Introduction
eSIM regulation in Turkey is one of the most important legal issues for mobile operators, virtual mobile network operators, IoT connectivity providers, connected vehicle companies, smartwatch manufacturers, smartphone distributors, foreign eSIM platforms, travel eSIM providers, fintech companies, cloud communication platforms and technology companies offering digital connectivity solutions.
eSIM, also known as embedded SIM or eUICC, allows a mobile operator profile to be downloaded, activated, changed or managed remotely without inserting a traditional physical SIM card. This technology provides flexibility for smartphones, tablets, smartwatches, connected vehicles, industrial IoT devices, logistics trackers, smart meters, healthcare devices, consumer electronics and machine-to-machine communication systems.
However, in Turkey, eSIM is not treated as an unregulated consumer convenience or a purely technical device feature. It is part of the electronic communications regulatory framework. The Information and Communication Technologies Authority, known as BTK, adopted a specific Board Decision dated 12 February 2019 and numbered 2019/DK-TED/053 on remote programmable SIM technologies, including eUICC and eSIM. The decision refers to Law No. 5809 on Electronic Communications, Law No. 5651 and other relevant legislation, and states that the purpose of the framework includes consumer protection, personal data protection, cybersecurity, national security, public order and proper performance of public services.
For operators and technology companies, the main legal point is clear: eSIM services used in Turkey must be structured around Turkish electronic communications law, BTK authorization, operator responsibility, local infrastructure, data localization, identity verification, SIM activation security, KVKK compliance and cybersecurity. A foreign company cannot safely assume that a global eSIM model used in other jurisdictions can be applied in Turkey without local legal analysis.
What Is eSIM?
eSIM is a remotely programmable SIM technology. Unlike a traditional physical SIM card, it is embedded in a device or integrated into the device architecture. The mobile operator profile can be downloaded and managed digitally. This allows users to activate a mobile plan, switch between operator profiles, use multiple profiles on the same device or manage large numbers of connected devices remotely.
In consumer devices, eSIM is commonly used in smartphones, tablets and smartwatches. In enterprise and industrial environments, eSIM is important for IoT devices, connected vehicles, logistics systems, smart meters, remote sensors and global device fleets. In the travel market, eSIM is often used to provide temporary data packages for tourists and business travelers.
From a legal perspective, eSIM is important because it separates the physical SIM card from the mobile operator profile. This creates new questions about who controls the profile, where the profile is prepared, where the subscription management platform is located, which operator is authorized, how the subscriber is identified, whether foreign profiles may be loaded, how personal data is stored and whether remote activation creates fraud or security risk.
Main Legal Framework for eSIM in Turkey
The main legal framework for eSIM in Turkey consists of Law No. 5809 on Electronic Communications, BTK authorization rules, the 2019 BTK eSIM Board Decision, identity verification rules in the electronic communications sector, KVKK, cybersecurity rules, IMEI registration rules and, depending on the service model, Law No. 5651.
BTK’s 2019 eSIM decision specifically covers “Uzaktan Programlanabilir SIM teknolojileri,” including eUICC and eSIM/embedded SIM. The decision describes these technologies as allowing the mobile operator profile to be managed remotely and sets out regulatory conditions for their use in Turkey.
This means that eSIM should not be evaluated only under ordinary consumer device law. It is closely connected with mobile network operation, subscriber management, operator authorization, national telecom infrastructure, data processing and cybersecurity.
For technology companies, the key question is not simply whether the device supports eSIM. The key question is whether the eSIM profile, subscription management process, connectivity service and data processing model comply with Turkish telecom and privacy rules.
BTK’s 2019 eSIM Decision
BTK’s 12 February 2019 decision is the central regulatory source for eSIM in Turkey. The decision states that for devices manufactured for use in Turkey, imported into Turkey or brought by passengers, remote programmable SIM technologies used within Turkey must be programmable in a way that can be controlled only by mobile operators in Turkey, and only Turkish mobile operator profiles may be loaded. Foreign company SIM profiles may be loaded only outside customs areas when going abroad.
