In your internet cafe, meet Articles 5, 9, and 11 in full.

Why does an internet cafe count as a "commercial internet public use provider"?

The Regulation defines internet cafes and similar places specifically; the criterion that defines this category is that internet is provided for a fee:

"Ticari amaçla internet toplu kullanım sağlayıcı: İnternet salonu ve benzeri umuma açık yerlerde belirli bir ücret karşılığı internet toplu kullanım sağlayıcılığı hizmeti veren veya bununla beraber bilgisayarlarda bilgi ve beceri artırıcı veya zeka geliştirici nitelikteki oyunların oynatılmasına imkân sağlayan gerçek ve tüzel kişileri,"

"Commercial public use provider: Natural or legal persons who provide internet public use services for a fee in internet cafés and similar places open to the public, or who, in addition, allow computer games of a skill- or intelligence-enhancing nature to be played,"

Regulation on Internet Public Use Providers (2017), Art. 3/1-l — mevzuat.gov.tr — unofficial translation

This is a fundamental difference from a hotel, cafe, or office: those businesses offer Wi-Fi as part of their service to a customer or employee, and do not sell the internet itself. In an internet cafe, by contrast, the customer buys internet access itself, in exchange for time or a session; that's why your business is subject to the full set of additional obligations under Law Article 7/1 and Regulation Articles 5-6-9-10-11. The user sitting at each terminal exits through a single line registered in your business's name; without an identity-matched record, proving who was sitting at which computer a day later is nearly impossible.

Article 5 obligations for internet cafes

Article 5 of the Regulation lists six obligations specific to commercial internet public use providers:

"Ticarî amaçla internet toplu kullanım sağlayıcılarının yükümlülükleri şunlardır: a) Mülki idare amirinden izin belgesi almak, b) Ailenin ve çocukların korunması ile konusu suç oluşturan içeriklere erişimi önleyici tedbirleri almak amacıyla içerik filtreleme sistemini ve güvenli internet hizmetini kullanmak, c) Kullanılan içerik filtreleme sistemini aktif ve güncel halde bulundurarak, herhangi bir müdahale ile devre dışı kalmasını önlemek, ç) Erişim sağlayıcılardan sabit IP almak, sabit IP kullanmak ve sabit IP değişikliklerini on beş gün içerisinde mülki idare amirliklerine bildirmek, d) Erişim kayıtlarını elektronik ortamda kendi sistemlerine kaydetmek ve iki yıl süre ile saklamak, e) (d) bendi gereğince kaydedilen bilgileri ve bu bilgilerin doğruluğunu, bütünlüğünü ve gizliliğini teyit eden değeri kendi sistemlerine günlük olarak kaydetmek ve bu verileri iki yıl süre ile saklamak, f) … işyerinin kapatılmasının veya devrinin on beş gün içinde yetkili mülki idare amirliğine bildirmek ve izin belgesini teslim etmek."

"The obligations of commercial internet public use providers are as follows: a) To obtain an operating permit from the local civil authority, b) To use a content filtering system and a safe internet service in order to take measures to protect the family and children and to prevent access to content that constitutes a criminal offense, c) To keep the content filtering system in use active and up to date, preventing it from being disabled by any intervention, ç) To obtain a fixed IP from access providers, to use a fixed IP, and to notify the local civil authorities of any change of fixed IP within fifteen days, d) To record access logs electronically on their own systems and retain them for a period of two years, e) To record on their own systems, on a daily basis, the information recorded under subparagraph (d) and the value confirming the accuracy, integrity and confidentiality of that information, and to retain this data for a period of two years, f) … to notify the competent local civil authority of the closure or transfer of the business within fifteen days and to surrender the operating permit."

