Law No. 5651: articles affecting public use providers
Law No. 5651, "the Law on the Regulation of Broadcasts via the Internet and the Fight Against Crimes Committed through Such Broadcasts," defines businesses offering internet access — hotels, cafés, restaurants, offices, schools, hospitals — as "public use providers" and imposes on them the obligation to keep access records and to apply content filtering. This page carries the official text and a plain-language explanation of the articles that directly affect these businesses.
Law No.: 5651 · Date of enactment: 4/5/2007 · Official Gazette: 23/5/2007, issue 26530. The articles below are taken from the law's current version (with 2026 amendments incorporated); only the sections directly relevant to public use providers (hotels, cafés, offices, schools, hospitals, etc.) have been selected. For the law in full, see the official link below.
Article 1 — Purpose and scope
MADDE 1- (1) Bu Kanunun amaç ve kapsamı; içerik sağlayıcı, yer sağlayıcı, erişim sağlayıcı ve toplu kullanım sağlayıcıların yükümlülük ve sorumlulukları ile internet ortamında işlenen belirli suçlarla içerik, yer ve erişim sağlayıcıları üzerinden mücadeleye ilişkin esas ve usûlleri düzenlemektir.
"ARTICLE 1- (1) The purpose and scope of this Law is to regulate the obligations and liabilities of content providers, hosting providers, access providers, and public use providers, and the principles and procedures for fighting, through content, hosting, and access providers, certain crimes committed via the internet."
Law No. 5651, Art. 1/1 — unofficial translation — mevzuat.gov.tr
What this means: The law defines four different parties and places different obligations on each: the one producing content (content provider), the one hosting that content (hosting provider), the one providing the ability to connect to the internet (access provider — e.g. your carrier), and the one offering internet use at a specific place (public use provider — e.g. your business). The rest of this page focuses only on the last group, and on the provisions affecting public use providers.
Article 2 — Definitions
Article 2 of the law defines the terms used throughout the text. Below are the five definitions relevant to public use providers.
MADDE 2- (1) Bu Kanunun uygulamasında; […]
d) Erişim: Bir internet ortamına bağlanarak kullanım olanağı kazanılmasını,
e) Erişim sağlayıcı: Kullanıcılarına internet ortamına erişim olanağı sağlayan her türlü gerçek veya tüzel kişileri,
g) İnternet ortamı: Haberleşme ile kişisel veya kurumsal bilgisayar sistemleri dışında kalan ve kamuya açık olan internet üzerinde oluşturulan ortamı,
[…]
i) Toplu kullanım sağlayıcı: Kişilere belli bir yerde ve belli bir süre internet ortamı kullanım olanağı sağlayanı,
j) (Değişik: 26/2/2014-6527/15 md.) Trafik bilgisi: Taraflara ilişkin IP adresi, kaynak ve hedef port bilgisi, verilen hizmetin başlama ve bitiş zamanı, yararlanılan hizmetin türü, aktarılan veri miktarı ve varsa abone kimlik bilgilerini,
ifade eder."ARTICLE 2- (1) For the purposes of this Law; […]
Law No. 5651, Art. 2/1-d, e, g, i, j — unofficial translation — mevzuat.gov.tr
d) Access: The acquisition of the ability to connect to and use an internet environment;
e) Access provider: Any real or legal person that provides its users with the ability to access an internet environment;
g) Internet environment: The environment created over the internet, which lies outside of communication and of personal or institutional computer systems and which is open to the public;
[…]
i) Public use provider: Anyone who provides persons with the ability to use an internet environment at a given place, for a given period of time;
j) (As amended: Law 6527, Art. 15, dated 26/2/2014) Traffic information: The IP address of the parties, source and destination port information, the start and end time of the service provided, the type of service used, the amount of data transferred, and, if any, subscriber identity information;
shall mean the following."