The same decision also regulates the technical infrastructure behind eSIM subscription management. It refers to GSMA Subscription Manager processes and components such as SM-DP, SM-SR, SM-DP+, SM-DS, data centers, software, platforms, Local Profile Assistant applications and related systems. BTK decided that all such structures, systems, software and storage units must be established within Turkey by authorized operators or by third parties designated by operators under the operators’ full responsibility.
This is one of the most important legal features of Turkey’s eSIM regime. Turkey’s approach is not limited to user-facing activation. It also covers back-end infrastructure, profile preparation, secure routing, storage, software and operational control.
Local Infrastructure and Data Localization
One of the strongest requirements in the 2019 BTK decision is localization. BTK required the relevant eSIM structures, systems, storage units, software and GSMA-standard platform components to be established within Turkey, to ensure interoperability and control, and to keep all data within Turkey.
This has major consequences for global eSIM platforms. A foreign eSIM provider that manages profiles, customer data, subscription infrastructure or eSIM platform components outside Turkey may face regulatory problems if it provides eSIM services for use in Turkey in a way that falls within the BTK framework.
For Turkish mobile operators, this means that eSIM infrastructure cannot be treated as a fully outsourced foreign cloud service without local compliance analysis. Operators may use third parties, but the 2019 decision places full responsibility on the authorized operator and requires the relevant systems and data to be kept within Turkey.
For technology companies, this creates a practical due diligence question: where are the eSIM subscription management servers, profile data, user data, activation data, platform software and support systems located? If the answer involves foreign infrastructure, Turkish compliance must be reviewed carefully.
Authorized Operators and eSIM Control
Turkey’s eSIM framework centers on authorized mobile operators. The 2019 BTK decision requires remote programmable SIM modules used in Turkey to be programmable in a manner controlled by mobile operators in Turkey, and to allow only Turkish mobile operator profiles for domestic use.
This affects several business models. A smartphone manufacturer cannot simply allow any foreign eSIM profile to be permanently used in Turkey without considering BTK’s framework. A global travel eSIM provider cannot assume that its foreign operator profile can be used in Turkey in the same way as in other markets. An IoT platform cannot rely on permanent foreign eSIM profiles for devices located in Turkey without assessing Turkish telecom rules.
The decision also limits international roaming data service for devices manufactured for use in Turkey, imported into Turkey or brought by passengers to the IMEI registration period of 120 days.
This does not mean every short-term roaming use is banned. However, it means that permanent or long-term use of foreign eSIM profiles in Turkey may create regulatory risk, especially for devices intended to operate in Turkey on an ongoing basis.
eSIM and IMEI Registration
eSIM regulation intersects with IMEI rules because the same device may support both physical SIM and eSIM profiles. BTK maintains consumer-facing IMEI operations through e-Devlet individual transactions, corporate MCKS transactions and information pages.
The 2019 eSIM decision expressly connects international roaming data service for relevant devices with the 120-day IMEI registration period.
For consumers and technology companies, this means that eSIM activation should not be separated from device registration status. A foreign device brought into Turkey may work temporarily, but long-term use may be affected by IMEI registration rules. A company deploying IoT devices or connected vehicles in Turkey should examine both eSIM profile rules and device registration requirements.
For businesses importing eSIM-capable devices, compliance review should include customs, IMEI, radio equipment conformity, BTK operator rules and data localization. A device that is technically capable of connecting to a network may still face legal restrictions if the IMEI or eSIM profile model is not compliant.
eSIM Activation and Identity Verification
eSIM activation creates higher identity verification risk than traditional SIM activation because the process can be remote, digital and fast. A fraudulent actor may attempt to obtain an eSIM profile, transfer a mobile number, activate a replacement profile or take control of a subscriber’s number.
BTK lists the Regulation on the Verification Process of the Applicant’s Identity in the Electronic Communications Sector among the official legislation relevant to electronic communications identity verification.
