If online content violates your personality rights, the first step is usually to contact the content provider or social network provider directly. Article 9 of Law No. 5651, which allowed access bans for violations of personality rights, has been annulled by the Constitutional Court; the route today depends on the type of violation: for breaches of privacy, Article 9/A of Law No. 5651 remains available, while for defamation and reputational harm, interim injunctions before the civil courts come to the fore. In cybercrime cases such as account takeovers and card fraud, a prompt criminal complaint and preserving evidence are decisive.
IT and internet law in Turkey
IT law covers the legal relationships arising from the use of the internet, computer systems and digital technologies. It is not contained in a single law; the most frequently applied rules are:
- Law No. 5651: regulation of online publications and the obligations of content, hosting and social network providers
- Turkish Criminal Code No. 5237: cybercrimes (Art. 243–245), defamation, threats, violation of privacy, aggravated fraud
- Civil Code No. 4721 and Code of Obligations No. 6098: protection of personality rights and compensation
- Personal Data Protection Law No. 6698 (see our data protection guide)
- Law No. 6563 on the Regulation of Electronic Commerce
- Law No. 5846 on Intellectual and Artistic Works: copyright in software and digital content
Removing online content and access bans
The available remedies against content that is defamatory, false, exposes your private life or was shared without your consent depend on the type of violation.
Article 9 of Law No. 5651, which allowed access bans to be requested from criminal judgeships of peace for violations of personality rights, has been annulled by the Constitutional Court. Legislative work on a new regulation has been on the agenda. Check the legislation in force before making an application.
The main routes currently available are:
| Type of violation | Remedy | Legal basis |
|---|---|---|
| Any violation | Direct removal request to the content, hosting or social network provider | Law No. 5651; platform rules |
| Violation of privacy | Application to the criminal judgeship of peace for an access ban; administrative route in urgent cases | Law No. 5651, Art. 9/A |
| Violation of personality rights (defamation, reputational harm) | Civil court action to stop the attack and remove the content, with an interim injunction; compensation | Civil Code, Art. 24–25; TBK, Art. 49, 58 |
| Catalogue crimes (child sexual abuse, obscenity, gambling and others) | Access ban; reporting | Law No. 5651, Art. 8, 8/A |
| Intellectual property infringement | Notice by the right holder to the content provider; intellectual property courts | Law No. 5846; Law No. 6769 |
Social network providers with daily access from Turkey above a certain threshold must respond with reasons to applications concerning personality rights and privacy within a short statutory period (Law No. 5651, Add. Art. 4). A recorded application through the platform's reporting channel is therefore often the fastest first step.
An access ban is not the same as removal: an access ban technically blocks access to the content from Turkey, while the content may remain online at its source. Complete deletion requires action by the content provider.
The right to be forgotten
The right to be forgotten allows a person to request that old news and content about them be made inaccessible, or not associated with their name in search engine results, even if it was lawfully published at the time, because of the passage of time, the disappearance of public interest and the fact that the person is not a public figure. In Turkish law this right has been recognised in decisions of the Constitutional Court and the Court of Cassation, and is supported by the right to erasure of personal data.
Requests are assessed by weighing how old the content is, whether it still has news value, the person's public role and the harm caused. Direct applications to search engines and news sites and court proceedings should be considered together.
Defamation and threats on social media
Attacking a person's honour, dignity or reputation on social media, by attributing a specific act or by insults, is the crime of defamation (Criminal Code, Art. 125). Because social media posts are public, this can increase the penalty. Threats (Art. 106), blackmail (Art. 107), violation of privacy (Art. 134) and unlawful obtaining or dissemination of personal data (Art. 136) are also frequently committed online.
- Preserve evidenceSave screenshots, the URL, the username and the date and time. Since content may be deleted, having it recorded by a notary or expert strengthens its evidential value.
- Report to the platformUse the social network's reporting channel to request removal and keep a record of the application.
- Criminal complaintFile a complaint with the public prosecutor, directly or through the police. Defamation is prosecuted only on complaint, which must be made within six months of learning of the act and the perpetrator (Criminal Code, Art. 73).
