Introduction
5G, Internet of Things and emerging technologies are transforming the Turkish telecommunications sector. Mobile networks are no longer used only for voice calls, SMS and ordinary internet access. They now support connected vehicles, smart factories, remote healthcare systems, smart agriculture, autonomous logistics, industrial sensors, cloud gaming, augmented reality, artificial intelligence applications, smart cities, public safety systems, energy management platforms and machine-to-machine communication.
This transformation creates new legal questions. Which companies need authorization from the Information and Communication Technologies Authority, known as BTK? How are 5G frequencies allocated? When does an IoT platform become an electronic communications service? Who is responsible for data protection in connected devices? What cybersecurity measures must telecom operators take? How should consumer rights be protected in services based on 5G, eSIM, smart devices and connected infrastructure?
The central legal framework is Law No. 5809 on Electronic Communications. Law No. 5809 covers regulation, authorization, inspection and reconciliation activities related to electronic communications services, devices and systems. BTK is the sectoral authority responsible for the supervision of electronic communications in Turkey and may impose sanctions where operators fail to comply with applicable rules.
As of 2026, 5G is no longer a purely theoretical issue for Turkey. BTK announced that the 5G authorization tender was completed on October 16, 2025, with three operators bidding for 11 frequency packages. The tender covered 700 MHz and 3.5 GHz bands, and BTK’s announcement stated that 5G service would start nationwide as of April 1, 2026.
The Legal Importance of 5G in Turkey
5G is legally important because it is not simply a faster version of 4G. It is the infrastructure layer for new digital services. High speed, low latency, wide device capacity and energy efficiency make 5G suitable for industrial IoT, connected vehicles, smart ports, smart factories, robotics, remote control systems, augmented reality, AI-supported infrastructure and public safety applications.
BTK’s 5G tender announcement described 5G as a strategic step for Turkey’s digital sovereignty, economic independence and national technological capacity. The announcement also stated that 5G’s high speed, low latency, wide connectivity capacity and energy efficiency would carry infrastructure, production power, industry, science and strategic capacity further.
For lawyers, investors and telecom operators, this means that 5G must be analyzed as a regulated infrastructure field. 5G services may involve spectrum rights, base station compliance, network security, consumer contracts, wholesale access, data protection, cybersecurity, domestic product obligations, administrative audits and sectoral sanctions.
A company that wants to build a business model around 5G should not limit its legal analysis to commercial contracts. It should also consider whether it needs BTK authorization, whether it uses scarce public resources, whether devices meet technical standards, whether data is processed lawfully and whether the service creates sector-specific cybersecurity risk.
BTK’s Role in 5G and Emerging Technologies
BTK is the main regulatory and supervisory authority in the Turkish telecommunications sector. BTK states that it regulates and supervises the telecommunications sector in Turkey and that it is Turkey’s first sectoral regulatory authority.
In the context of 5G and emerging technologies, BTK’s role includes authorization, spectrum management, technical regulation, equipment compliance, operator audits, market surveillance, consumer protection, cybersecurity coordination and administrative enforcement. BTK is also involved in international standardization work. The Authority states that it is a full member of the International Telecommunication Union and an observer member of the European Telecommunications Standards Institute, and that it coordinates Turkey’s relations with international telecommunications standards organizations.
This international dimension is important because 5G, IoT and connected technologies are not purely domestic. Devices, modules, chips, cloud platforms, roaming systems, network equipment and security standards are shaped by global technical frameworks. Turkish operators and technology companies must therefore consider both national law and international technical standards.
5G Authorization and Frequency Allocation
5G mobile services require spectrum. Spectrum is a scarce public resource and cannot be used freely by private companies. Under Turkish telecommunications law, electronic communications services and infrastructure may require authorization, and services requiring scarce resources such as frequency, numbering or satellite position may require usage rights.
BTK’s 5G tender announcement stated that a total of 400 MHz of frequency in the 700 MHz and 3.5 GHz bands was opened for operators, and that 11 separate frequency packages were offered in the tender. The same announcement reported that Turkcell, Türk Telekom and Vodafone acquired different frequency packages through the tender.
For operators, spectrum allocation is not merely a commercial asset. It creates legal obligations. Operators must use frequencies within the scope of allocation, comply with the National Frequency Plan, prevent harmful interference and follow BTK rules on spectrum management. BTK’s spectrum management principles state that operators must comply with frequency allocation and registration rules, the National Frequency Plan and relevant changes, and must take measures to prevent harmful electromagnetic interference.