The identity verification framework is directly relevant to eSIM because eSIM activation, SIM change, subscription contract creation, operator change and number portability may all require reliable identification depending on the transaction. Legal summaries of the 2026 amendments state that electronic communications identity verification methods include e-Devlet, NFC-supported electronic identity document verification, video verification and, for certain foreign applicants, verification through the Presidency of Migration Management.
For operators, the legal requirement is not only to issue a QR code or activation link. The operator must be able to prove that the applicant was properly identified, that the transaction was approved by the real subscriber or authorized representative, and that transaction records were preserved securely.
eSIM, SIM Swap and Fraud Risk
eSIM can make SIM swap fraud more dangerous if activation controls are weak. A SIM swap attack occurs when a fraudster obtains control of a victim’s mobile number by causing the operator to issue a replacement SIM or eSIM profile. Once the fraudster controls the number, they may receive SMS verification codes and access bank accounts, e-mail accounts, crypto wallets, social media accounts and corporate systems.
Because eSIM activation can be performed remotely, operators should treat replacement eSIM profiles as high-risk transactions. A strong eSIM activation process should include enhanced identity verification, transaction-specific approval, notification to the existing line, fraud scoring, cooldown periods for suspicious requests, dealer monitoring and secure delivery of activation credentials.
Technology companies using mobile numbers for authentication should also understand this risk. SMS-based two-factor authentication is vulnerable if the mobile number can be taken over. Banks, fintech companies, crypto platforms and marketplaces should consider additional authentication layers, especially for high-value transactions.
eSIM for MVNOs and Virtual Operators
eSIM is highly relevant for MVNOs and virtual mobile service providers. A virtual operator may want to onboard customers remotely, issue eSIM profiles digitally and manage subscriptions without physical SIM distribution. This may reduce cost and improve customer experience.
However, MVNOs must still comply with BTK authorization, mobile service rules, identity verification, subscriber records, number allocation, consumer protection, KVKK, cybersecurity and operator responsibility. The fact that the SIM is digital does not remove the regulatory duties that apply to mobile services.
BTK’s 2019 decision states that, unless otherwise determined by the Authority, the compliance obligations applicable to services offered through physical SIMs also apply to services offered through remote programmable SIM technologies.
This principle is critical. eSIM is not a legal shortcut. If a service requires subscriber identification, operator authorization, lawful profile management or data security in the physical SIM world, the same issues must be addressed for eSIM.
eSIM for IoT and Connected Devices
eSIM is especially important for IoT. Devices such as smart meters, connected vehicles, logistics trackers, industrial sensors, payment terminals, alarm systems, health devices and agricultural sensors may need mobile connectivity for years. eSIM allows connectivity profiles to be managed remotely and can reduce the cost of physical SIM replacement.
However, IoT eSIM projects in Turkey require careful legal classification. The company must determine whether it is a device manufacturer, software provider, IoT platform, telecom reseller, MVNO, authorized operator, data controller or data processor. If the company provides connectivity under its own brand or controls eSIM profiles, BTK authorization analysis may be necessary.
IoT eSIM projects also raise data localization and privacy issues. Connected vehicle data, location data, device identifiers, terminal information, usage data and user-related data may constitute personal data. Where eSIM platforms or support systems are outside Turkey, the 2019 BTK decision and KVKK transfer rules should both be assessed.
Foreign eSIM Providers and Travel eSIM Services
Foreign eSIM providers often sell data packages to travelers through mobile apps or websites. These services may rely on foreign operator profiles, roaming agreements or global eSIM platforms. Turkey’s 2019 eSIM decision creates special issues for such providers because it restricts domestic use of remote programmable SIM technologies to profiles controlled by Turkish mobile operators and limits international roaming data service for relevant devices to the IMEI registration period.
The legal analysis depends on the exact model. Temporary roaming for travelers is different from permanent use of foreign eSIM profiles in Turkey. A tourist who uses a short-term roaming data package may be treated differently from an IoT company deploying thousands of devices in Turkey with foreign eSIM profiles for continuous use.