What this means: The definition of "public use provider" (subparagraph i) is deliberately broad: it says "persons," without distinguishing between customer, guest, or employee. Any business offering internet access to a hotel guest, a café customer, an office employee, or a school student falls within this definition. "Access" (subparagraph d) and "access provider" (subparagraph e) are separate concepts — your business provides access on its own internal network, but the "access provider" is generally the carrier supplying your internet line. The definition of "traffic information" (subparagraph j) shows which data matters under this scope: IP address, port information, the service's start/end time, the type of service, and the amount of data transferred.
izgate's counterpart: izgate automatically extracts the elements in the traffic information definition (source/destination IP and port, the NAT port, time, data volume) from the logs coming from your firewall, and stores them matched to the user.
Article 7 — Obligations of public use providers
The law's only article that directly places obligations on public use providers is Article 7, made up of four paragraphs. The difference between the paragraphs matters: some apply only to those operating on a commercial basis, while others apply to everyone, regardless of whether they operate on a commercial basis.
Article 7/1 — Operating permit (commercial providers only)
MADDE 7- (1) Ticarî amaçla toplu kullanım sağlayıcılar, mahallî mülkî amirden izin belgesi almakla yükümlüdür. İzne ilişkin bilgiler otuz gün içinde mahallî mülkî amir tarafından Başkanlığa bildirilir. Bunların denetimi mahallî mülkî amirler tarafından yapılır. İzin belgesinin verilmesine ve denetime ilişkin esas ve usûller, yönetmelikle düzenlenir.
"ARTICLE 7- (1) Commercial public use providers are obliged to obtain an operating permit from the local civil authority. Information regarding the permit shall be notified to the Presidency by the local civil authority within thirty days. These providers shall be supervised by the local civil authorities. The principles and procedures regarding the issuance of the operating permit and its supervision shall be regulated by a regulation."
Law No. 5651, Art. 7/1 — unofficial translation — mevzuat.gov.tr
What this means: This obligation is written only for "commercial public use providers" — the related regulation defines this term as businesses "providing commercial public internet use services for a fee in internet cafés and similar venues open to the public" (see Regulation, Art. 3/l). A hotel, café, office, or hospital offering free Wi-Fi to its customers/guests falls outside this definition and is not obliged to obtain an operating permit.
Article 7/2 — Access records and content blocking (everyone)
(2) (Değişik: 6/2/2014-6518/91 md.) Ticari amaçla olup olmadığına bakılmaksızın bütün internet toplu kullanım sağlayıcılar, konusu suç oluşturan içeriklere erişimin engellenmesi ve kullanıma ilişkin erişim kayıtlarının tutulması hususlarında yönetmelikle belirlenen tedbirleri almakla yükümlüdür.
"(2) (As amended: Law 6518, Art. 91, dated 6/2/2014) All internet public use providers, regardless of whether they operate on a commercial basis, are obliged to take the measures determined by regulation regarding the blocking of access to content constituting a crime and the keeping of access records relating to use."
Law No. 5651, Art. 7/2 — unofficial translation — mevzuat.gov.tr
What this means: This is the law's broadest provision: with the phrase "regardless of whether they operate on a commercial basis," a hotel offering free Wi-Fi, an office providing internet to its employees, and a school giving its students network access all fall within this paragraph. The concrete content of the obligation (what must be kept, for how long) is regulated in the Regulation — see the Regulation on Internet Public Use Providers, Art. 4.
izgate's counterpart: izgate collects exactly the access records this paragraph points to (internal IP, MAC, destination IP/port, NAT information, time), matches them to the user, and stores them in a signed archive.
Article 7/3 — Protection of the family and children (commercial providers only)
(3) (Değişik: 6/2/2014-6518/91 md.) Ticari amaçla toplu kullanım sağlayıcılar, ailenin ve çocukların korunması, suçun önlenmesi ve suçluların tespiti kapsamında usul ve esasları yönetmelikte belirlenen tedbirleri almakla yükümlüdür.
"(3) (As amended: Law 6518, Art. 91, dated 6/2/2014) Commercial public use providers are obliged to take the measures, the procedures and principles of which are determined by regulation, within the scope of protecting the family and children, preventing crime, and identifying offenders."
