Türkiye proposes amendment to data protection law introducing platform liability for AI-generated content
Key contacts
On 9 January 2026, a Draft Law proposing an amendment to the Personal Data Protection Law No. 6698 (KVKK) was submitted to the Grand National Assembly of Türkiye. The Draft Law introduces a targeted amendment that addresses risks from AI technologies, particularly the unauthorised generation and dissemination of AI-generated audio, visual and written content through digital platforms.
The preamble of the Draft Law highlights that recent advances in generative AI and deepfake technologies have significantly increased the risk of personal data being copied, manipulated and disseminated without consent causing serious infringements of personality rights, privacy and digital reputation. Existing legislation provides general protections, but is considered insufficient to prevent the rapid and large scale spread of such content via social media and digital platforms.
In the absence of specific provisions addressing AI-generated content under the existing legal framework, AI-related risks continue to be addressed primarily under the KVKK. In this context, the Draft Law seeks to address the lack of specific provisions on platform liability by introducing administrative sanctions applicable to social media tools and digital platforms. The preamble further emphasises that digital platforms are not merely passive intermediaries but play a decisive role in the dissemination of content through their algorithmic systems.
Key amendment
The Draft Law was designed to prevent the uncontrolled spread of AI-generated content created without consent and strengthen deterrence by imposing legal responsibility on social media networks and digital platforms. It expressly states that the amendment does not restrict freedom of expression but protects personal data, privacy, private life and personality rights against misuse of AI technologies.
Under the proposed amendment, a new paragraph would be added to Article 18 of the KVKK. Pursuant to this provision, social media tools and digital platforms that allow the sharing of AI-generated audio, visual or written communications without the individual’s consent would be subject to an administrative fine equal to 5% of their turnover generated in the financial year preceding the year in which the communication was shared. The fine would be applied separately for each infringing communication.
Notably, the proposed amendment establishes direct administrative liability for social media tools and digital platforms rather than the individual uploader. This represents a shift toward platform-level accountability whereby liability arises from permitting or facilitating the dissemination of AI-generated content without consent, reflecting a move away from treating platforms as purely passive intermediaries.
This approach suggests a stricter regulatory expectation that platforms actively prevent or restrict the dissemination of AI-generated audio, visual or written communications shared without the individual’s consent, rather than relying solely on ex post removal mechanisms triggered by complaints or regulatory orders.
Multi-layered regulatory framework for AI-Generated content
The Draft Law is part of a broad legislative initiative addressing the risks associated with AI-generated content, following an earlier legislative proposal to amend Law No. 5651 on the Regulation of Publications on the Internet. (For a detailed overview of that initiative and its regulatory implications, see our article: Türkiye Introduces Criminal Regulation for AI Content) The previous proposal introduced a mandatory labelling obligation requiring content providers to clearly indicate when content generated using AI with non-compliance triggering potential criminal liability under Article 217/A of the Turkish Criminal Code.
Against this legislative background, the subsequent proposal to amend the KVKK represents a complementary enforcement mechanism. While the earlier proposal focused on transparency obligations and criminal liability for content providers, the KVKK amendment shifts the regulatory focus to administrative liability for digital platforms that allow the dissemination of AI-generated communications without the individual’s consent.
As revealed in the table below, these proposals contain a coordinated regulatory approach to address AI-generated content across multiple layers of the digital ecosystem, combining criminal, transparency and data protection enforcement tools.
| Criterion | Draft Amendment to Law No. 5651 on the Regulation of Publications on the Internet | Draft Amendment to Personal Data Protection Law No. 6698 |
| Date of submission | 5 December 2025 | 9 January 2026 |
| Legislative objective | To introduce transparency and prevent the dissemination of misleading AI-generated content by requiring clear disclosure when content is generated using AI. | To protect individuals’ personal data, privacy, and personality rights by imposing liability on platforms that allow dissemination of AI-generated communications without the individual’s consent. |
| Primary regulatory focus | Transparency and content authenticity (AI content disclosure requirement). | Platform accountability and protection of personal data and personality rights. |
| Entities subject to liability | Content providers (içerik sağlayıcılar) | Social media tools and digital platforms – social network providers (sosyal ağ sağlayıcıları) |
| Nature of legal obligation | Mandatory labelling obligation: AI-generated audio, visual, or written communications must be clearly identified using visible signs, logos, or written notice. | Prohibition-based liability: platforms face sanctions if they allow the sharing of AI-generated communications without the individual’s consent. |
| Trigger for liability | Failure to clearly label AI-generated content as such. | Allowing dissemination of AI-generated audio, visual, or written communications without consent. |
| Type of liability | Criminal liability under Article 217/A of the Turkish Criminal Code (Publicly Disseminating Misleading Information). | Administrative liability under Article 18 of the Personal Data Protection Law. |
| Sanction mechanism | Criminal sanctions, including potential imprisonment for content providers who fail to comply. | Administrative fine equal to 5% of the platform’s turnover in the preceding year. |
Conclusion
While limited in scope, the Draft Law is an important step in Türkiye’s evolving approach to AI-related risks and platform responsibility, which signals a regulatory shift towards increased accountability for digital platforms and alignment with international developments in AI and data protection regulation.
For more information on this Draft Law, contact your CMS client partner or the CMS experts who wrote this article: alican.babalioglu@ybk-av.com, melis.celik@ybk-av.com, and ezgi.bahar@ybk-av.com.