Therefore, any 5G business model that depends on wireless connectivity must begin with a frequency and authorization analysis. Private networks, industrial 5G, smart factory systems, ports, airports, mining sites, energy facilities and campuses may all raise questions about whether the system uses licensed spectrum, unlicensed spectrum, operator-managed services or internal networks.
Authorization of 5G-Related Services
A company that provides electronic communications services or establishes and operates electronic communications networks or infrastructure may need BTK authorization. BTK’s CEVHER guidance states that applications for initial authorization, additional authorization, renewal and adequacy processes are conducted through BTK’s CEVHER System, and that operator information changes must also be notified through the system.
The same BTK guidance states that an applicant must generally be established as a limited liability company or joint-stock company for activities subject to authorization, and its articles of association must include electronic communications or telecommunications services and/or network or infrastructure operation within its field of activity. It also refers to minimum paid-in capital requirements determined by BTK, including TRY 2,500,000 for OKTH authorization and TRY 10,000,000 for other authorizations under the Board Decision dated March 10, 2026 and numbered 2026/DK-YED/71.
This is important for emerging technology companies. A startup may describe itself as an IoT provider, smart city platform, connected vehicle solution, industrial automation company, eSIM platform, cloud communications provider or private network integrator. However, if its activity includes electronic communications service provision, network operation, infrastructure operation, frequency use or connectivity resale, BTK authorization may become relevant.
Internet of Things under Turkish Telecommunications Law
The Internet of Things, or IoT, refers to networks of connected devices that collect, transmit and process data. IoT systems may include smart meters, connected cars, wearable devices, industrial sensors, agricultural monitoring devices, logistics trackers, smart home systems, smart city cameras, health devices, energy infrastructure and environmental monitoring systems.
From a legal perspective, IoT is not a single regulated category. It is a layered ecosystem. One company may manufacture the device. Another may provide SIM or eSIM connectivity. Another may operate the cloud platform. Another may process analytics. Another may provide the end-user service. Each actor may have a different legal role.
BTK’s materials on IoT-based smart cities describe IoT as a key building block for smart city solutions and note that sensors, cameras and tracking systems used within smart city applications are products of IoT technology.
The legal question is whether the IoT service includes regulated electronic communications activity. If a company merely manufactures a sensor, telecom authorization may not be necessary. If the company provides connectivity, operates a network, assigns SIMs, manages data transmission or offers public communication service, Law No. 5809 and BTK authorization rules may apply.
Machine-to-Machine Communication and M2M Services
Machine-to-machine communication, or M2M, is closely connected to IoT. M2M communication allows devices to communicate automatically without direct human intervention. Examples include vehicle telematics, smart meters, industrial automation systems, remote monitoring devices, agricultural sensors and logistics trackers.
M2M services often rely on mobile networks, fixed networks, satellite systems, low-power wide-area networks or private wireless systems. Therefore, the legal analysis depends on the communication layer used.
BTK’s 5G tender announcement expressly connected 5G with machine-to-machine communication and IoT applications, stating that the electronic communications sector will become the foundational infrastructure for machine-to-machine communication, artificial intelligence, augmented reality, autonomous systems and robot technologies.
In practice, companies providing M2M solutions should analyze whether they are acting as telecom operators, resellers, platform providers, device sellers, data processors or software providers. A fleet tracking company, for example, may purchase connectivity from a mobile operator and provide software to customers. A different company may operate its own network or provide connectivity directly. These two models may have different legal consequences.
Private 5G Networks and Industrial Applications
Private 5G networks are one of the most important emerging legal issues. Factories, ports, airports, hospitals, universities, mines, logistics centers and energy facilities may want dedicated wireless networks for low-latency, secure and high-capacity industrial use.
The legal classification of a private 5G network depends on technical and commercial details. If the network is built and operated by an authorized mobile operator for a corporate customer, the customer may be receiving a managed telecom service. If the customer or a third-party integrator establishes and operates radio systems, spectrum and authorization questions arise. If the network is purely internal, non-commercial and limited to property under the user’s own control, different exceptions may need to be assessed.
