Internet Service Provider Regulations in Turkey

Introduction

Internet Service Provider regulations in Turkey are among the most important parts of Turkish telecommunications and internet law. As internet access has become essential for individuals, businesses, public institutions, e-commerce platforms, financial services, education, healthcare, logistics, and digital communication, Internet Service Providers, commonly referred to as ISPs, operate in a highly regulated legal environment.

In Turkey, ISPs are not ordinary commercial service providers. They are part of the electronic communications ecosystem and are subject to authorization, technical, administrative, consumer protection, data protection, cybersecurity, and internet law obligations. Companies that wish to provide internet access services, broadband connectivity, fiber internet, wireless internet, corporate internet lines, fixed internet services, or related network services must carefully assess whether they require authorization from the Information and Communication Technologies Authority, known in Turkish as Bilgi Teknolojileri ve İletişim Kurumu, or BTK.

The main legal framework governing ISP regulations in Turkey is Law No. 5809 on Electronic Communications. This law aims to establish effective competition, protect consumer rights, expand electronic communications services, ensure efficient use of resources, and encourage technological development and investment in communications infrastructure. In addition, Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications is directly relevant to ISPs because it regulates the obligations and responsibilities of content providers, hosting providers, access providers, and public internet use providers.

For domestic and foreign investors, understanding ISP regulations in Turkey is essential before entering the market. Operating without proper authorization, failing to comply with access-blocking decisions, ignoring consumer rights, mishandling subscriber data, or neglecting network security may result in administrative sanctions, civil liability, data protection penalties, reputational damage, and in some cases criminal law risks.

What Is an Internet Service Provider under Turkish Law?

An Internet Service Provider is generally a company that enables users to access the internet through electronic communications networks. In practice, ISPs may provide fixed broadband, fiber internet, wireless broadband, corporate internet access, leased lines, wholesale internet access, Wi-Fi connectivity, and other forms of data transmission services.

Under Turkish law, ISP activities are closely connected to the concept of “electronic communications.” BTK explains that electronic communications include the transmission, sending, and reception of signs, symbols, sounds, images, and data that can be converted into electrical signals through cable, radio, optical, electrical, magnetic, electromagnetic, electrochemical, electromechanical, or other transmission systems. This broad definition means that internet access services generally fall within the electronic communications regulatory framework.

BTK also states that electronic communications service means the provision as a service of part or all of the activities falling within the definition of electronic communications. Electronic communications infrastructure includes network elements, switching equipment, hardware, software, terminals, lines, related facilities, and integral parts used for electronic communications.

Therefore, a company that provides internet access to end users, operates internet infrastructure, leases network capacity, or provides connectivity services to third parties may be treated as an operator under Turkish electronic communications law. The legal classification depends on the technical and commercial structure of the business model.

Main Legal Framework for ISPs in Turkey

The regulatory framework for Internet Service Providers in Turkey is based on several legal sources. The most important legislation is Law No. 5809 on Electronic Communications. This law governs electronic communications services, networks, infrastructure, authorization, consumer rights, tariffs, competition, numbering, spectrum, inspection, and administrative sanctions.

Law No. 5651 is also highly important for ISPs. It regulates the responsibilities of internet actors such as content providers, hosting providers, access providers, and public internet use providers. Its purpose is to determine the obligations and liabilities of these actors and to regulate procedures for combating certain crimes committed through internet publications.

In addition, ISPs must comply with Law No. 6698 on the Protection of Personal Data. The purpose of Law No. 6698 is to protect fundamental rights and freedoms, especially the right to privacy, with respect to the processing of personal data and to regulate obligations, principles, and procedures applicable to persons who process personal data.

BTK regulations, consumer protection legislation, network and information security rules, cybersecurity obligations, commercial electronic communication rules, and administrative court practice may also become relevant. For this reason, ISP compliance in Turkey requires a multi-layered legal analysis rather than a single licensing review.

The Role of BTK in ISP Regulation

BTK is the main regulatory and supervisory authority for electronic communications in Turkey. It is responsible for authorization, inspection, consumer protection, market regulation, network security, numbering, spectrum, tariffs, technical standards, and sanctions.

