In brief
The duties are listed not in the law itself but in a 2017 regulation. Here is what each article says, with sources.
Most of what circulates about the duties of businesses offering internet to guests does not agree with itself. This article states the duties and shows which article of which text they come from. Where we could not verify something, we say so.
First, the category question
Article 2 of Law No. 5651 defines four provider types: access provider, content provider, hosting provider and mass use provider (toplu kullanım sağlayıcı).
Cafés, hotels, malls, hospitals and offices that offer internet to customers or visitors fall into the mass use provider category.
One term is often confused: "ticari amaçla toplu kullanım sağlayıcı" (commercial mass use provider). That phrase is not defined in the Law; it appears only in article 7. Its definition sits in article 3 of the İnternet Toplu Kullanım Sağlayıcıları Hakkında Yönetmelik, and reads:
"İnternet salonu ve benzeri umuma açık yerlerde belirli bir ücret karşılığı internet toplu kullanım sağlayıcılığı hizmeti veren veya bununla beraber bilgisayarlarda bilgi ve beceri artırıcı veya zeka geliştirici nitelikteki oyunların oynatılmasına imkân sağlayan gerçek ve tüzel kişileri"
At the centre of the definition is providing internet service for a fee ("belirli bir ücret karşılığı") — in other words, classic internet cafés. A café or hotel offering Wi-Fi free to its customers does not fit the letter of that definition.
To be straight with you: we could not verify with certainty how this distinction is interpreted in practice. So we are not telling you "you are not a commercial provider, relax". Below we set out the duties of both groups separately; consult a lawyer about your own situation.
Which regulation is in force?
The text in force is the İnternet Toplu Kullanım Sağlayıcıları Hakkında Yönetmelik, published in the Official Gazette of 11 April 2017, No. 30035. It repealed the earlier 2007 regulation (article 14).
Be careful with articles based on the 2007 text; it no longer applies.
Duties for everyone (article 4)
Article 4 lists three headings for all mass use providers:
a) Content filtering. Take measures to block harmful content, in line with the service contract with the access provider.
b) Keep and store access records. Record them electronically on your own system and keep them for two years.
c) Identify users. The wording is:
"kısa mesaj servisi (sms) ve benzeri yöntemlerle kullanıcıları tanımlayacak sistemleri kurmak"
The phrase "ve benzeri" ("and similar") matters: SMS is given as an example, not as the only way. Vouchers, e-mail or registered users also identify a user.
Extra duties (article 5) — for commercial providers
Article 5 adds duties for commercial mass use providers. The notable ones:
- a) Obtain a permit.
- b, c) Provide filtering and a safe internet service.
- ç) Use a static IP.
- d) Keep access records for two years.
- e) Store a value confirming "the accuracy, integrity and confidentiality" of that information.
Note the last one: article 4's general duty contains no such integrity-value requirement.
What exactly is an "access record"?
Article 3 defines it. It covers: the internal IP address, connection start and end times, MAC address, destination IP address, and the real IP and port behind NAT.
Not covered: the websites visited, page contents, messages. The regulation does not ask for those.
This distinction matters. If you meet a product pitch claiming "you must record which sites your guests visit", ask for the basis.
Fines
Article 7/4 of Law 5651 governs the administrative fine, and the figure in the text is:
"bin Türk Lirasından on beş bin Türk Lirasına kadar" (from one thousand to fifteen thousand Turkish lira)
Article 11 of the regulation describes a staged process: a written warning first, then closure for up to three days if the breach continues, and a fine on repetition.
That figure is revalued every year. The basis is article 17/7 of the Kabahatler Kanunu. The revaluation rate announced for 2026 is 25.49% (VUK General Communiqué No. 585).
We are not printing a current lira figure. This fine is imposed by the civil administrative authority, and we could not find an official list publishing the revalued amount. Taking a number from a blog post and printing it here would mean giving you wrong information.
Question the source of figures like 50,000 TL or 500,000 TL that you see online; on the competitor sites we surveyed, amounts for the same offence differed by a factor of 200.
A 2026 change
Law No. 7590 (24 July 2026) replaced references to "the Authority" in 5651 with "the Presidency", moving the power to the Cyber Security Presidency. Because the 2017 regulation still points at the BTK, there is a mismatch between the two texts.
Summary table
| Duty | Everyone (art. 4) | Commercial (art. 5) |
|---|---|---|
| Content filtering | Yes | Yes + safe internet |
| User identification | Yes (SMS and similar) | Yes |
| Access record retention | 2 years | 2 years |
| Integrity value | No | Yes |
| Permit | No | Yes |
| Static IP | No | Yes |
What to do
- Use a method at sign-in that identifies the user.
- Keep access records and store them for two years.
- Check your contract with your access provider regarding content filtering.
- Clarify your own category with a lawyer.
This article is for information only and is not legal advice. Consult a lawyer about your own situation. Quotations are taken from the legislation as it stood on the date of publication.
This article is for information only and is not legal advice; confirm your obligations with your legal adviser.