Foreign eSIM platforms targeting Turkish users or providing services for devices located in Turkey should conduct local legal review before marketing, selling or activating eSIM services in Turkey. Important issues include BTK authorization, domestic operator involvement, profile localization, data localization, IMEI period, KVKK, consumer law and official request handling.
KVKK and Personal Data Protection
eSIM services process significant personal data. This may include subscriber identity information, phone numbers, device identifiers, IMEI data, eUICC identifiers, profile data, activation logs, QR code delivery records, IP addresses, location data, billing information, customer support records and transaction approvals.
KVKK regulates the processing of personal data and cross-border transfers. The Personal Data Protection Authority announced that Article 9 of Law No. 6698 on transfers abroad was amended by Law No. 7499 and that English translations of the by-law and standard contract texts were made available in 2024.
For eSIM services, KVKK compliance should include clear privacy notices, data processing inventories, lawful processing grounds, consent management where required, secure storage, retention rules, data subject request procedures, vendor agreements and breach response procedures.
The privacy risk is higher in eSIM because activation data and subscription management data may be connected to a person’s mobile identity. Unauthorized disclosure of eSIM activation information may create identity theft, SIM swap fraud, financial fraud and unauthorized access to digital accounts.
Cross-Border Data Transfers
Cross-border transfer is one of the most sensitive issues in eSIM projects. Global eSIM platforms often use foreign cloud infrastructure, foreign subscription management systems, foreign support teams, global analytics and international profile management. However, Turkey’s eSIM decision includes a sector-specific localization requirement, and KVKK separately regulates personal data transfers abroad.
KVKK’s guidance on transfers abroad explains that standard contracts may be used as one of the appropriate safeguard methods, and that such standard contracts must include matters such as data categories, transfer purposes, recipients, technical and administrative measures and additional safeguards for special categories of data.
For eSIM, companies should not assume that a KVKK standard contract alone solves all localization issues. BTK’s sector-specific eSIM localization decision may impose stricter requirements for eSIM platform systems and data in Turkey. Therefore, both telecom localization and personal data transfer rules must be reviewed together.
Cybersecurity Obligations
eSIM systems are security-sensitive because they control mobile operator profiles. If an eSIM platform is compromised, attackers may activate unauthorized profiles, intercept subscriber processes, take over numbers, manipulate device connectivity or disrupt large IoT fleets.
BTK’s 2019 decision expressly refers to the need to ensure cybersecurity at the highest level, protect personal data and take measures required for national security, public order and public service.
Operators and technology providers should implement strong cybersecurity controls, including encryption, secure key management, role-based access, multi-factor authentication, secure APIs, event logging, fraud monitoring, penetration testing, vendor audits, incident response and secure profile delivery.
For IoT and connected vehicle projects, cybersecurity should also include device authentication, secure firmware updates, remote profile management restrictions, device lifecycle control and emergency deactivation procedures.
Consumer Protection and eSIM
Consumers using eSIM should be informed clearly about activation, supported devices, fees, number portability, SIM replacement, QR code security, loss of device, transfer to a new device, cancellation, roaming limits, IMEI issues and data processing.
An eSIM activation flow should not mislead consumers. If a device is not supported, if the eSIM can be activated only once, if a replacement fee applies, if physical SIM conversion has conditions or if roaming/IMEI limits apply, these points should be disclosed before purchase.
Consumer disputes may arise from failed activation, wrong profile loading, unauthorized eSIM replacement, inability to transfer eSIM to a new device, unexpected roaming charges, cancellation problems or fraud after SIM swap. Operators should maintain clear procedures and evidence records for all eSIM transactions.
eSIM and Device Manufacturers
Device manufacturers and importers must consider Turkey’s eSIM rules before placing eSIM-capable devices on the Turkish market. BTK’s 2019 decision applies to devices manufactured for use in Turkey, imported into Turkey or brought by passengers where remote programmable SIM technologies are used within Turkey.