BTK’s authorization regime is central for ISPs. According to BTK, companies wishing to provide electronic communications services or establish and operate electronic communications networks or infrastructure must notify the Authority before commencing operations. If the service does not require allocation of resources such as numbers, frequencies, or satellite positions, authorization may be completed through notification. If resource allocation is required, the company must obtain usage rights from BTK.

This rule is particularly important for internet service providers because many ISP business models involve electronic communications services and network infrastructure. A company cannot simply start selling internet access in Turkey as an ordinary commercial service. It must first determine whether its activity requires BTK authorization and, if necessary, complete the relevant authorization process.

BTK also plays an important role in consumer protection. Law No. 5809 gives BTK duties regarding equal access to services, protection of consumers and end users, transparency and information, subscription agreements, processing of personal data and protection of privacy, and service quality.

ISP Authorization and Licensing in Turkey

In international terminology, investors often refer to “ISP license in Turkey.” Under Turkish law, however, the more accurate term is usually “authorization.” ISP authorization is the legal process through which a company becomes entitled to provide internet service provision activities under the supervision of BTK.

Before applying, the company must determine the exact nature of its service. The following questions are important:

Does the company provide internet access to end users?

Does it operate fiber, wireless, satellite, or fixed infrastructure?

Does it provide connectivity to corporate customers?

Does it resell internet access obtained from another operator?

Does it operate public Wi-Fi or hotspot services?

Does it provide access services to third parties?

Does it use frequencies, numbering, or other scarce resources?

Does it only provide software, or does it also provide electronic communications functionality?

The answer to these questions determines whether BTK authorization is required and which category applies. The authorization process may also require corporate documents, articles of association, technical descriptions, service model explanations, capital compliance, shareholder information, and other documents requested by BTK.

For foreign investors, it is generally necessary to establish a Turkish company or structure the investment in a way that complies with Turkish electronic communications rules. The company’s articles of association must be aligned with the intended regulated activity. A broad and unrelated commercial purpose may create problems during the authorization process.

Access Provider Status under Law No. 5651

ISPs are also relevant under Law No. 5651 because they may qualify as access providers. Under the Turkish internet law framework, an access provider enables users to access the internet. This status creates specific obligations regarding access-blocking decisions, traffic information, cooperation with authorities, and compliance with procedures established by law.

Law No. 5651 distinguishes between content providers, hosting providers, access providers, and public internet use providers. This distinction is legally significant because each actor has different responsibilities. A content provider is generally responsible for the content it creates or provides. A hosting provider provides or operates systems that host services and content. An access provider enables access to internet services.

For ISPs, access provider status is particularly sensitive because access providers may be required to implement access-blocking decisions issued by competent authorities. They may also have obligations regarding traffic data retention, confidentiality, accuracy, and cooperation with relevant authorities within the limits of the law.

Therefore, an ISP in Turkey must not only comply with BTK authorization rules but also develop internal procedures for Law No. 5651 compliance. These procedures should include receiving official decisions, verifying the scope of access-blocking orders, implementing technical measures, documenting compliance, preserving records, and responding to official requests lawfully.

Access Blocking and Content-Related Obligations

One of the most discussed aspects of internet regulation in Turkey is access blocking. Access-blocking decisions may be issued in relation to certain unlawful content, protection of personal rights, privacy violations, or certain offenses regulated under Law No. 5651.

ISPs do not generally create the content accessed by users. However, as access providers, they may be technically responsible for implementing lawful access-blocking decisions. This means that ISPs must have technical systems and legal procedures to process official orders correctly and within required timeframes.

A strong ISP compliance system should include:

A designated legal compliance unit for official requests.

A technical team capable of implementing URL, domain, IP, or other forms of access restriction where legally required.

An internal record-keeping system showing when the decision was received, how it was interpreted, what technical measure was taken, and when compliance was completed.

A procedure for challenging unclear, unlawful, excessive, or technically impossible decisions before the competent authority or court.

Access-blocking compliance is a sensitive issue because it may affect freedom of expression, privacy, public order, criminal investigations, and the rights of users. Therefore, ISPs should not treat such decisions as purely technical tickets. Each decision must be reviewed legally and technically.

