Turkey has given a cybersecurity agency reporting directly to the presidency power to order internet and communications companies to carry out emergency measures before a judge reviews them, as part of a broader transfer of online regulatory powers from the country’s telecommunications watchdog, the TR724 news website reported.
Under the law, published in the Official Gazette on Friday, the Cybersecurity Presidency can act on its own or at the request of security and intelligence agencies on grounds including national security and public order. Internet providers, content and hosting companies and data centers must comply with its orders within two hours. The decision must be submitted to a judge within 24 hours, who then has 48 hours to rule.
The law does not define what those measures can include. The Freedom of Expression Association (İFÖD) says the open-ended wording could allow authorities to restrict access, throttle internet traffic, filter online communications or interfere with internet infrastructure before judicial approval is obtained.
The changes are part of Law No. 7590, which transfers a range of internet-related responsibilities from the Information and Communication Technologies Authority (BTK) to the Cybersecurity Presidency. Parliament approved the legislation this month, and it took effect Friday.
The transfer includes regulatory powers involving social media and online gaming platforms as well as responsibilities related to internet domain names and other digital infrastructure. The Cybersecurity Presidency will also take over BTK’s role in providing the technical framework through which authorized security and intelligence agencies carry out lawful interception. The change itself does not give the presidency the authority to conduct wiretaps.
İFÖD, a Turkish digital rights group that analyzed the legislation before its passage, said moving the powers from a telecommunications regulator to an agency embedded in the country’s security structure could weaken transparency and judicial oversight.
The group raised particular concerns about the repeal of an existing provision that specifically regulated bandwidth throttling, a practice that slows access to online services without completely blocking them. The new law replaces that provision with the broader authority to impose undefined “measures,” which İFÖD said could make it harder to determine what action authorities have taken and under what legal authority.
Turkey has repeatedly throttled access to social media during periods of political tension. Following the detention of Istanbul Mayor Ekrem İmamoğlu in March 2025, access to platforms including X, YouTube, Instagram and WhatsApp was slowed for about 42 hours, according to İFÖD.
The new law also transfers BTK personnel, information systems and other infrastructure connected to the affected responsibilities to the Cybersecurity Presidency.
The presidency was established by presidential decree in January 2025 and was later given responsibilities under Turkey’s Cybersecurity Law for coordinating national cybersecurity policy, responding to cyber threats and protecting critical infrastructure.
İFÖD had urged lawmakers to remove the agency’s ability to impose measures on its own initiative and to define more narrowly what actions it could order, arguing that restrictions affecting internet access and communications should be subject to judicial review before they take effect.