Private network contracts should regulate service availability, cybersecurity, data ownership, lawful interception and official request handling, device management, SIM/eSIM control, vendor access, maintenance windows, liability for outages, intellectual property and termination. Industrial 5G is not just a connectivity contract; it is often part of critical operational infrastructure.
eSIM and Remote SIM Provisioning
eSIM technology is another emerging telecom issue. It allows mobile connectivity profiles to be embedded and managed remotely without a traditional physical SIM card. eSIM is important for smartphones, smart watches, connected vehicles, logistics devices, industrial IoT and cross-border device management.
Legally, eSIM creates questions about identity verification, subscriber registration, device activation, remote provisioning, cross-border service models, fraud prevention and consumer rights. If a foreign IoT provider supplies eSIM-based connectivity for devices located in Turkey, it must consider whether Turkish telecom authorization, data protection and consumer rules apply.
eSIM also increases the importance of cybersecurity. Unauthorized profile activation, SIM swap fraud, weak identity verification or compromised remote provisioning platforms may create serious harm. Operators and eSIM service providers should maintain strong authentication, audit logs, fraud detection and subscriber verification procedures.
Connected Vehicles and Automotive Telecommunications
Connected vehicles are one of the most important use cases for 5G and IoT. Modern vehicles may include emergency call functions, navigation, entertainment systems, remote diagnostics, software updates, fleet tracking, vehicle-to-infrastructure communication and autonomous driving features.
A connected vehicle ecosystem may involve car manufacturers, mobile operators, eSIM providers, cloud platforms, mapping providers, insurers, fleet companies, repair services and public authorities. This creates complex legal responsibilities.
The key questions include who provides connectivity, who controls the subscriber relationship, who processes location data, who owns vehicle-generated data, where cloud services are hosted, whether emergency communication functions comply with Turkish rules and whether personal data is transferred abroad.
Because connected vehicles process location data and driving behavior, KVKK compliance is crucial. Drivers and vehicle owners should be informed clearly about data processing purposes, data recipients, retention periods and data subject rights.
Smart Cities and Public Infrastructure
Smart city applications may include connected cameras, traffic sensors, smart parking systems, smart lighting, environmental sensors, water management, waste collection, public Wi-Fi, emergency response systems and intelligent transportation.
These projects often involve municipalities, telecom operators, software vendors, cloud providers, hardware manufacturers and public institutions. Legal risks include procurement law, data protection, cybersecurity, public-private partnership contracts, surveillance concerns, infrastructure access, right of way and service continuity.
IoT-based smart city projects must be designed with privacy and security by default. A smart city camera system, for example, may process personal data. A traffic sensor system may generate location-related information. A public Wi-Fi system may involve traffic data obligations. A city-wide sensor network may become critical infrastructure.
Therefore, smart city contracts should define data controllership, data processing purposes, security standards, breach notification, access rights, public authority responsibilities, vendor liability and deletion obligations.
Technical Standards and Equipment Compliance
5G and IoT services require compliant devices and network equipment. Base stations, antennas, radio modules, IoT sensors, routers, gateways, eSIM modules, modems and industrial wireless systems may be subject to technical regulation.
BTK states that Law No. 5809 covers regulation, authorization, inspection and reconciliation activities related to electronic communications devices and systems, and that non-compliant radio equipment may pose risks to health and safety. BTK also notes that the Radio Equipment Directive was transposed into Turkish law through the Radio Equipment Regulation published in the Official Gazette dated November 5, 2020.
For 5G and IoT investors, this means that imported or locally manufactured devices should be checked for conformity. Technical files, CE marking, radio equipment compliance, electromagnetic compatibility, cybersecurity capabilities, software update mechanisms and product safety rules should be reviewed before market launch.
Base Stations, Security Certificates and Electromagnetic Limits
5G deployment requires base stations and radio equipment. BTK states that, under Law No. 5809, it has authority to regulate the criteria for establishing base stations. It also states that base stations must be established and operated under the Electronic Communications Devices Security Certificate Regulation, and that the Security Certificate certifies that a base station is established, operated and functioning in accordance with applicable regulation.
BTK also explains that electromagnetic field strength values of electronic communications devices falling within the scope of the regulation are measured and inspected by the Authority, and that measurements may be conducted by institutions authorized by BTK and transmitted to BTK’s database through the Measurement Tracking System.
This is legally important because 5G deployment may face local objections concerning health, environment, urban planning or property use. Operators should ensure that base station installations are properly licensed, measured, documented and compliant with technical limits.