Manufacturers should ensure that devices intended for Turkey are compatible with the Turkish eSIM framework, Turkish operator profiles, IMEI rules and relevant technical standards. They should also consider whether device software allows loading foreign profiles in a way that conflicts with Turkish requirements.
Importers and distributors should coordinate with authorized Turkish mobile operators, technical compliance teams and legal counsel before commercial launch. A device may be technologically advanced but commercially unusable if the eSIM configuration conflicts with local regulation.
Contracts for eSIM Projects
eSIM projects require strong contractual documentation. A simple software license or device supply agreement is usually insufficient. Contracts should address regulatory responsibility, operator authorization, localization, GSMA standards, platform control, data processing, cybersecurity, profile delivery, user identity verification, support, liability and incident response.
Important eSIM contract clauses include:
Scope of eSIM services.
Authorized operator responsibility.
Location of platform infrastructure.
Location of data storage.
GSMA compliance.
Role of SM-DP, SM-SR, SM-DP+ and SM-DS systems.
Profile preparation and delivery.
Identity verification obligations.
QR code or activation link security.
eSIM replacement procedures.
Fraud monitoring.
KVKK roles and responsibilities.
Cross-border data transfer restrictions.
Cybersecurity controls.
Incident notification.
Official request handling.
Audit rights.
Termination and data deletion.
Regulatory change clauses.
For IoT projects, contracts should also define device ownership, profile lifecycle, connectivity suspension, fleet management, location data, remote provisioning and decommissioning.
Legal Risks for Non-Compliant eSIM Services
Non-compliant eSIM services may create several legal risks. These include unauthorized electronic communications activity, breach of BTK decisions, violation of localization requirements, unlawful use of foreign operator profiles, failure to comply with IMEI limitations, weak identity verification, SIM swap fraud, KVKK violations, unlawful cross-border transfers, cybersecurity incidents, consumer claims and administrative sanctions.
The most serious risk is misclassification. A technology company may believe that it is merely offering a digital connectivity product, while Turkish law may treat the model as an electronic communications service requiring Turkish operator control and local infrastructure. Similarly, an IoT company may believe it is only importing devices, while the eSIM profile model may trigger telecom rules.
Companies should obtain legal classification before launch, especially if they plan to sell eSIM services in Turkey, activate foreign profiles in Turkey, deploy IoT devices in Turkey, support connected vehicles, distribute eSIM-capable devices or manage eSIM infrastructure from abroad.
Practical Compliance Checklist for Operators
Mobile operators and MVNOs offering eSIM in Turkey should follow this checklist:
Confirm BTK authorization scope.
Review the 2019 BTK eSIM decision.
Ensure Turkish operator control over domestic eSIM profiles.
Keep eSIM platform infrastructure within Turkey where required.
Keep eSIM-related data within Turkey where required.
Ensure GSMA-standard platform compliance.
Use secure identity verification before activation.
Protect QR codes and activation links.
Create SIM swap prevention procedures.
Maintain transaction-specific approval records.
Prepare KVKK privacy notices.
Limit access to profile and activation data.
Monitor suspicious eSIM replacements.
Train dealers and customer support teams.
Prepare cybersecurity incident response.
Review contracts with platform vendors.
Maintain audit-ready documentation.
Practical Compliance Checklist for Technology Companies
Technology companies, device manufacturers, IoT providers and foreign eSIM platforms should follow this checklist:
Classify the business model.
Determine whether the service involves electronic communications.
Check whether a Turkish authorized operator must be involved.
Review whether foreign profiles may be used in Turkey.
Analyze IMEI and 120-day temporary use issues.
Review eSIM platform localization.
Identify where profile and subscriber data is stored.
Review KVKK and cross-border transfer rules.
Prepare user identity verification procedures.
Review cybersecurity controls.
Draft Turkish-law-compliant contracts.
Check device conformity and market-entry rules.
Prepare consumer disclosures.
Do not market permanent foreign eSIM use in Turkey without legal review.
