Introduction
VoIP services in Turkey are an increasingly important part of the telecommunications and technology market. Businesses use VoIP for cloud PBX systems, call centers, SIP trunking, remote work communication, international calls, customer support lines, video meetings, softphones, mobile applications and unified communications. Individuals use VoIP through messaging applications, internet-based calling services, mobile apps and business communication platforms. As a result, the boundary between traditional telephone service, internet-based communication, software platforms and regulated electronic communications has become increasingly blurred.
VoIP stands for Voice over Internet Protocol. In simple terms, it allows voice communication to be transmitted through internet protocol networks rather than through traditional circuit-switched telephone networks. In commercial practice, VoIP may appear in many forms: app-to-app voice calls, calls from an app to ordinary phone numbers, cloud PBX, SIP trunking, virtual numbers, customer service platforms, enterprise voice systems, call center infrastructure and communication APIs.
Under Turkish law, the legal status of VoIP depends on the actual service model. A closed internal communication tool used only inside a company may raise different legal issues from a VoIP provider offering public calling, Turkish numbers, inbound and outbound call routing, SIP trunking or services substituting traditional fixed telephone service. Therefore, the key legal question is not simply whether the technology uses IP. The key question is whether the provider offers an electronic communications service, uses numbering resources, connects to public telecom networks, provides voice communication to end users or operates communication infrastructure.
The main legislation is Law No. 5809 on Electronic Communications. BTK states that electronic communications, electronic communications infrastructure, electronic communications service and electronic communications networks are functions that may be carried out by obtaining authorization from the Authority. BTK defines electronic communications broadly as the transmission, sending and reception of signs, symbols, sounds, images and data through transmission systems.
Legal Framework for VoIP Services in Turkey
VoIP services may be subject to several legal regimes at the same time. The most important framework is Turkish electronic communications law, especially Law No. 5809 and BTK authorization rules. Depending on the business model, VoIP services may also be affected by fixed telephone service regulation, numbering rules, interconnection rules, consumer protection law, personal data protection law, cybersecurity obligations, Law No. 5651, commercial electronic communication rules and contract law.
BTK’s authorization regime provides that companies wishing to provide electronic communications services or establish and operate networks or infrastructure must notify BTK before commencing operations. If the service does not require allocation of scarce resources such as numbers, frequencies or satellite positions, notification-based authorization may apply; if such resources are required, usage rights must be obtained.
This is highly relevant for VoIP because some VoIP services may operate purely as software, while others may require numbers, interconnection, call routing, network infrastructure or public telephone network integration. The legal classification must therefore be made according to the real technical and commercial structure.
VoIP as Technology vs. VoIP as Regulated Service
VoIP is a technology, but legal obligations arise from the service provided through that technology. A company may use VoIP internally for its employees without offering any communication service to third parties. In such a case, the regulatory analysis may be limited. However, when a company sells VoIP calling services, provides cloud telephone lines, assigns numbers, offers SIP trunking, routes calls to public networks, sells voice minutes or provides enterprise telephone services under its own brand, Turkish telecom regulation becomes more relevant.
For example, a software company that provides a video meeting tool may not necessarily be treated in the same way as a provider offering Turkish geographic numbers and outbound calls to the public telephone network. Similarly, a call center software provider that only supplies software may be different from a provider that also sells telephone connectivity and call routing.
The legal classification should examine:
Whether users can call ordinary phone numbers.
Whether ordinary phone numbers can call users.
Whether Turkish numbers are assigned or used.
Whether the provider controls call routing.
Whether the provider invoices customers for voice communication.
Whether the service is offered to the public.
Whether the service uses an authorized Turkish telecom operator.
Whether the provider operates network or switching infrastructure.
Whether the service substitutes fixed telephone service.
This functional analysis is essential because the same “VoIP” label may describe very different legal situations.
BTK Authorization and VoIP Licensing Risk
The most important licensing risk for VoIP providers in Turkey is unauthorized electronic communications activity. BTK’s official authorization materials state that electronic communications service means provision as a service of part or all of the activities falling within electronic communications, and that electronic communications network includes transmission systems and switching equipment used to provide electronic communications between points.
Therefore, a VoIP provider that provides voice transmission, call routing, public telephone access, number-based services or similar communication services may need to assess whether BTK authorization is required. This does not mean that every internet voice feature automatically requires authorization. However, any commercial VoIP model involving public calling, telephone numbers, fixed telephone substitution, SIP trunking or operator-level service provision should be legally reviewed before launch.