Traffic Data and Record-Keeping Obligations

Traffic data is one of the most sensitive areas of ISP regulation. Internet access services naturally involve technical records such as IP address allocation, connection logs, subscriber identifiers, timestamps, session information, and routing-related data. These records may be required for network management, billing, security, legal compliance, and official investigations.

Under Law No. 5651 and related secondary regulations, access providers and hosting providers may have obligations to retain certain traffic information for legally specified periods and to ensure its accuracy, integrity, and confidentiality. Legal commentary and translations of Law No. 5651 also emphasize that hosting providers must keep traffic information for a period determined by regulation and ensure the accuracy, integrity, and privacy of such information.

For ISPs, traffic data compliance must be carefully balanced with data protection law. Retaining logs may be legally required, but excessive, unlawful, insecure, or indefinite retention may create data protection risks. Therefore, ISPs should define clear data retention periods, legal bases, access controls, encryption standards, deletion procedures, and audit mechanisms.

The company should also ensure that only authorized personnel can access traffic data. Internal misuse of subscriber logs, disclosure of IP allocation data to unauthorized persons, or insecure storage of logs may lead to serious legal consequences.

Data Protection and Subscriber Privacy

ISPs process large amounts of personal data. Subscriber names, addresses, Turkish identity numbers, passport numbers, phone numbers, e-mail addresses, IP addresses, modem information, billing records, payment details, customer service records, location-related information, traffic data, and complaint records may all qualify as personal data.

Because of this, ISPs must comply with Law No. 6698 on the Protection of Personal Data. Data protection compliance requires more than a standard privacy policy. ISPs must establish a complete data governance framework covering privacy notices, lawful processing grounds, explicit consent where necessary, data minimization, data security, retention and deletion, vendor management, cross-border transfers, and data subject rights.

ISPs should pay special attention to the following issues:

Subscriber identity verification.

Secure storage of contracts and identity documents.

Lawful processing of traffic data.

Protection of IP address logs.

Access control for customer service personnel.

Secure billing systems.

Vendor and subcontractor agreements.

Data breach response procedures.

Cross-border data transfer rules.

Deletion or anonymization after expiry of retention obligations.

Data breaches in the ISP sector can be particularly damaging. A leak of subscriber information, IP logs, billing records, or traffic data can expose users to privacy risks and may trigger regulatory investigations, administrative fines, compensation claims, and reputational damage.

Network and Information Security Obligations

Network and information security is another core obligation for ISPs in Turkey. BTK states that Law No. 5809, authorization regulations, privilege agreements, and the Regulation on Network and Information Security in the Electronic Communications Sector include obligations related to network and information security. BTK further explains that this regulation sets out procedures and principles that operators must comply with to ensure network and information security.

BTK also notes that certain network and information security obligations apply to all operators, while additional obligations apply to operators holding specific authorization types, including internet service provision, infrastructure operation, fixed telephone service, virtual mobile network service, satellite communication service, and other listed services, depending on criteria such as annual net sales.

For ISPs, network security is not merely an IT concern. It is a legal compliance obligation. ISPs must protect their networks from unauthorized access, cyberattacks, service disruption, denial-of-service attacks, malware, routing manipulation, insider threats, and data breaches.

A robust ISP security program should include risk assessment, penetration testing, network monitoring, incident response planning, encryption, access management, vulnerability management, vendor security controls, business continuity planning, disaster recovery procedures, and employee training.

Consumer Rights in Internet Services

Consumer protection is one of the most important areas of ISP regulation in Turkey. Internet subscribers frequently face disputes involving low speed, service interruptions, modem fees, installation delays, unfair invoices, cancellation fees, automatic renewal, misleading campaigns, and difficulties in terminating subscriptions.

BTK has regulatory duties concerning transparency, subscription agreements, service quality, protection of personal data and privacy, and consumer rights in the electronic communications sector. Therefore, ISPs must prepare customer-facing documents carefully.

Subscription agreements should clearly explain the type of internet service, advertised speed, expected speed range, infrastructure limitations, installation fees, modem or device fees, commitment period, cancellation conditions, tariff details, taxes, additional charges, complaint channels, and consumer rights.

