Turkey just handed its executive branch extraordinary control over the country's digital infrastructure. Under Law No. 7590, passed by parliament and enacted at the end of July 2026, regulatory authority over internet domain names, electronic communications, and online platforms shifted directly from the traditional telecommunications watchdog to the Cybersecurity Presidency.
If you run a tech platform, host data, or manage an access provider in the region, you now face a two-hour compliance window for emergency executive orders. Critics call it a command center for digital obedience. Supporters call it a necessary shield for national security.
Here is what the legislative overhaul actually means, why digital rights groups are sounding alarms, and how it impacts the broader internet ecosystem.
Inside the Power Shift to the Presidency
For years, the Information and Communication Technologies Authority, known locally as the BTK, handled day-to-day internet regulation and oversight. Law No. 7590 rewrites that arrangement. Core powers now rest with the Cybersecurity Presidency, an agency operating directly under President Recep Tayyip Erdoğan's office.
The structural change centralizes state cybersecurity functions, domain name management, and infrastructure strategies into a single executive office. Lawmakers backing the bill argued that streamlining these duties eliminates bureaucratic overlap between state agencies and saves millions in public funds.
Yet, the speed and scope of the execution caught industry players off guard.
When the Presidency issues an urgent directive citing national security, public order, or constitutional communication grounds, telecom operators and hosting providers must comply within two hours. Judicial review happens after the fact. Prosecutors or security agencies submit the decision to a criminal judge within 24 hours, and the court has 48 hours to issue a final ruling. If the judge stays silent, the measure lapses.
Two hours is not much time when you operate a massive data center or content delivery network.
The Core Concerns Over Open-Ended Wording
Digital rights advocates point out that the legislation lacks narrow definitions for what constitutes an emergency measure. Organizations like the Freedom of Expression Association (İFÖD) argue that open-ended text leaves room for sweeping internet traffic throttling, targeted domain blocking, and infrastructure filtering before any court touches the case.
Yaman Akdeniz, a law professor at Istanbul's Bilgi University, notes that this goes far beyond a cosmetic bureaucratic shuffle. It builds an operational framework where executive bodies can dictate digital access without immediate judicial brakes.
The legislation arrives against a backdrop of aggressive online content management. Turkish authorities have a track record of restricting social media bandwidth during periods of civil unrest. During past political demonstrations, major networks like X, YouTube, Instagram, and WhatsApp experienced severe throttling lasting days. Thousands of accounts and millions of followers have faced blocks under existing judicial and administrative orders.
Moving these controls into an office attached directly to the presidency means future digital curbs can deploy instantly.
What This Means for Tech Operators and Platforms
If you manage digital operations that touch Turkish cyberspace, your compliance playbook requires immediate updates.
- Internal Response Timelines: Standard bureaucratic delays will trigger automatic administrative fines ranging from 20,000 to 100,000 Turkish Liras per violation, alongside potential operational sanctions. Engineering and legal teams must establish a 24/7 monitoring desk to catch emergency notifications instantly.
- Infrastructure Audits: The Cybersecurity Presidency holds wide-ranging authority to request data, documents, and system access for critical infrastructure. Local entities must ensure their certified products and security frameworks strictly align with the new agency's technical mandates.
- Navigating Accountability: While administrative fines can technically be challenged before competent administrative courts, the preliminary mandate must be executed within that strict two-hour window regardless of pending litigation.
Turkey's centralization of cyber governance marks a turning point in how sovereign states manage digital borders. As executive branches claim direct oversight over routing, domain management, and emergency response, the traditional separation between technical regulators and political offices continues to vanish.
Review your compliance workflows, verify your local data hosting dependencies, and prepare for a regulatory environment where speed overrides procedural debate.