BTK applications are conducted through the CEVHER System. BTK’s CEVHER guidance states that applications for initial authorization, additional authorization, renewal, adequacy procedures and operator information updates are carried out through that system. It also states that applicant companies must generally be limited liability companies or joint-stock companies established for electronic communications activities and must meet articles of association, shareholder, management and paid-in capital requirements.
This means that VoIP licensing in Turkey is not only a technical question. It may require proper company formation, corporate purpose drafting, capital planning, management eligibility review, KEP address, application forms, number allocation forms and ongoing operator compliance.
Fixed Telephone Service and VoIP
Some VoIP services may overlap with fixed telephone services. This is particularly relevant where the provider offers a service that allows users to make or receive calls through ordinary telephone numbers. BTK’s CEVHER page specifically refers to the “STH Operators Information Addendum,” meaning Fixed Telephone Service operators have specific application documentation within the authorization framework.
VoIP providers should therefore examine whether their service falls within fixed telephone service, cloud PBX, SIP trunking, call termination, call origination, number-based communication or purely software-based communication. If the service allows customers to replace traditional telephone lines with a cloud-based voice service, the risk of telecom authorization is higher.
A business should not assume that “internet-based” means “unregulated.” A voice service may be IP-based and still function as a regulated telephone service. Turkish telecom law is technology-neutral in many respects: the legal issue is the communication service, not merely the protocol used.
OTT Communication Services and VoIP Applications
Many VoIP applications are provided as over-the-top communication services. These services are offered over internet access independently from the internet access provider. They may include app-to-app voice calls, video calls, messaging, group calls and other interpersonal communication tools.
Turkey has been developing a regulatory framework for “şebekeler üstü hizmet,” or OTT communication services. BTK’s 2025 public draft concerning OTT services defines such services as interpersonal electronic communications services within voice, written and visual communication, offered through publicly available software to subscribers and users with internet access, independently from operators or the internet service provided.
The same BTK draft proposed that certain OTT services below thresholds to be determined by BTK, or services where interpersonal communication is not the principal element, would be exempt from authorization. It also proposed that providers above the threshold would operate through fully authorized Turkish limited liability or joint-stock representatives and would be subject to notification-based authorization, fees, consumer protection, competition, network and information security, personal data protection, interoperability, sectoral data reporting and security incident reporting.
Because this source is a public draft, companies should verify the final regulatory status before relying on it. However, it clearly shows BTK’s regulatory direction: large-scale internet-based voice, messaging and visual communication services may face increasing regulatory obligations in Turkey.
Numbering and Virtual Numbers
Numbering is one of the most important issues in VoIP regulation. A VoIP service that works only between usernames inside an app may raise different issues from a service that provides geographic numbers, non-geographic numbers, 0850 numbers, virtual numbers or corporate call numbers.
If a VoIP provider uses Turkish numbers, number allocation rules and usage rights may become relevant. BTK’s CEVHER guidance includes a number allocation application form for numbers used in electronic communications networks.
Numbering affects several legal areas:
Subscriber identity.
Emergency calls.
Call routing.
Interconnection.
Billing.
Number portability.
Fraud prevention.
Official requests.
Customer complaints.
A provider offering Turkish numbers should define whether the numbers are directly allocated to the provider, supplied through an authorized operator or used under another lawful structure. The provider should also clarify who is responsible for number portability, customer identification, misuse prevention, termination and official requests.
Virtual numbers are commercially attractive, but they can create legal risk if they are sold without a clear authorization and numbering basis.
SIP Trunking and Cloud PBX
SIP trunking and cloud PBX are common business VoIP services. SIP trunking allows businesses to connect their PBX or communication platform to voice networks through IP-based connections. Cloud PBX allows businesses to use a hosted telephone system instead of maintaining physical PBX equipment.
These services may be regulated if the provider offers public voice communication, call routing, numbering or telecom connectivity. A pure software provider may not have the same obligations as a telecom operator, but a cloud PBX provider that sells voice minutes, numbers and call routing to customers should conduct a full BTK authorization analysis.
Cloud PBX contracts should explain:
Whether the provider is an authorized operator.
Which operator provides the telecom line.
Whether numbers are allocated directly or indirectly.
Who handles emergency calling.
Who handles number portability.
Who stores call records.
Who controls call recording.
Who is responsible for service outages.
Who responds to official requests.
Who processes personal data.
Who is liable for unauthorized use.
A generic SaaS agreement is usually insufficient for cloud PBX and SIP trunking. These services combine software, telecom, data protection, cybersecurity and service continuity.
Interconnection and Call Routing
VoIP services that connect with public telephone networks may require interconnection arrangements. Interconnection determines how calls pass between networks and operators. For regulated voice services, interconnection may affect call termination, call origination, wholesale charges, quality of service, routing, numbering and dispute resolution.