Advertising language must also be accurate. Expressions such as “unlimited internet,” “fiber speed,” “no commitment,” “free modem,” “no cancellation fee,” or “high-speed internet” must not mislead consumers. If the service is subject to technical limitations, fair usage conditions, infrastructure restrictions, or additional costs, these must be disclosed clearly.

Internet Speed, Service Quality and Infrastructure Limitations

Internet speed disputes are common in Turkey. A subscriber may claim that the ISP promised a certain speed but delivered a much lower connection speed. In such disputes, the legal analysis usually depends on the wording of the subscription agreement, campaign documents, technical feasibility, infrastructure conditions, speed test results, and service quality obligations.

ISPs should avoid making absolute speed promises unless the network can support them reliably. Where speeds depend on distance, infrastructure, modem quality, building wiring, network congestion, or technical conditions, these limitations should be explained transparently.

From a compliance perspective, ISPs should maintain technical records of connection quality, outage history, repair requests, customer complaints, and network performance. These records may be necessary in disputes before BTK, consumer arbitration committees, consumer courts, or administrative authorities.

Infrastructure limitations should not be used as a blanket excuse. If the ISP sold a service despite knowing that the infrastructure could not support the promised performance, the consumer may have legal remedies. Therefore, pre-sale availability checks and accurate information are essential.

Billing, Tariffs and Cancellation Fees

Billing transparency is a key legal requirement for ISPs. Subscribers must know what they are paying for, how the tariff is calculated, which taxes and fees apply, whether there is a commitment period, and what amount may be charged if they terminate the contract early.

Unfair or unclear cancellation fees are among the most common consumer complaints. ISPs may offer discounted tariffs in return for a commitment period, but the financial consequences of early termination must be lawful, transparent, and proportionate. The consumer should be informed before entering the agreement.

ISPs should also ensure that services not requested by the consumer are not added to invoices. Additional packages, security services, static IP fees, modem rental, cloud services, installation fees, or value-added services must be based on clear consent or contractual acceptance.

Continued invoicing after a valid termination request is another high-risk issue. If a consumer properly requests cancellation, the ISP must process the request within the applicable legal framework. Delays or artificial obstacles may trigger consumer complaints and potential liability.

Public Wi-Fi and Corporate Internet Services

ISP regulations may also affect public Wi-Fi operators, hotels, cafés, shopping malls, universities, municipalities, co-working spaces, and companies offering internet access to customers or visitors. Depending on the structure of the service, such actors may be public internet use providers, access providers, or customers of an authorized ISP.

Public internet access raises specific legal risks because third parties use the network. The operator should identify whether it has traffic data obligations, user authentication requirements, log retention obligations, and cooperation duties under Law No. 5651 and related regulations.

Corporate internet services also require careful contract drafting. Service level agreements should define uptime, bandwidth, support response time, maintenance windows, security obligations, liability limitations, force majeure, data protection terms, and termination conditions.

For enterprise customers, internet connectivity may be business-critical. If the ISP fails to provide agreed service levels, the customer may claim damages under the contract. Therefore, ISPs should avoid vague or unrealistic service commitments.

Foreign Companies Providing ISP Services in Turkey

Foreign investors and international telecom companies may enter the Turkish ISP market, but they must comply with Turkish regulatory requirements. Operating from abroad does not automatically eliminate Turkish law obligations if the service targets users in Turkey, provides electronic communications functionality in Turkey, uses local infrastructure, or processes personal data of individuals in Turkey.

Foreign companies should analyze whether they need to establish a Turkish company, obtain BTK authorization, appoint local representatives, prepare Turkish-law compliant contracts, comply with data protection obligations, and create local consumer complaint mechanisms.

A foreign company should not launch internet access, VPN-like connectivity, satellite internet, IoT connectivity, corporate network access, or wireless internet services in Turkey without a legal classification analysis. Some services may be treated as software, while others may fall under electronic communications regulation.

Administrative Sanctions and Legal Risks

ISPs that violate Turkish regulations may face administrative fines, corrective measures, suspension of activities, termination of unauthorized services, consumer claims, data protection investigations, and reputational harm.

BTK’s audit function is important in this respect. BTK states that under Law No. 5809, operators are monitored for compliance with license conditions, equipment standards, sectoral legislation, spectrum use, and other regulatory requirements, and sanctions may be imposed on operators that fail to comply with regulations.

