INTRODUCTION: PERSONAL DATA AND IDENTITY INTEGRITY IN THE DIGITAL COMMUNICATION AGE
The settlement of social networks and digital communication platforms at the center of daily life has paved the way for individuals to form a digital identity, just as they have a physical existence. With the widespread use of visual platforms, photographs, name information, and digital content belonging to individuals have become easily accessible on the internet environment. However, this free movement in the digital realm brings along risks of the use of personal data by unauthorized persons and the violation of personal rights.
One of the violation types frequently encountered in practice is the creation of fake social media accounts by using an individual’s pictures and personal data without their consent and knowledge. Although there are cases where such acts are seen among the public merely as a violation of social network rules or an ethical fault; in light of the Turkish Penal Code and established judicial jurisprudence, the act in question constitutes a serious crime type attached to criminal sanctions. In this study, the legal nature of the act of opening an unauthorized account with another person’s photographs and information, the provisions of the Turkish Penal Code (TCK), the Court of Cassation’s approach to the issue, and the legal mechanisms that victimized individuals can apply to are examined.
I. LEGAL BASIS OF THE CRIME AND EVALUATION WITHIN THE SCOPE OF TCK ARTICLE 136
Article 136, located in the ninth section titled “Crimes Against Private Life and the Secret Realm of Life” of the Turkish Penal Code, penalizes the unlawful acquisition, dissemination, and provision to another person of personal data.
“Any person who unlawfully gives, disseminates, or acquires personal data to another person shall be sentenced to imprisonment from two years to four years.”
A. The Quality of the Photograph as “Personal Data”
In accordance with the articles in Article 3 of the Law on the Protection of Personal Data (KVKK) and Article 136 of the TCK, personal data refers to any information relating to an identified or identifiable natural person. In line with this definition, a person’s photographs clearly revealing their face and physical characteristics, name and surname information, contact data, and professional information are indisputably evaluated in the category of “personal data”.
Making an individual’s image a new profile picture or sharing it on a social media platform without their permission means processing the data unlawfully and disclosing it to the public.
B. The Problem of Unauthorized Use of Publicly Available Data
One of the misconceptions frequently fallen into by social media users is the thought that photographs made publicly available on the internet environment or on individuals’ own profiles can be freely used by everyone. According to the view adopted in judicial practice; the fact that data has been shared on a public platform does not mean that consent has been given for that data to be used for all kinds of purposes and endlessly. The fact that a person shared their photograph on their own account does not give legal validity to another person taking this photograph and using it by opening a new fake account.
II. COURT OF CASSATION PRACTICE AND JURISPRUDENTIAL COURSE
Criminal chambers of the Court of Cassation consistently evaluate the acts of opening a fake account with another person’s photographs and personal information within the scope of TCK Art. 136.
A. Typicality of the Act and Criminal Sanction
In Court of Cassation decisions, the following matters stand out in the act of creating an unconsented fake account:
- The detection or recording of the victim’s identifying data such as name, surname, and picture without consent constitutes the “acquisition” element;
- Presenting this data to the access of third parties over internet networks constitutes the “dissemination” element.
Accordingly; even fake accounts that do not contain another crime such as insult, threat, or fraud fall under the scope of TCK Art. 136 and are punished simply because they use another person’s information without authorization. These penalty decisions rendered by local courts are also upheld by the courts of appeal and the Court of Cassation.
B. Minority Opinions and Discussions
In some decisions that are not taken unanimously in judicial rulings, counter-views based on the principle of criminal law being the “last resort” (ultima ratio) can also find a place. In these views, in summary, it is argued that:
- In the use of images that are already publicly available on social media, broad interpretation of the “personal data” definition in TCK Art. 136 could strain the principle of legality in crime and punishment,
- In case the fake account remains in a passive state and does not carry the aim of misleading or harming any third person, the situation should be addressed under private law (compensation) or administrative sanction (KVKK) rather than criminal sanction.
Nevertheless, the dominant and in-force jurisprudential line of the Court of Cassation considers unconsented photograph usage directly as a violation of TCK Art. 136 and finds criminal conviction decisions in accordance with the law.
III. RELATIONSHIP OF THE ACT WITH OTHER CRIME TYPES AND AREAS OF LAW
The act of opening a fake account is not limited to a single crime type depending on the development of the concrete event and the purpose of use of the account, but may also cause different legal violations.
A. Occurrence of Additional Crimes (Qualified Forms)
As a result of activities carried out through a fake profile, the following crimes may also come onto the agenda:
- Insult and Slander / Defamation (TCK Art. 125, Art. 267): The account making posts that degrade the victim, damage their reputation, or making statements that constitute a crime on behalf of the victim.
