When you review a website against KVKK — Turkey’s Personal Data Protection Law No. 6698 — the first place to look is not the “KVKK” link in the footer. It’s the forms. The contact form, the sign-up screen, the newsletter box, the job application page, the live chat widget — these are the doors personal data walks in through. And on the vast majority of sites we review, every one of those doors follows the same pattern: a single checkbox above the submit button, labelled “I have read and accept the KVKK text” (in Turkish, the ubiquitous “Okudum, kabul ediyorum”).
That checkbox is put there in good faith, and it is almost always wrong. To see why, you need to separate two concepts.
This article is for general information purposes only and does not constitute legal advice.
A Privacy Notice and Explicit Consent Are Not the Same Thing
A privacy notice (aydınlatma metni) is a disclosure. At the moment you collect data, you must tell the data subject (ilgili kişi) who you are, the purpose you are processing the data for, to whom and for what purpose you may transfer it, the method of collection and the legal basis, and their rights under the law. This obligation exists for every processing activity, whatever your legal basis is. A privacy notice does not need to be “accepted” — it is a one-way notification.
Explicit consent (açık rıza), on the other hand, is a legal basis, and it is only needed when you cannot rely on any other legal basis. For it to be valid, three conditions must be met: it must relate to a specific matter, it must be based on information, and it must be given freely.
The practical consequences of that distinction:
- You don’t need consent to reply to an enquiry that came in through your contact form; a privacy notice is enough.
- If you want to add that same email address to your marketing newsletter, that is a separate purpose and requires a separate opt-in.
- The privacy notice and the explicit consent statement must be presented separately. The communiqué on the obligation to inform issued by the Personal Data Protection Authority (Kurum, “the Authority”) regulates this explicitly.
The 7 Mistakes We See Most on Websites
1. The “I have read and accept” checkbox
A privacy notice is not a contract to be accepted. The right approach is to show a visible link next to the form — “Privacy notice on the processing of your personal data” — and to use checkboxes only for processing that genuinely requires consent. You can collect an “I have read” statement if you like; but the words “I accept” show that you are confusing disclosure with consent.
2. Making the service conditional on consent
“To sign up, you must consent to marketing messages.” When provision of the service is made conditional on consent, the consent is not considered freely given and is invalid. The Personal Data Protection Board (Kurul, “the Board”) has issued numerous decisions to this effect.
3. Pre-ticked boxes
A checkbox that arrives ticked by default is not explicit consent. Consent must be given through an active action by the person.
4. Bundled consent in a single box
“I accept the processing of my data, its sharing with third parties, its transfer abroad and the sending of commercial messages to me.” Consent must relate to a specific matter. A separate box for each purpose, a separate decision for each.
5. Asking for consent when another legal basis applies
If you process an address to deliver an order or a tax number to issue an invoice, your legal basis is performance of a contract and legal obligation. Asking for consent here misleads the person: they assume their data will no longer be processed once they withdraw consent, but you are obliged to keep processing it.
6. Putting the same generic text everywhere
The data of a candidate on a job application form and the data of an e-commerce customer are processed for different purposes, kept for different periods and transferred to different recipients. A single “KVKK Privacy Notice” cannot describe all of that accurately. Prepare separate, short, context-specific notices per data subject group and present each one next to the relevant form.
7. Not recording consent
The burden of proof lies with the data controller (veri sorumlusu). If you cannot show that consent was obtained, it is treated as not obtained. We cover how to approach this technically further down.
Cookies: Your Banner Is Most Likely Non-Compliant
The Guideline on Cookie Practices published by the Authority in 2022 made the picture clear:
| Cookie type | Is explicit consent required? |
|---|---|
| Strictly necessary cookies (session, cart, security, load balancing, language preference) | No — a privacy notice is enough |
| Analytics cookies (including third-party analytics tools) | Yes |
| Advertising, retargeting and profiling cookies | Yes |
| Social media plug-in cookies | Yes |
Accordingly, compliant cookie management ensures the following:
- No script loads before consent. This is the most common violation: the banner sits on the screen, but the analytics and advertising tags have already started firing the moment the page opens. What matters is not that a banner exists, but that the tags wait for consent.