Regulation on Internet Public Use Providers (2017), Art. 5/1 — mevzuat.gov.tr — unofficial translation

Each of these six items belongs to a different responsible party; let's look separately at which is met by your business and which by izgate:

• a) Operating permit: Obtained from the local civil authority (governor/district governor); a Business Opening and Operating License is required first (Art. 6). This is a purely administrative process; izgate does not provide this permit or stand in for it.
• b, c) Content filtering + safe internet: Provided through your firewall's (FortiGate, MikroTik, pfSense, OPNsense) web filter; keeping it active and up to date is the business's job. izgate is not the filter itself; it collects, retains, and reports the blocking records the filter produces.
• ç) Fixed IP: Obtained from your access provider, with any change notified to the local civil authority within 15 days; this too is your business's job.
• d) Two-year electronic records: This is izgate's core job — access records, including internal IP, MAC, destination IP/port, NAT (real) IP/port, and timing information, are kept electronically and retained by default for two years.
• e) Daily integrity value: izgate chains every archive segment with SHA-256, signs it with Ed25519, and obtains a qualified timestamp from Kamu SM once a day; an automatic integrity check runs every night. This process satisfies the obligation to produce, on a daily basis, the value confirming the accuracy, integrity, and confidentiality of the recorded information.
• f) Closure/transfer notification: An administrative notification; this is your business's job.

In other words: content filtering is not izgate's own feature — it is done by your firewall's web filter, while izgate keeps and reports the records. The operating permit and the camera system are likewise outside izgate's scope.

Rules to be followed on the premises (Article 9)

Article 9 of the Regulation lists a set of premises rules that an internet cafe operator must follow; these are physical/administrative rules, independent of record-keeping:

"a) 12 yaşından küçükler, ancak yanlarında veli veya vasileriyle işyerlerine girebilirler. b) 15 yaşından küçükler yanlarında veli veya vasileri olmadan saat 20.00'den sonra işyerlerine alınmazlar. … ğ) Güvenlik amacıyla işyerlerinin giriş ve çıkışlarını görecek şekilde yüksek çözünürlüklü (en az 3 mega piksel) ve 'IR' (gece görüşlü) kamera kayıt sistemi kurulur. Bu sistem aracılığıyla elde edilen kayıtlar doksan gün süreyle saklanır ve bu kayıtlar yetkili makamlar haricindeki kişi ve kuruluşlara verilemez."

"a) Children under the age of 12 may only enter the premises accompanied by a parent or legal guardian. b) Children under the age of 15 may not be admitted to the premises after 20:00 without a parent or legal guardian. … ğ) For security purposes, a high-resolution (at least 3 megapixels) 'IR' (night-vision) camera recording system covering the entrances and exits of the premises shall be installed. Recordings obtained through this system shall be retained for ninety days and may not be given to any person or organization other than the competent authorities."

Regulation on Internet Public Use Providers (2017), Art. 9/1 — mevzuat.gov.tr — unofficial translation

The same article also lists a ban on the sale and consumption of tobacco/alcohol, prevention of rights infringements under Law No. 5846 on Intellectual and Artistic Works, the absence of electronic/mechanical gaming devices and machines, and a ban on operating games that could have a negative effect on the development of persons under 18. All of these relate to the physical operation of the premises; izgate is not a camera system and does not take on any of these rules — it covers only the record-keeping and integrity side.

Sanctions (Article 11 and Law Article 7/4)

When a violation of the Article 5 obligations is established, the applicable sanction is graduated:

"5 inci maddenin birinci fıkrasındaki yükümlülüklere aykırı hareket ettiği belirlenen ticari amaçla internet toplu kullanım sağlayıcılara, mülki idare amiri tarafından ilk ihlalde yazılı olarak uyarma; ihlalin devamı halinde üç güne kadar kapatma; ihlalin tekrarı halinde ise bin Türk Lirasından on beş bin Türk Lirasına kadar idarî para cezası vermeye mahalli mülki amir yetkilidir."

"The local civil authority is authorized to issue, to commercial internet public use providers found to have acted in violation of the obligations set out in the first paragraph of Article 5: a written warning for the first violation; closure for up to three days if the violation continues; and, if the violation is repeated, an administrative fine of between one thousand and fifteen thousand Turkish Lira."