Common compliance failures include:

Providing internet services without authorization.

Misleading consumers about speed or tariffs.

Charging unlawful cancellation fees.

Failing to terminate subscriptions properly.

Failing to protect personal data.

Failing to retain required traffic records.

Retaining data excessively or insecurely.

Failing to implement lawful access-blocking decisions.

Ignoring network and information security obligations.

Failing to respond to consumer complaints.

If an administrative sanction is imposed, the company may challenge it before administrative courts. However, deadlines are strict, and the case must be supported by technical evidence, legal arguments, procedural objections, and proportionality analysis.

Practical ISP Compliance Checklist in Turkey

An ISP operating in Turkey should implement a structured compliance program. The following checklist is useful:

Determine whether the business model requires BTK authorization.

Classify the company’s role as ISP, access provider, hosting provider, infrastructure operator, or another regulated actor.

Prepare proper corporate documents and articles of association.

Complete BTK authorization before commercial launch.

Prepare transparent subscription agreements.

Disclose tariffs, speeds, fees, and cancellation conditions clearly.

Establish lawful billing and invoicing systems.

Create procedures for consumer complaints.

Maintain technical records of service quality.

Develop Law No. 5651 compliance procedures.

Create access-blocking order response protocols.

Protect traffic data and subscriber logs.

Prepare KVKK-compliant privacy notices and data processing records.

Implement network and information security measures.

Train employees and customer service staff.

Review vendor and subcontractor agreements.

Monitor BTK decisions and regulatory updates.

Prepare litigation and administrative objection strategies.

Conclusion

Internet Service Provider regulations in Turkey are complex, technical, and highly regulated. ISPs must comply with Law No. 5809 on Electronic Communications, BTK authorization rules, Law No. 5651, personal data protection law, consumer protection rules, network and information security obligations, and administrative procedures.

For ISPs, the most important issue is not only obtaining authorization but also maintaining continuous compliance. A company may be properly authorized but still face legal risks if it misleads consumers, fails to protect subscriber data, ignores access-blocking decisions, provides poor service quality, charges unfair fees, or neglects cybersecurity.

For foreign investors, Turkey offers a significant internet and telecommunications market. However, regulatory planning must be completed before market entry. The correct legal classification of the service, proper BTK authorization, strong consumer contracts, data protection compliance, network security, and Law No. 5651 procedures are essential for lawful and sustainable operations.

An ISP that invests in legal compliance can reduce regulatory risk, strengthen consumer trust, protect its reputation, and build a more sustainable business model in the Turkish digital economy.

Frequently Asked Questions

Do Internet Service Providers need authorization in Turkey?

Yes. Companies that provide internet service provision or electronic communications services may need authorization from BTK before starting operations.

What is the main law governing ISPs in Turkey?

The main legal framework includes Law No. 5809 on Electronic Communications and Law No. 5651 on internet publications. ISPs must also comply with data protection, consumer protection, and network security rules.

What is BTK’s role in ISP regulation?

BTK is the main regulatory and supervisory authority. It handles authorization, inspection, consumer protection, network security, tariffs, technical rules, and administrative sanctions.

Are ISPs responsible for user content?

ISPs are generally not the creators of user content. However, as access providers, they may be required to implement lawful access-blocking decisions and comply with obligations under Law No. 5651.

Must ISPs keep traffic data?

Access providers and related internet actors may have legal obligations to retain certain traffic information for legally determined periods while protecting its accuracy, integrity, and confidentiality.

Are IP addresses personal data in Turkey?

In many contexts, IP addresses and subscriber logs may be treated as personal data because they can be linked to identifiable individuals. Therefore, ISPs must handle them in compliance with Law No. 6698.

Can foreign companies provide ISP services in Turkey?

Yes, but they must analyze whether their services require BTK authorization, local company establishment, data protection compliance, consumer protection procedures, and other regulatory steps.

What are the main legal risks for ISPs in Turkey?

The main risks include unauthorized operation, misleading advertisements, unfair billing, excessive cancellation fees, data breaches, failure to implement access-blocking orders, cybersecurity failures, and administrative sanctions.