

• Which actors does the law distinguish and what are their basic obligations?
• How does the content removal and access blocking procedure work?
• How are personality rights protected under Article 9?
• When do the authorities block, and what does the right to be forgotten mean?
• What special obligations apply to social networks?
• What does the law mean for companies with their own platforms?
• How can affected parties challenge blocking orders?
• How does one proceed in practice against reputation-damaging online content?
• How does the law interact with copyright, trademark and data protection law?
• What are the most common mistakes in practice?
• How does access blocking work in practice? An example and an assessment
• Conclusion

Which actors does the law distinguish and what are their basic obligations?

The law distinguishes the content provider ("içerik sağlayıcı"), which provides its own content and is fully responsible for it; the hosting provider ("yer sağlayıcı"), which stores third-party content, bears no general monitoring duty but must remove unlawful content upon knowledge and must retain traffic data for the statutorily determined period; and the access provider ("erişim sağlayıcı"), which provides network access and must implement judicial and administrative blocking orders. Hosting providers require an activity notification to the Information and Communication Technologies Authority (BTK); the obligations are graduated by size. A company operating websites, forums, review or comment functions is regularly both a content and a hosting provider at the same time – with the corresponding notification, imprint and reaction duties.

The retention period is between six months and two years for hosting providers (in practice usually six months) and between one and two years for access providers (in practice usually one year), and is specified by secondary legislation.

How does the content removal and access blocking procedure work?

The law knows two basic instruments: removal of the content ("içeriğin çıkarılması") and access blocking ("erişimin engellenmesi"), which must be ordered as narrowly as possible – targeted at the specific URL rather than the entire domain. For a catalogue of serious offences (including sexual abuse of children, encouragement of suicide, narcotics, obscenity, gambling and offences against Atatürk), blocking can be ordered by the court and, in urgent cases, by the authority. Separate procedures exist for violations of personality rights and for national security. The orders are distributed to all providers via the Association of Access Providers ("Erişim Sağlayıcıları Birliği") and must be implemented at short notice.

How are personality rights protected under Article 9?

Anyone whose personality rights are violated by online content – natural and legal persons alike, hence also companies confronted with defamatory or credit-damaging publications – may first request removal from the content or hosting provider and may apply directly to the criminal judge of the peace ("sulh ceza hâkimliği"). The judge decides in principle within 24 hours without an oral hearing; the decision orders removal of the content and/or a URL-based block and is implemented via the Association. This expedited procedure is remarkably fast and inexpensive and has established itself as the standard instrument of online reputation protection; because of its proximity to freedom of expression and of the press, it is at the same time subject to review by the Constitutional Court, which has repeatedly objected to excessive blocking. Companies should use it judiciously – against clearly unlawful content, not against unwelcome criticism.

When do the authorities block, and what does the right to be forgotten mean?

Alongside the judicial procedures, the BTK can order blocks administratively in statutorily defined cases – in particular for catalogue offences and threats to national security and public order – subject to subsequent judicial confirmation. A right to be forgotten is also recognised: upon application, the removal of outdated content that burdens the person unreasonably can be ordered from search results and archives; the case-law weighs the public's interest in information, currency and the severity of the impairment. In reputation management practice, this instrument complements the Article 9 procedures.

This threefold test was shaped by the N.B.B. decision of the Constitutional Court and largely coincides with the criteria of the CJEU's Google Spain decision (2014): the public's current interest in information, the age of the content and the person's position in society (public figure or private individual) are weighed together. For European companies, this offers a framework familiar from "right to be forgotten" requests under the GDPR; what must be followed, however, is Turkey's own case-law and its own procedural route (the criminal judge of the peace).

What special obligations apply to social networks?

Providers of social networks ("sosyal ağ sağlayıcı") with more than one million daily accesses from Turkey have been subject to a special regime since 2020, tightened again in 2022:

• Appointment of a representative in Turkey; for large networks, the representative must be a capital company established in Turkey or a Turkish citizen resident in Turkey
• Response to individual applications concerning personality rights violations within 48 hours and reporting duties towards the BTK
• Implementation of judicial and administrative removal and blocking orders within short deadlines
• Data localisation requirements for certain user data and duties to provide information to law enforcement authorities as provided by the law

In the event of violations, the law provides an escalating sanction system – from graduated administrative fines through an advertising ban to bandwidth throttling. For international platforms with a relevant Turkish user base, the appointment of a representative is thus practically unavoidable; it should be combined with a clear internal responsibility and escalation framework for Turkish orders.

In concrete terms, this tiered system works as follows: if the duty to appoint a representative is breached, the BTK first issues a notification; if non-compliance persists 30 days after the notification, a fine of TRY 10 million is imposed, and a further TRY 30 million 30 days after its service; thereafter follow the advertising ban and, as the final stage, bandwidth throttling of initially 50%, and 90–95% if non-compliance continues for 30 more days. In the event of subsequent compliance, only one quarter of the imposed fines is collected, the advertising ban lapses and the throttling orders become automatically void. Separately, failure to answer personality rights applications within 48/72 hours carries fines of TRY 100,000 to 1,000,000, and failure to submit the quarterly reports to the BTK fines of TRY 1 to 5 million. The exact method of measuring the threshold of "one million daily accesses" has not been conclusively clarified in secondary legislation; platforms close to the threshold should monitor current BTK practice.