- CompensationIndependently of the criminal process, an action for non-pecuniary damages for violation of personality rights can be brought before the civil court.
Identifying the author of posts from fake or anonymous accounts may be possible when the prosecutor requests information from platforms and internet service providers, which is why pursuing the matter through the prosecutor's office is important. General information on criminal procedure is available in our criminal law guide.
Cybercrime
| Crime | Example | Legal basis |
|---|---|---|
| Unauthorised access to an IT system | Logging into another person's email or social media account without permission | Criminal Code, Art. 243 |
| Blocking or disrupting a system, destroying or altering data | Ransomware, taking over an account by changing its password, deleting data | Art. 244 |
| Misuse of bank or credit cards | Unauthorised purchases with card details, producing counterfeit cards | Art. 245 |
| Aggravated fraud using IT systems | Obtaining money through fake websites, fake listings or phishing | Art. 158(1)(f) |
Most of these crimes are not dependent on a complaint; the prosecutor opens an investigation as soon as the crime becomes known. Because log records, IP addresses and bank transactions may be deleted or retention periods may expire, a criminal complaint should be filed promptly.
Online fraud: if money has been taken from your account
Obtaining bank details through fake text messages, emails or websites, and getting victims to send money through fake listings, are the most common forms of online fraud in Turkey. Time is critical:
- Call your bank immediately: block your cards and online banking, dispute the transaction and get a reference number for the dispute.
- File a criminal complaint: apply to the public prosecutor or the police, attaching the account details the money was sent to and the transaction receipts. The prosecutor may request measures on the recipient accounts.
- Keep the evidence: text messages, emails, website addresses, listing screenshots and bank transactions should not be deleted.
- Assess the bank's liability: banks must ensure the security of customer accounts and exercise due care against suspicious transactions. If the bank's security measures were deficient, the loss may be recoverable from the bank, taking into account the customer's own fault. Disputes with a bank that qualify as consumer transactions go to consumer arbitration committees or consumer courts (see our consumer law guide).
E-commerce rules
Businesses selling goods or services online in Turkey must comply with Law No. 6563 on the Regulation of Electronic Commerce and related regulations. The main obligations are:
- Information: the seller's name, contact details, tax information and the steps for concluding the contract must be clearly displayed on the website.
- Commercial electronic messages: marketing text messages and emails can generally be sent only with the recipient's prior consent, and consents are managed through the Message Management System (İYS) (Law No. 6563, Art. 6).
- Distance sales: pre-contractual information form, distance sales contract and the consumer's right of withdrawal.
- Personal data: privacy notice, explicit consent where required and a cookie policy.
- Intermediary service providers: marketplace platforms have additional obligations.
Software and IT contracts
Software development, licensing, SaaS, hosting and maintenance contracts form the commercial side of IT law. Disputes most often arise from:
- Vague technical specifications and acceptance tests
- Ownership of source code and intellectual property rights; scope and term of the licence
- Delivery schedule, delay and the consequences of defective delivery
- Service level commitments (SLA), outages and limitations of liability
- Data security, confidentiality and return of data at the end of the contract
- Source code escrow and what happens if the provider ceases operations
Software development contracts are generally subject to the rules on contracts for work in the Code of Obligations, while the software itself is protected as a work under Law No. 5846. General contract rules are explained in our contracts and obligations guide.
Competent authorities
| Dispute | Authority |
|---|---|
| Cybercrime, defamation, threats, fraud | Public prosecutor (investigation), criminal courts (trial) |
| Access ban for violation of privacy | Criminal judgeship of peace (Law No. 5651, Art. 9/A) |
| Protection of personality rights and non-pecuniary damages | Civil court of first instance |
| Software and IT contracts (commercial) | Commercial court (after mandatory mediation) |
| Copyright and trademark infringement | Intellectual property civil and criminal courts |
| Personal data violations | Personal Data Protection Board (administrative); courts (compensation) |
Key time limits
| Item | Period | Legal basis |
|---|---|---|
| Complaint for crimes prosecuted on complaint, such as defamation | 6 months from learning of the act and the perpetrator | Criminal Code, Art. 73 |
| Compensation for violation of personality rights | 2 years from learning; 10 years at the latest (longer if the act is a crime) | TBK, Art. 72 |
| Criminal complaint for cybercrime | Not dependent on complaint, but should be made immediately before evidence is lost | Criminal Code, Art. 243–245 |
Rules on online content have changed frequently in recent years through Constitutional Court decisions and legislative amendments. Check the legislation in force before making an application.