Cybersecurity Obligations for 5G and IoT
5G and IoT increase cybersecurity risk because they connect millions of devices and critical systems. A weak IoT device may become part of a botnet. A compromised industrial sensor may disrupt production. A hacked connected vehicle platform may endanger safety. A DDoS attack against a 5G network may affect businesses and public services.
BTK states that, under the Network and Information Security Regulation in the Electronic Communications Sector, operators are required to take measures against cyberattacks, establish Corporate CSIRT structures and operate in coordination with the Sectoral CSIRT, and take necessary measures in coordination with USOM against DoS/DDoS attacks, malware propagation and similar attacks.
This is especially important for emerging technologies. Traditional telecom networks served phones and computers; 5G networks serve vehicles, sensors, factories, hospitals and energy systems. Cybersecurity controls should therefore include device authentication, network segmentation, secure firmware updates, vulnerability management, encryption, incident response, DDoS mitigation, vendor security and continuous monitoring.
Personal Data Protection in 5G and IoT Services
5G and IoT services often process personal data. Connected devices may collect identity data, location data, device identifiers, behavioral data, biometric-related signals, health-related data, vehicle data, energy consumption data and communication metadata.
Under KVKK, personal data must be processed lawfully and fairly, be accurate and kept up to date where necessary, be processed for specified, explicit and legitimate purposes, be relevant, limited and proportionate, and be stored only for the period required by law or by the purpose of processing.
Data security is also a legal obligation. KVKK guidance states that data controllers must take all necessary technical and organizational measures to provide an appropriate level of security, prevent unlawful processing, prevent unlawful access and ensure protection of personal data.
For IoT businesses, privacy compliance should not be added after the product is launched. It must be embedded into product design. Devices should collect only necessary data. Users should receive clear privacy notices. Consent should be obtained where required. Data retention periods should be defined. Cross-border transfers should be analyzed. Security updates should be maintained throughout the device lifecycle.
Consumer Rights in 5G and Emerging Services
Consumers using 5G, eSIM, smart home devices, wearable devices, connected vehicles or IoT subscriptions must be protected against misleading advertising, unfair invoices, hidden fees, poor service quality, unauthorized data processing and unclear cancellation terms.
A 5G advertisement should not mislead consumers about coverage, speed, device compatibility or tariff conditions. If 5G coverage is limited to certain regions, if a compatible device is required, or if the service depends on network availability, these conditions should be disclosed clearly.
IoT consumer products also raise service-continuity questions. For example, if a smart home device requires a paid cloud subscription to function, the consumer should be informed. If a connected vehicle feature depends on a mobile subscription, the contract should explain the duration, fee, cancellation and data processing terms.
Consumer protection will become more important as telecom services become bundled with devices, apps, cloud platforms and subscriptions.
Liability in IoT and Connected Technology Ecosystems
Emerging technologies usually involve multiple parties. A smart health device may involve a manufacturer, telecom operator, cloud provider, app developer, hospital and analytics provider. A connected vehicle may involve an automaker, SIM provider, mobile operator, software vendor and insurer. When something goes wrong, determining liability may be difficult.
Liability may arise from defective devices, service interruption, weak cybersecurity, unlawful data processing, misleading information, delayed software updates, failure to warn users, breach of contract or failure to comply with regulatory obligations.
Contracts should clearly allocate responsibilities. Who is responsible for device security? Who handles breach notification? Who responds to data subject requests? Who maintains firmware updates? Who pays for telecom service interruption? Who is liable if the cloud platform fails? Who handles official requests from public authorities?
Without clear contracts, disputes may become complex and expensive.
Competition and Infrastructure Issues
5G and IoT may also raise competition-law and infrastructure-access questions. Operators holding valuable spectrum and infrastructure may have significant market power in certain service areas. IoT platforms may become dependent on a small number of mobile network operators. Private network providers may need access to infrastructure. Smart city projects may create long-term exclusivity concerns.
BTK supervision and competition principles may become relevant where access, interconnection, wholesale services, facility sharing or discriminatory treatment affects market entry. Investors should review exclusivity clauses, wholesale connectivity agreements, roaming arrangements, infrastructure-sharing contracts and vertical integration risks.
Foreign Investors and Emerging Technologies in Turkey
Foreign investors entering Turkey’s 5G, IoT or emerging technology market should conduct regulatory due diligence before launch. A foreign company may need to establish a Turkish entity, obtain BTK authorization, partner with an authorized operator, comply with data protection law, review cross-border transfers, ensure device conformity and prepare cybersecurity documentation.