- Qualified Fraud (TCK Art. 158/1-f): Securing financial benefit from the victim’s close circle or third parties through a fake identity by benefiting from the convenience provided by information systems.
- Violation of the Privacy of Private Life (TCK Art. 134): The images used relating to the victim’s intimate realm or carrying the characteristic of covert recording.
B. Private Law and Intellectual Rights Dimension
- Protection of Personal Rights (TMK Art. 24 and Art. 25): The person whose image is used without authorization can request the prevention, cessation of the attack on personal rights, and compensation for moral damages suffered within the framework of civil law.
- Rights on Pictures and Portraits (FSEK Art. 86): Pursuant to the Law on Intellectual and Artistic Works, pictures and portraits belonging to individuals, even if they do not possess the quality of a work, cannot be exhibited or presented to the public without consent.
IV. APPLICATION PROCESSES AND TECHNICAL / LEGAL STEPS FOR VICTIMS
The procedural steps that individuals experiencing victimization through a fake profile should follow are as follows:
- Determination of Evidence: The profile link of the account, username, shared images, and message logs should be recorded with screenshots in a manner containing time stamps.
- In-Platform Notification: Closure of the account should be requested through the impersonation account and violation report channels of the relevant social network.
- Blocking of Access (Law No. 5651): In case the content is not removed or the account is not closed, a decision for blocking access can be obtained by applying to the Criminal Court of Peace on the grounds of violation of personal rights.
- Criminal Investigation: A criminal complaint should be filed with the Chief Public Prosecutor’s Office pursuant to TCK Art. 136; identification of the perpetrator through IP and session logs should be requested via cybercrime units.
- Compensation and KVKK Application: A compensation lawsuit can be filed in the Civil Court of First Instance for moral damages suffered due to the violation; additionally, an administrative complaint can be submitted to the Personal Data Protection Board.
CONCLUSION AND GENERAL EVALUATION
Creating a fake profile in a social media environment by using another person’s photograph, name, and data without permission should not be seen as a simple act brought by the digital age. Article 136 of the Turkish Penal Code and established jurisprudence of the Court of Cassation clearly demonstrate that this behavior is a personal data violation crime subject to imprisonment sanctions. The fact that data was previously shared on a public medium does not strip the act of being a crime; an individual’s personal rights and privacy in the digital environment continue to be protected before the law.
SOME PRECEDENT DECISIONS ON THE ISSUES WE HAVE DISCUSSED
- COURT OF CASSATION 12TH CRIMINAL CHAMBER, E. 2025/5496 K. 2025/9062 D. 22.12.2025:
“…it was ruled that ‘AFFIRMATION of the judgment established regarding the conviction of the defendant (…) who opened a fake internet account on behalf of the victim by using the victim’s picture and telephone number, for the offense of unlawfully providing or acquiring data regulated in Article 136/1 of the TCK No. 5237…'”
- COURT OF CASSATION 4TH CIVIL CHAMBER, E. 2017/4253 K. 2019/3600 D. 26.06.2019:
“The plaintiff’s attorney stated that the defendant created a fake profile on social media by using the photograph and personal information belonging to the plaintiff (…), requesting the remedy of the moral damages occurred. (…) The lawsuit relates to a request for non-pecuniary compensation due to a tortious act.”
- COURT OF CASSATION 12TH CRIMINAL CHAMBER, E. 2025/1596 K. 2025/6627 D. 22.09.2025:
“(…) A conviction decision was rendered against the defendant who opened fake Facebook accounts on behalf of the complainant and sent messages (…) for the crime of unlawfully providing or acquiring data in Article 136/1 (…) of the TCK No. 5237. (…) Since it is understood that the acts were determined to be performed by the defendant (…), and the offense qualification fitting the acts and the sanctions were correctly determined (…) AFFIRMATION…”
- COURT OF CASSATION 12TH CRIMINAL CHAMBER, E. 2022/8948 K. 2025/731 D. 21.01.2025:
“…the conviction decision rendered against the defendant—who opened a fake account on the Facebook social media platform, shared a photograph taken at the intervenors’ engagement where they appear dancing together, and shared the telephone number belonging to the intervenor by writing insulting texts, presenting the photograph carrying the nature of personal data belonging to the intervenors to the view of others through a method that leaves no doubt of being unlawful due to the absence of grounds for justification—for the crime of unlawfully providing or acquiring data in a successive manner [TCK Art. 136/1, 43/1] fitting his act, is in accordance with procedure and law.”