Regulation on Internet Public Use Providers (2017), Art. 11/1 — mevzuat.gov.tr — unofficial translation

A violation of the Article 9 premises rules carries a separate sanction:

"9 uncu maddeye aykırılık halinde mülki idare amiri tarafından, 4/7/1934 tarihli ve 2559 sayılı Polis Vazife ve Salâhiyet Kanununun 6 ncı maddesinin birinci fıkrasının (d) bendi uyarınca idari para cezası verilir."

"In the event of a violation of Article 9, the local civil authority shall impose an administrative fine pursuant to subparagraph (d) of the first paragraph of Article 6 of the Law on Duties and Powers of the Police No. 2559, dated 4/7/1934."

Regulation on Internet Public Use Providers (2017), Art. 11/2 — mevzuat.gov.tr — unofficial translation

The Law itself repeats the same graduated sanction, specific to commercial providers:

"Bu maddede belirtilen yükümlülükleri ihlal eden ticari amaçla toplu kullanım sağlayıcılarına, ihlalin ağırlığına göre yönetmelikle belirlenecek usul ve esaslar çerçevesinde uyarma, bin Türk Lirasından on beş bin Türk Lirasına kadar idari para cezası verme veya üç güne kadar ticari faaliyetlerini durdurma müeyyidelerinden birine karar vermeye mahalli mülki amir yetkilidir."

"The local civil authority is authorized to decide, in accordance with the procedures and principles to be determined by regulation based on the severity of the violation, on one of the following sanctions for commercial public use providers who violate the obligations set out in this Article: a warning, an administrative fine of between one thousand and fifteen thousand Turkish Lira, or suspension of their commercial activities for up to three days."

Law No. 5651, Art. 7/4 — mevzuat.gov.tr — unofficial translation

All of these sanctions fall within the authority of the local civil authority and are applied according to the violation determined by the inspection commission (Art. 10); izgate does not provide a guarantee against penalties or inspection — it only helps you fully meet the record-keeping and integrity obligations in Article 5/1-d and -e. For more detail: 5651 Penalties and Sanctions, What Is a Public Use Provider?

An inspection, a request: an internet cafe example

What does izgate do, and not do, in an internet cafe?

For clarity, we separate the two:

• Terminal/user-matched recordsThe user assigned to each computer (via a user account or the firewall's own user method) is matched with the internal IP, MAC, destination, NAT IP/port, and timing information.
• Two-year electronic recordsAccess records are kept in parallel in the live database and the signed archive on a separate disk, for a default period of two years.
• Daily integrity valueSHA-256 chain + Ed25519 signature + one qualified timestamp from Kamu SM per day; automatic verification every night.
• A package ready for an authority requestFor a requested date range, it's exported as a signed package containing a README, catalog, segments, manifest, and timestamp certificate.
• 17 ready-made reportsUsage, security, and access reports are available as PDF/Excel/CSV, and can be scheduled to be sent by email.

How is it deployed in an internet cafe?

Activating the content filtering system and the operating-permit/fixed-IP/camera processes are outside this deployment; these are completed through your firewall's web filter settings and your business's own administrative processes.

Compliance checklist for internet cafes

• Has an operating permit been obtained from the local civil authority? (Art. 5/1-a)
• Is the content filtering system and the safe internet service active and up to date? (Art. 5/1-b, c)
• Has a fixed IP been obtained, with any change notified within 15 days? (Art. 5/1-ç)
• Are access records being recorded electronically and retained for two years? (Art. 5/1-d)
• Is the records' daily integrity value (signed archive + timestamp) being produced? (Art. 5/1-e)
• Are children under 12 not admitted without a parent/guardian, and those under 15 not admitted after 20:00 without one? (Art. 9/1-a, b)
• Is a security camera (at least 3MP, IR) installed, with recordings retained for 90 days? (Art. 9/1-ğ)
• Are the bans on tobacco, alcohol, gaming machines, and inappropriate content being observed? (Art. 9/1-c, d, f, g)

Frequently asked questions

This page is for information only; for the current text of the legislation, refer to the official source (mevzuat.gov.tr).