BTK’s electronic communication page includes access and interconnection regulations, interconnection fees, reference access and interconnection offers and conciliation mechanisms within the sectoral framework.
A VoIP provider should determine whether it directly interconnects with operators, uses a wholesale provider, relies on a host operator or provides only software. Commercial agreements with telecom operators should define technical interfaces, routing responsibilities, number usage, fraud prevention, call detail records, lawful requests, service levels, payment, traffic forecasts and termination.
Interconnection risk is particularly important for international VoIP providers. If international calls are routed into Turkey through unauthorized or non-transparent structures, regulatory, tax, fraud and quality issues may arise.
Emergency Calls and Public Safety
Where a VoIP service replaces ordinary telephone service, emergency call access may become an issue. Traditional telephone services are expected to support emergency communication and location-related functions. VoIP services, especially nomadic or app-based services, may not always know the user’s physical location.
VoIP providers should not ignore emergency call obligations. If the service is marketed as a telephone replacement, customers may reasonably expect emergency calling capability. The provider should disclose limitations clearly and comply with applicable telecom rules where emergency access obligations apply.
For enterprise VoIP, emergency planning is also important. A business using cloud PBX should know how employees can call emergency services during internet outages, power failures, remote work situations or system failures.
Consumer Protection and Subscriber Agreements
VoIP services offered to consumers are subject to consumer protection risks. Consumers must be informed clearly about service scope, price, limitations, cancellation, number use, internet dependency, equipment requirements, emergency call limitations, call quality, data use and complaint channels.
Misleading statements such as “unlimited calls,” “free international calling,” “no cancellation fee,” “works like a normal phone line” or “guaranteed call quality” may create disputes if the conditions are not clearly explained.
Important clauses in VoIP consumer contracts include:
Monthly fee.
Per-minute charges.
International call rates.
Number rental fee.
Device or adapter fee.
Internet connection requirement.
Call quality limitations.
Emergency call limitations.
Cancellation procedure.
Refund policy.
Number portability.
Data processing.
Call recording.
Customer support.
Complaint mechanism.
For business customers, consumer law may not directly apply, but transparency and contract clarity remain important. Poor drafting may lead to commercial litigation, unpaid invoices, service interruption disputes and damage claims.
KVKK and Personal Data Protection
VoIP services process significant personal data. This may include names, phone numbers, IP addresses, device identifiers, call detail records, customer account data, billing records, call recordings, voicemails, contact lists, location-related data, support tickets and authentication logs.
KVKK defines personal data as any information relating to an identified or identifiable natural person, and requires personal data to be processed lawfully, fairly, for specified and legitimate purposes, in a proportionate manner and only for the period required by law or the processing purpose.
VoIP providers must also consider data security. KVKK requires data controllers to take all necessary technical and organizational measures to prevent unlawful processing, prevent unlawful access and ensure protection of personal data. Where processing is carried out by another person on behalf of the controller, the controller is jointly responsible with that person for taking these measures.
For VoIP services, data protection compliance should include:
Privacy notices.
Data processing inventory.
Legal basis analysis.
Call recording notices.
Retention periods.
Data subject request procedure.
Vendor contracts.
Cross-border transfer review.
Access controls.
Encryption.
Breach response procedure.
Deletion and anonymization policy.
Call recordings deserve special attention because they may contain sensitive business information, financial data, identity data, health information, consumer complaints or confidential communications.
Cross-Border Data Transfers
Many VoIP services use global cloud infrastructure. Call records, account data, customer support tickets, recordings, voicemails, analytics and security logs may be stored or accessed abroad. This creates cross-border data transfer issues under KVKK.
KVKK Article 9 regulates transfers abroad. Under the amended framework, transfers may be made where processing conditions are met and there is an adequacy decision. In the absence of adequacy, transfers may rely on appropriate safeguards such as binding corporate rules, standard contracts or written commitments approved by the Board, subject to statutory conditions.
Foreign VoIP providers targeting Turkish users should therefore analyze:
Where user data is stored.
Where call records are processed.
Where recordings are kept.
Whether support teams outside Turkey access data.
Whether AI transcription tools process calls abroad.
Whether group companies access data.
Whether standard contracts or other safeguards are required.
It is risky to claim “local service” or “data stays in Turkey” unless the entire technical and operational structure supports that statement.
Call Recording and Monitoring
VoIP platforms often include call recording, transcription, call analytics, agent performance scoring and AI-supported quality control. These features create additional legal risks.