What does the law mean for companies with their own platforms?

Beyond the large networks, the law also reaches corporate offerings with user-generated content – review portals, forums, marketplaces with comment functions: required are the hosting notification to the BTK, retention of traffic data, a functioning process for removal requests and court orders, and the imprint information. Documented notice-and-takedown workflows with legal escalation, clear community rules and contractual safeguards vis-à-vis users are advisable. Establishing these processes reduces not only the risk of fines but also the company's own civil liability from the moment of knowledge.

How can affected parties challenge blocking orders?

Decisions of the criminal judge of the peace can be challenged by objection to the next judge of the peace; administrative measures can be challenged before the administrative courts. After exhaustion of legal remedies, an individual application to the Constitutional Court is available, which in a series of decisions has classified blanket blocks of entire platforms and sweeping orders as violations of freedom of expression. For companies whose content or services are blocked – for instance by overbroad URL lists – swift, formal opposition is worthwhile; the deadlines are short, and the prospects of success depend substantially on the documentation of one's own legal position.

How does one proceed in practice against reputation-damaging online content?

A typical case: false allegations of alleged insolvency about a German company with a Turkish subsidiary appear on a complaints portal and on social media; customers and banks become nervous. The staged approach: first, the content is documented in an evidence-proof manner – screenshots with URL and time stamp, notarial determination or time-stamping services for key content, since content is frequently altered once proceedings begin. In parallel, the platform operator is requested to remove the content via its notification procedure; for social networks, the 48-hour deadline of the special regime runs. If this remains unsuccessful, the application to the criminal judge of the peace under Article 9 is filed within a few days – based on the falsity of the factual allegations and the violation of the company's personality rights, seeking removal and a URL block. Flanking measures include a criminal complaint for insult or endangerment of commercial credit and a civil damages action against identifiable authors. What matters is the dividing line: value judgements and permissible criticism must be tolerated; the procedure is promising against false factual allegations, abusive attacks and breaches of confidentiality. The judge's decision is regularly issued within days and implemented nationwide via the Association of Access Providers.

How does the law interact with copyright, trademark and data protection law?

Law No. 5651 stands alongside the subject-specific instruments: copyright infringements can additionally be pursued via the special FSEK procedure, counterfeit offers fought via the platforms' e-commerce notice-and-takedown mechanisms, and data protection violations reported to the Data Protection Authority. The choice of the right instrument – or their combination – depends on the content, the provider and the location of the server: against foreign providers without a Turkish presence, access blocking is often the only effective means; against domestic providers, removal and civil liability are preferable.

What are the most common mistakes in practice?

• Content is not documented in an evidence-proof manner before proceedings begin – after deletion, the basis for follow-on claims is missing.
• The Article 9 application is directed against criticism and value judgements instead of false factual allegations, and fails.
• The hosting notification to the BTK and the retention of traffic data are overlooked for the company's own platform offerings.
• Removal requests reach the wrong actor – only the access provider is addressed instead of the content provider.
• The deadlines of the special regime for social networks (48 hours, reporting duties) are missed for lack of an internal process.
• No or late objection is filed against overbroad blocks of the company's own services.

How does access blocking work in practice? An example and an assessment

In the judgment of the Istanbul Regional Court of Appeal (44th Civil Chamber, E. 2023/811, K. 2025/1494, judgment of 13 November 2025), the claimant argued that its trademarks, well known in Turkey and worldwide, were being used by the defendants without authorisation: through domains such as www...net and www...com, through social media accounts and with the designation "İstanbul ... Servisi" at their business premises, the defendants presented themselves as if they were connected with the claimant's trademarks, thereby creating the impression among consumers of an authorised service partner and generating unjustified revenues. The first-instance court upheld the claim and ordered the cessation of the trademark-infringing and unfair competitive acts, the confiscation of signs and advertising materials, and the access block.

Where the use of a trademark on websites, social media accounts or digital platforms – even combined with additions such as "independent service" – creates the impression of an authorised partner, an access block can be used to stop the retrieval of this content from Turkey; this protects the reputation of the brand and at the same time serves to prevent unfair competition. When clients approach us, we first examine the infringement in all its dimensions and secure the evidence carefully before applying for the block – because the courts grant access blocks only where the infringement is clearly presented and substantiated. Website content, social media posts, business signs and advertising materials are therefore documented and submitted to the file; the blocking application thus rests on a solid legal foundation, which effectively protects the client's rights and makes it easier for the courts to order the measure.

Conclusion

With the 24-hour expedited procedure of Article 9, the catalogue blocks and the special regime for social networks, Law No. 5651 provides a fast, sharp set of instruments – for companies at once a shield against unlawful online content and a programme of duties for their own digital offerings.

Operators of platforms with a Turkish dimension should set up the hosting notification, data retention and takedown processes cleanly; large networks cannot avoid representative appointment and a local compliance structure. When deploying the blocking instruments offensively, restraint is advised – constitutional review increasingly sets limits on excessive orders.

The IP/IT team at GEMS Schindhelm represents companies in the removal of unlawful online content and in blocking proceedings, advises platforms and hosting providers on their obligations under Law No. 5651, and supports social networks with representative appointment and compliance.