Important due diligence questions include:
Does the service involve electronic communications?
Is BTK authorization required?
Does the service use licensed spectrum?
Is connectivity provided by an authorized Turkish operator?
Are devices compliant with Turkish technical rules?
Is personal data processed in Turkey?
Are location or traffic data involved?
Is data transferred abroad?
Who is the data controller?
Are cybersecurity obligations documented?
Are consumer terms clear?
Are public-sector procurement rules involved?
Foreign investors should not assume that a model valid in the EU, US or Gulf region can be launched in Turkey without local adaptation.
Practical Compliance Checklist
A company working with 5G, IoT or emerging telecom technologies in Turkey should follow this checklist:
Classify the service legally and technically.
Determine whether Law No. 5809 applies.
Check whether BTK authorization is required.
Analyze spectrum, numbering or satellite resource use.
Verify whether connectivity is provided by an authorized operator.
Review CEVHER, corporate form and capital requirements where authorization is needed.
Check device conformity and radio equipment rules.
Review base station or radio system permit requirements.
Prepare cybersecurity measures and incident response procedures.
Apply privacy-by-design and security-by-design principles.
Prepare KVKK privacy notices, data inventories and consent mechanisms.
Assess cross-border data transfers.
Define controller and processor roles in contracts.
Review consumer terms, tariffs, cancellation and service quality promises.
Prepare vendor and subcontractor agreements.
Document service continuity and liability rules.
Monitor BTK, KVKK and cybersecurity authority guidance.
Conclusion
5G, IoT and emerging technologies are reshaping Turkish telecommunications law. The sector is moving beyond traditional mobile and internet services into connected vehicles, smart cities, industrial networks, autonomous systems, AI-supported services, eSIM connectivity, public infrastructure and machine-to-machine communication.
The main legal framework remains Law No. 5809, BTK authorization rules, spectrum management, technical standards, cybersecurity obligations, data protection law and consumer protection principles. However, the practical application of these rules is becoming more complex because emerging technologies combine telecommunications, software, cloud services, devices, artificial intelligence, sensors and data analytics.
For operators, the key issue is compliance readiness. For investors, the key issue is regulatory due diligence. For technology companies, the key issue is correct classification of the business model. For consumers, the key issue is transparency, privacy and service quality.
Companies that build their 5G and IoT services with legal compliance from the beginning will reduce regulatory risk, protect users, strengthen trust and create a more sustainable position in Turkey’s digital economy.
Frequently Asked Questions
What law regulates 5G and IoT services in Turkey?
The main law is Law No. 5809 on Electronic Communications. Depending on the business model, KVKK, consumer protection law, cybersecurity rules, technical equipment regulations and Law No. 5651 may also apply.
Does a 5G service require BTK authorization?
Yes, if the service involves electronic communications service provision, network operation, infrastructure operation or frequency use, BTK authorization and possibly usage rights may be required.
Which frequency bands were used in Turkey’s 5G tender?
BTK announced that the 5G tender opened 400 MHz of frequency in the 700 MHz and 3.5 GHz bands, divided into 11 frequency packages.
When did nationwide 5G service start in Turkey?
BTK’s 5G tender announcement stated that 5G service would start nationwide as of April 1, 2026.
Are IoT companies always telecom operators?
No. An IoT company may be a device manufacturer, software provider, cloud platform or data analytics provider. However, if it provides connectivity, operates a network or offers electronic communications services, BTK authorization may become relevant.
Are connected vehicle services regulated?
Connected vehicle services may involve telecom, data protection, cybersecurity, consumer law and product liability issues. If connectivity is provided in Turkey, the service model should be reviewed under Turkish telecommunications law.
Is personal data protection important for IoT services?
Yes. IoT services may process location data, device identifiers, user behavior, health-related data, vehicle data or household data. KVKK compliance is essential.
Are 5G base stations subject to technical regulation?
Yes. BTK states that base stations must be established and operated under the relevant security certificate regulation, and electromagnetic field values are measured and inspected.
What are the main cybersecurity risks in IoT?
Main risks include weak device authentication, insecure firmware, botnets, DDoS attacks, unauthorized access, data leakage, cloud compromise and lack of security updates.
What should foreign investors check before launching 5G or IoT services in Turkey?
They should check BTK authorization, spectrum use, local operator partnerships, device conformity, data protection, cybersecurity, consumer contracts, cross-border data transfers and sector-specific regulatory obligations.
No Responses