Users and employees should be informed where calls are recorded. In customer service contexts, callers should be notified before or at the beginning of the call. The purpose of recording should be clear. Retention periods should be defined. Access to recordings should be limited. Recordings should not be used for unrelated purposes unless a valid legal basis exists.
AI transcription and analytics raise further issues. If recorded calls are converted into text, analyzed for sentiment, used to train AI models or reviewed by third-party vendors, data protection obligations become more complex. Contracts should define whether customer content may be used for service improvement or AI training.
Cybersecurity and Network Security
VoIP systems are attractive targets for cyberattacks and fraud. Common risks include SIP credential theft, toll fraud, call spoofing, denial-of-service attacks, voicemail compromise, unauthorized call forwarding, account takeover, weak API security and exposed management panels.
If a VoIP provider is an authorized electronic communications operator, BTK network and information security obligations may apply. BTK states that Law No. 5809, privilege agreements and authorization regulations include network and information security obligations, and that the Regulation on Network and Information Security in the Electronic Communications Sector sets out procedures and principles operators must follow. Additional obligations may apply to operators holding specific authorization types, including fixed telephone service, if the relevant financial thresholds are met.
VoIP providers should implement:
Strong authentication.
SIP security controls.
Fraud detection.
Rate limiting.
Encryption.
Secure admin panels.
DDoS protection.
Call pattern monitoring.
Incident response.
Patch management.
Customer alerting.
API security.
Backup and recovery.
Cybersecurity is not only a technical matter. A major VoIP compromise may create customer claims, KVKK notifications, BTK scrutiny and reputational damage.
Law No. 5651 and VoIP Platforms
VoIP services may also intersect with Law No. 5651, especially where the provider hosts user content, stores voicemails, chat messages, call recordings, shared files, meeting recordings or other online materials. Law No. 5651 regulates content providers, hosting providers, access providers and public internet use providers.
A VoIP platform may be a hosting provider if it stores user-generated content or communication records. A public internet access provider offering VoIP in shared environments may also face access provider issues. Where the provider only offers internal software and does not host public content, Law No. 5651 may be less central, but it should still be reviewed.
VoIP providers should create procedures for lawful requests, abuse complaints, illegal use, content retention, evidence preservation and user account termination.
Fraud, Abuse and SIM/Number Misuse
VoIP systems are frequently misused for fraud, phishing, spoofing, robocalls, unauthorized marketing and international call bypass. Providers should build anti-abuse controls into their systems.
Risk areas include:
Fake caller ID.
Unauthorized mass calling.
Premium-rate abuse.
International toll fraud.
Phishing calls.
Customer impersonation.
Use of virtual numbers for fraud.
Account takeover.
Automated spam calls.
VoIP providers should verify business customers, monitor suspicious traffic, restrict high-risk destinations, set spending limits, maintain logs, investigate complaints and cooperate with lawful authorities. Business contracts should prohibit unlawful calls, fraud, harassment, spam and unauthorized marketing.
Commercial Electronic Communications
VoIP services may be used for automated calls, customer campaigns, sales calls and marketing communication. These activities may trigger commercial electronic communication rules. Businesses should not use VoIP platforms for unauthorized marketing calls or automated promotional campaigns without complying with applicable consent and opt-out requirements.
VoIP providers should include anti-spam and acceptable use rules in contracts. They should also require business customers to confirm that they have obtained required consents and comply with Turkish marketing rules.
Foreign VoIP Providers Targeting Turkey
Foreign VoIP providers may face Turkish legal obligations if they target Turkish users, offer Turkish-language services, use Turkish numbers, sell to Turkish businesses, connect with Turkish telecom networks, process Turkish user data or provide services that substitute telephone communication in Turkey.
Foreign providers should analyze:
Whether BTK authorization is required.
Whether OTT communication rules apply.
Whether a Turkish company or representative is needed.
Whether Turkish numbers are used.
Whether data is transferred abroad.
Whether Turkish consumer law applies.
Whether Law No. 5651 applies.
Whether contracts need Turkish-law adaptation.
Whether official request procedures are ready.
Compliance with EU, US or other foreign rules does not automatically satisfy Turkish telecom, data protection and internet law requirements.
Contracts for VoIP Services
A VoIP contract should be more detailed than an ordinary software agreement. The contract should reflect telecom, data protection, security and operational issues.
Important clauses include:
Service description.
Regulatory status.
Authorized operator involvement.
Number allocation and use.
Call routing.
Interconnection.
Emergency call limitations.
Call quality.
Service levels.
Equipment and software requirements.
Customer responsibilities.
Prohibited use.
Fraud prevention.
Call recording.
Personal data processing.
Cross-border transfers.
Security measures.
Official requests.
Suspension rights.
Termination.
Data export and deletion.