Law No. 5651, Art. 7/3 — unofficial translation — mevzuat.gov.tr
What this means: This paragraph, too, is only for commercial providers (internet-café-like businesses); the concrete measures (content filtering plus safe internet service, age limits, camera recording, etc.) are listed in Articles 5 and 9 of the related regulation.
Article 7/4 — Administrative sanctions (commercial providers only)
(4) (Ek: 6/2/2014-6518/91 md.) Bu maddede belirtilen yükümlülükleri ihlal eden ticari amaçla toplu kullanım sağlayıcılarına, ihlalin ağırlığına göre yönetmelikle belirlenecek usul ve esaslar çerçevesinde uyarma, bin Türk Lirasından on beş bin Türk Lirasına kadar idari para cezası verme veya üç güne kadar ticari faaliyetlerini durdurma müeyyidelerinden birine karar vermeye mahalli mülki amir yetkilidir.
"(4) (Added: Law 6518, Art. 91, dated 6/2/2014) The local civil authority is authorized to decide, within the framework of the procedures and principles to be determined by regulation according to the severity of the violation, on one of the following sanctions against commercial public use providers who violate the obligations set out in this article: a warning, an administrative fine ranging from one thousand to fifteen thousand Turkish Lira, or suspension of commercial activities for up to three days."
Law No. 5651, Art. 7/4 — unofficial translation — mevzuat.gov.tr
What this means: This is an important distinction: the administrative fine of 1,000–15,000 TRY, the warning, and the suspension of activities for up to three days are, in the text of the law, written only for commercial public use providers. Generalizations such as "every café/hotel gets a 15,000 TRY fine" are not supported by the text of the law. For a non-commercial business, the correct statement is: the law (Art. 7/2) imposes the obligation to keep access records on everyone, regardless of whether they operate commercially; but the administrative fine provision in this article is only foreseen for commercial providers.
Summary: who is responsible for which paragraph
| Paragraph | Subject | Scope |
|---|---|---|
| Art. 7/1 | Operating permit | Commercial providers only (internet-café-like) |
| Art. 7/2 | Content blocking + keeping access records | Everyone, regardless of commercial basis |
| Art. 7/3 | Family/child protection measures | Commercial providers only |
| Art. 7/4 | Administrative sanction (warning, 1,000–15,000 TRY, suspension) | Commercial providers only |
For businesses such as hotels, cafés, restaurants, offices, schools, and hospitals that offer free Wi-Fi to their customers/employees/guests, the only paragraph that's binding is Art. 7/2: content blocking and keeping access records. The operating permit, the separate administrative-fine regime, and the stricter venue rules concern internet cafés and similar businesses that sell internet access for a fee.
Frequently asked questions
Do hotels and cafés need to obtain an operating permit under Law 5651?
No. The operating-permit obligation (Art. 7/1) is only foreseen for "commercial internet public use providers" — that is, internet-café-like venues that sell internet access for a fee. Businesses such as hotels, cafés, restaurants, and offices that offer free Wi-Fi to their customers/guests fall outside this definition.
Does a business offering free Wi-Fi have no obligations at all?
It does. Art. 7/2 imposes content-blocking and access-record obligations on all public use providers, regardless of whether they operate commercially. Only the operating permit, the additional measures (Art. 7/3), and the administrative fine in this article (Art. 7/4) are limited to commercial providers.
Who does the 1,000–15,000 TRY administrative fine apply to?
In the text of the law, this fine is foreseen for commercial public use providers who violate the obligations set out in Article 7 (Art. 7/4). A generalization to "every business" is not supported by the text of the law.
Do the 2026 amendments to Law 5651 affect public use providers?
The current text of the law includes 2026-dated amendments (e.g. adding definitions for games/game distributors to Art. 2, and provisions relating to the Cyber Security Presidency); these do not directly change public use providers' access-record and content-blocking obligation (Art. 7).
This page is for information only; for the current text of the legislation, refer to the official source (mevzuat.gov.tr).
Making your network Law No. 5651 compliant is a one-day job.
Configure izgate Cloud based on your number of firewall devices and storage needs; no setup, get started in minutes. Call us with any questions.