- The “Reject” option is as visible as “Accept”. On the same layer, the same size, equally easy. Hiding rejection behind three clicks undermines the consent.
- Categories are off by default.
- The user can change their preference later. There should be a permanent “cookie preferences” link in the footer.
- “By continuing to use the site you accept” is not valid. Scrolling a page does not count as an active declaration of will.
Technically, the cleanest solution is to tie every non-essential tag to a consent state:
<!-- Does not run until consent is given -->
<script type="text/plain" data-consent="analytics"
data-src="https://analytics.example.com/tag.js"></script>
<script>
function applyConsent(granted) {
document.querySelectorAll('script[data-consent]').forEach((el) => {
if (!granted.includes(el.dataset.consent)) return;
const s = document.createElement('script');
s.src = el.dataset.src;
document.head.appendChild(s);
});
}
</script>In addition, if your analytics tool’s servers are located abroad, the data you collect through cookies is also a cross-border data transfer.
Commercial Electronic Messages: KVKK Consent Is Not Enough
Marketing by email, SMS and phone call is subject not only to KVKK but also to Law No. 6563, the Law on the Regulation of Electronic Commerce. To send a commercial electronic message (ticari elektronik ileti) to individual recipients, you must obtain prior approval and record those approvals in the Message Management System (İleti Yönetim Sistemi, İYS). Offering an easy and free opt-out in every message is also mandatory.
These two approvals do not substitute for one another. On your newsletter form, the privacy notice for processing for marketing purposes and the commercial message approval should be set up together, but clearly.
Where Mobile Apps Stand
Everything said for the web applies to mobile apps too, with a few extra items on top:
- SDKs. Analytics, advertising, crash reporting and push notification SDKs each collect data. You cannot write an accurate privacy notice without knowing which one collects what and where it sends it.
- Device permissions. For location, contacts, camera and photos, request only the permission you genuinely need, at the moment you need it. The operating system’s permission dialog does not replace a KVKK privacy notice.
- Store declarations. Your data safety declarations on the App Store and Google Play must be consistent with your privacy notice and with the app’s actual behaviour.
- Account deletion. Users must be able to delete their account from within the app, and the deletion must actually trigger data destruction on the back end.
On mobile projects, addressing these at the design stage is far cheaper than fixing them after release — as we touched on in our mobile strategy article.
Being Able to Prove Consent
In a complaint, saying “this person gave consent” is not enough; you have to show it. A consent record should contain at least the following:
{
"subject_id": "u_48213",
"purpose": "marketing_email",
"granted": true,
"text_version": "consent-marketing-v3",
"channel": "web_signup_form",
"timestamp": "2026-09-02T09:41:12Z",
"ip": "203.0.113.24"
}The critical field is text_version: you need to be able to prove which text the person saw on screen that day. Version your texts and keep the old versions. Write withdrawals to the same table as separate records — not by overwriting — and make sure a withdrawn consent is automatically reflected in your marketing tools and in the İYS.
A 15-Minute Self-Audit
- Is there a form-specific privacy notice next to every form on your site?
- Are “I accept” boxes used only for purposes that genuinely require consent?
- Are there any consent boxes that are pre-ticked or made a condition of the service?
- Open your browser’s network tab and load the page in a private window: do analytics or advertising requests go out without you touching the cookie banner?
- Is the “Reject” button on the first screen?
- Can you show on what date, and against which text, a given user gave their consent?
The fourth item takes five minutes, and most of the sites we review fail that test.
Let’s Look at It Together
Writing the privacy notices and consent texts is half the job; the other half is making sure the forms, the cookie management, the consent records and the withdrawal flows actually do what those texts say. At IWWOMI we handle both sides together: we audit the data collection points of your site and app, build the texts around the real data flow, and implement the technical side. If you’d like to see where your site currently stands, get in touch.
If you’re curious about compliance as a whole, take a look at our 8-step KVKK roadmap.
Sources: Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform · Guideline on Cookie Practices — KVKK · Message Management System (İYS)