Liability limitation.
Regulatory change.
For enterprise customers, the contract should also cover service continuity, support response times, outage reporting, disaster recovery and migration of numbers after termination.
Practical Compliance Checklist for VoIP Providers in Turkey
A VoIP provider operating in or targeting Turkey should follow this checklist:
Classify the VoIP service technically and legally.
Determine whether the service is pure software, OTT communication, fixed telephone service or electronic communications service.
Check whether BTK authorization is required.
Review whether numbers are used or allocated.
Determine whether usage rights are necessary.
Review CEVHER application requirements.
Prepare a suitable Turkish company if authorization is needed.
Review paid-in capital and management eligibility.
Clarify the role of authorized telecom operators.
Prepare interconnection or wholesale agreements.
Draft consumer and business contracts.
Disclose emergency call limitations.
Prepare call recording notices.
Prepare KVKK privacy notices and data inventory.
Analyze cross-border data transfers.
Secure call records and recordings.
Implement anti-fraud controls.
Prepare Law No. 5651 procedures if hosting or access roles exist.
Create official request handling procedures.
Prepare cybersecurity and incident response plans.
Maintain audit-ready documentation.
Conclusion
VoIP services in Turkey require careful legal classification. VoIP is a technology, but the legal obligations depend on the service model. A closed internal voice tool may create limited telecom risk, while a public VoIP service offering Turkish numbers, outbound calling, inbound calling, SIP trunking, cloud PBX or fixed telephone substitution may trigger BTK authorization, numbering, interconnection, consumer protection, cybersecurity and data protection obligations.
Law No. 5809 and BTK authorization rules are central to the analysis. Companies that provide electronic communications services, networks or infrastructure must evaluate whether notification or usage rights are required before commencing operations. VoIP providers must also consider KVKK, Law No. 5651, call recording rules, cross-border data transfers, fraud prevention, commercial electronic communication rules and contract law.
The most important risk is misclassification. A company may describe itself as a software provider, but Turkish law may treat parts of its service as regulated electronic communications. Therefore, VoIP businesses should obtain a legal classification before launch, especially if they use numbers, connect to public telephone networks, sell voice minutes, provide SIP trunking or target Turkish users.
A compliant VoIP structure should combine telecom authorization analysis, clear customer contracts, lawful numbering arrangements, privacy documentation, secure infrastructure, anti-fraud controls, proper call recording procedures and audit-ready records. Companies that address these issues early will reduce regulatory risk and operate more sustainably in the Turkish communications market.
Frequently Asked Questions
Are VoIP services legal in Turkey?
Yes. VoIP services are legal in Turkey, but the provider must analyze whether the service requires BTK authorization or other compliance obligations depending on the business model.
Does every VoIP service require BTK authorization?
No. A purely internal or software-only VoIP feature may not require the same authorization as a public voice service. However, services involving public calling, Turkish numbers, SIP trunking, cloud PBX or electronic communications service provision should be reviewed carefully.
What is the main telecom law for VoIP in Turkey?
The main law is Law No. 5809 on Electronic Communications. BTK states that electronic communications services, networks and infrastructure may be carried out by obtaining authorization from the Authority.
What is the BTK authorization regime?
BTK authorization may be based on notification or usage rights. Companies wishing to provide electronic communications services or operate networks or infrastructure must notify BTK before commencing operations, and usage rights are required where scarce resources such as numbers, frequencies or satellite positions are needed.
Can a cloud PBX provider need authorization?
Yes. If the cloud PBX provider offers voice communication, numbers, call routing or public telephone network integration, BTK authorization may be relevant depending on the structure.
Are Turkish phone numbers important for VoIP regulation?
Yes. Use of Turkish numbers may trigger numbering and usage-right analysis. BTK’s CEVHER guidance includes number allocation application forms for numbers used in electronic communications networks.
Does KVKK apply to VoIP services?
Yes. VoIP providers process personal data such as phone numbers, IP addresses, call logs, recordings, billing records and customer account data. KVKK processing principles and security obligations apply.
Can VoIP call recordings be stored abroad?
Cross-border storage or access must comply with KVKK Article 9 transfer rules. Providers should review whether adequacy, standard contracts, binding corporate rules or other safeguards are needed.
Do VoIP providers have cybersecurity obligations?
Yes. All providers should implement security measures. Authorized operators may also fall under BTK network and information security rules depending on their authorization type and thresholds.
What is the biggest legal risk for VoIP providers in Turkey?
The biggest risk is offering a service that is legally considered electronic communications without obtaining the necessary BTK authorization or without complying with numbering, data protection, cybersecurity and consumer rules.
No Responses