Conclusion
eSIM regulation in Turkey is a strategic legal area for telecom operators and technology companies. eSIM offers major benefits: remote activation, easier device management, digital onboarding, IoT scalability and flexible connectivity. However, in Turkey, eSIM is subject to a detailed regulatory framework shaped by BTK’s 2019 decision, Law No. 5809, operator authorization, identity verification, data localization, KVKK, cybersecurity and IMEI rules.
The most important principle is that eSIM is not a way to avoid telecom regulation. BTK expressly decided that, unless otherwise determined by the Authority, compliance obligations applicable to services offered through physical SIMs also apply to services offered through remote programmable SIM technologies.
Operators must ensure Turkish control, local infrastructure, local data storage, secure activation and subscriber protection. Technology companies must assess whether their eSIM model requires Turkish operator involvement, local infrastructure, KVKK safeguards and cybersecurity controls. Foreign eSIM providers, IoT platforms and connected device companies should be especially cautious before offering services for devices located in Turkey.
A compliant eSIM strategy in Turkey should combine telecom authorization analysis, BTK localization review, identity verification, SIM swap prevention, KVKK documentation, cybersecurity controls, clear consumer disclosures and strong contracts. Companies that build these requirements into their product and market-entry strategy will reduce legal risk and operate more sustainably in Turkey’s digital communications market.
Frequently Asked Questions
Is eSIM legal in Turkey?
Yes. eSIM is legal in Turkey, but it is regulated. BTK adopted a specific decision dated 12 February 2019 and numbered 2019/DK-TED/053 on remote programmable SIM technologies, including eUICC and eSIM.
What is the main BTK decision on eSIM?
The central decision is BTK Board Decision dated 12 February 2019 and numbered 2019/DK-TED/053. It regulates remote programmable SIM technologies and sets out conditions on Turkish operator control, local infrastructure, data localization, GSMA-standard systems and temporary roaming limits.
Can foreign eSIM profiles be used permanently in Turkey?
BTK’s 2019 decision requires eSIM technologies used in Turkey to be programmable under Turkish mobile operator control and to allow only Turkish mobile operator profiles for domestic use. Foreign profiles may be loaded outside customs areas when going abroad, and international roaming data service is limited to the 120-day IMEI registration period for the relevant devices.
Must eSIM servers be located in Turkey?
BTK’s 2019 decision requires eSIM subscription management systems, software, platform components, data centers, storage units and related structures to be established within Turkey by authorized operators or third parties under the full responsibility of operators, and requires all data to be kept within Turkey.
Does eSIM require identity verification?
Yes. eSIM activation and related subscriber transactions should be supported by proper identity verification. BTK lists the Regulation on the Verification Process of the Applicant’s Identity in the Electronic Communications Sector among relevant official legislation.
Does KVKK apply to eSIM services?
Yes. eSIM services process personal data such as subscriber identity, device identifiers, profile data, activation logs, phone numbers and customer records. KVKK and its cross-border transfer rules must be considered.
Can eSIM data be transferred abroad?
This requires careful analysis. KVKK permits certain cross-border transfers through mechanisms such as standard contracts, but BTK’s eSIM decision also contains sector-specific localization requirements for eSIM systems and data.
Are MVNOs allowed to offer eSIM in Turkey?
MVNOs may offer eSIM if their authorization, commercial agreements, identity verification, BTK compliance, localization, KVKK and cybersecurity structures are lawful. eSIM does not remove ordinary mobile operator obligations.
What is the biggest legal risk for foreign eSIM platforms?
The biggest risk is offering permanent or Turkey-targeted eSIM connectivity through foreign profiles or foreign infrastructure without satisfying BTK’s Turkish operator control and localization requirements.
What should companies do before launching eSIM services in Turkey?
They should review BTK authorization, the 2019 eSIM decision, Turkish operator involvement, localization, IMEI issues, identity verification, KVKK, cybersecurity, consumer terms and contracts before launch.
No Responses