Documents and evidence
- Screenshots of the content, URLs, usernames and date and time information
- Any e-detection record made by a notary or expert
- Applications made to the platform and the responses received
- For fraud: bank receipts, account transactions, text messages and emails, the fake website address
- For account takeovers: account recovery records, login notifications and device information
- For contract disputes: the contract, technical specifications, delivery and acceptance records, correspondence
Relevant legislation
Turkish legislation is published (in Turkish) at mevzuat.gov.tr:
- Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed through such Publications
- Turkish Criminal Code No. 5237 — Art. 73, 106, 107, 125, 134, 136, 158, 243–245
- Turkish Civil Code No. 4721 — Art. 24–25
- Turkish Code of Obligations No. 6098 — Art. 49, 58, 470 et seq.
- Law No. 6563 on the Regulation of Electronic Commerce
- Personal Data Protection Law No. 6698
- Law No. 5846 on Intellectual and Artistic Works
IT and Internet Law: topics
The main topics within IT and internet law are listed below. Detailed guides for each are in preparation.
- Removing online content and access bans
- The right to be forgotten
- Defamation on social media
- Cybercrime
- Online fraud
- E-commerce law
- Software contracts
Frequently asked questions about IT and internet law in Turkey
How can I have defamatory content about me removed in Turkey?
Start with a direct removal request to the platform or website and keep a record of it. If that fails, depending on the type of violation, an access ban for privacy violations under Article 9/A of Law No. 5651, or a civil court action with an interim injunction for defamation, may be available. Since Article 9 was annulled, check the current legislation first.
Is an access ban the same as deleting the content?
No. An access ban blocks access to the content from Turkey, but the content may remain online at its source and be visible from other countries. Complete removal requires the content provider to delete it.
Can old news articles about me be removed?
Possibly, under the right to be forgotten. The age of the content, whether it still has news value, your public role and the harm caused are weighed. Applications can be made to search engines and news sites, and if necessary to the courts.
Someone is insulting me on social media from an anonymous account. What can I do?
Preserve the evidence (screenshots, URL, username, date and time) and file a criminal complaint with the public prosecutor within six months of learning of the act and the perpetrator. The prosecutor can request information from platforms and service providers to identify the account holder.
Money was taken from my bank account through a fake website. What should I do?
Call your bank immediately to block your cards and dispute the transaction, then file a criminal complaint with the prosecutor or police with the transaction details. Keep all messages and screenshots. Depending on the circumstances, the bank may be liable if its security measures were deficient.
Do I need consent to send marketing emails or text messages in Turkey?
Generally yes. Commercial electronic messages can be sent only with the recipient's prior consent, and consents must be registered in the Message Management System (İYS), subject to limited exceptions (Law No. 6563, Art. 6).
Who owns the source code of software developed for my company?
It depends on the contract. Software is protected as a work under copyright law, and the economic rights must be transferred in writing and specified individually. The development contract should state clearly who owns the source code and the intellectual property rights.
Is unauthorised access to someone's account a crime even if nothing was taken?
Yes. Unauthorised access to an IT system, such as another person's email or social media account, is a crime under Article 243 of the Criminal Code, regardless of whether data was taken or altered. Altering or deleting data is a separate, more serious crime.
This article is for general information only and does not constitute legal advice. Please consult a lawyer about your specific situation. Legislation and court practice change over time, so check the current legislation before taking any step. Last updated: 7 October 2026