bt_bb_section_bottom_section_coverage_image

Cookie Consent and Tracking Compliance in Turkey

Cookie Consent and Tracking Compliance in Turkey

Cookie Consent and Tracking Compliance in Turkey

Your GDPR cookie banner is not automatically compliant in Turkey, and the gaps are specific enough to name.

Turkey’s Personal Data Protection Authority published a dedicated Guide on Cookie Applications, first issued in final form on 20 June 2022 and subsequently updated. It sets out rules that overlap substantially with European practice but diverge in ways that catch foreign brands: accept, reject and preferences options must be presented to the user equally; the information notice is a separate obligation from consent and covers every cookie including strictly necessary ones; and merely entering a site is expressly not consent.

On top of that sits a decision from the Personal Data Protection Board addressing cookie use in the e-commerce sector, which concluded that advertising and marketing cookies are subject to explicit consent and cannot be run on a legitimate interest basis.

For a marketing team, this is not an abstract legal matter. It determines whether your analytics data is lawful, whether your retargeting audiences can be built, and whether your conversion tracking works at all. This guide covers what the guide requires, which cookies escape consent, what valid consent looks like in practice, and how to configure a measurement stack that survives it.

Table of Contents

Why a GDPR banner is not enough

KVKK, Turkey’s Law No. 6698, applies to the processing of personal data of individuals in Turkey regardless of where the controller is established. Cookies that identify a user or a device process personal data, which brings analytics, advertising and social plugin cookies into scope when they can be linked to an identifiable person.

Foreign brands typically arrive with a consent management platform configured for European requirements and assume it transfers. Much of it does. What does not transfer cleanly are four things:

  • Button parity. The Authority’s guidance indicates that accept, reject and preferences options should be presented to the user on an equal footing. A banner with a prominent “Accept All” and a buried or absent reject route is the most common defect.
  • The separate information notice. Turkish law treats the aydınlatma obligation as distinct from consent, and it covers all cookies — including those that need no consent.
  • The legal basis map. Turkish processing conditions are not identical to the GDPR’s, and “legitimate interest” does not do the same work here, particularly for advertising cookies.
  • Cross-border transfer. Most of your tags send data abroad, and Turkey’s transfer regime has its own mechanics, amended in 2024.

The broader framework, including VERBİS registration and representative requirements, is covered in our guide to KVKK compliance for foreign brands marketing in Turkey. This article deals specifically with the cookie and tracking layer.

The guide that sets the rules

The Guide on Cookie Applications is the reference document. Prepared in draft in September 2021 and published in final form on 20 June 2022, it has since been updated by the Authority.

Its scope is broad: cookies and cookie types, the relationship between Electronic Communications Law No. 5809 and KVKK, the rules to observe for cookies, scenarios where cookies may be used under processing conditions other than explicit consent, scenarios requiring explicit consent, the elements of lawfully obtained consent, cross-border transfer, and how to provide proper information. It covers all technologies that process personal data using cookies — not only cookies in the narrow technical sense.

Usefully for a compliance project, the guide closes with a checklist for data controllers. Its items include understanding what cookies are and what they are used for, implementing a consent mechanism that lets users control the settings of all non-strictly-necessary cookies, ensuring those consent mechanisms comply with the Law, retaining cookie consent records for an appropriate period, documenting all of the above, and setting a review period.

Because the guide has been updated since first publication, work from the current version on the Authority’s website rather than from a summary — including this one.

The default position is that cookies processing personal data require the data subject’s explicit consent. Two routes avoid that requirement, and both are narrow.

Strictly necessary cookies. The Authority describes these as cookies mandatory for a website to perform its basic functions and to provide a requested information society service. Where personal data is processed through such cookies, explicit consent is not required.

Other lawful processing conditions. The guide contemplates cookie use under KVKK’s other processing conditions. Legal analysis of the guide gives the example of a user adding a product to a basket on an e-commerce site: personal data may be processed there without explicit consent, on the basis that processing is necessary for the establishment or performance of a contract, provided it is directly related to it. The guide also treats cookies used for the purpose of carrying out communication over an electronic communications network as processable without explicit consent.

Everything else — analytics, advertising, retargeting, social media plugins, personalisation — needs consent before the cookie is set.

The practical exercise is a cookie audit that classifies every tag on your Turkish site against these categories, with a reasoned basis for each. “We think it is essential” is not a classification; “this cookie maintains the session for a service the user requested” is.

Turkish requirements for valid cookie consent are demanding, and several are more explicit than what many European banners implement.

An active action is required. The Authority’s guidance is clear that obtaining explicit consent requires the user to take an active action, and that merely entering the site does not constitute consent. Continued browsing, scrolling and pre-ticked boxes do not qualify.

Options must be equal. In consent mechanisms, “accept”, “reject” and “preferences” options should be offered to the user equally. This is the specific point where a standard “Accept All” banner with a small “Manage” link fails.

Users must be able to manage preferences easily. Users should be able to manage their cookie preferences clearly, comprehensibly and accessibly. Practical compliance guidance describes this as requiring a persistent cookie settings link or icon reachable from every page of the site.

Consent must be withdrawable. Since a data subject may withdraw explicit consent at any time, cookie consent must be withdrawable too — and in practice as easily as it was given.

Specificity matters. The guide sets out elements of lawfully obtained consent, including stating the cookie’s purpose, a cookie duration determined proportionately to that purpose, and whether the cookie is first or third party.

Records must be kept. The guide’s checklist includes retaining cookie consent records for an appropriate period and documenting the arrangements. A consent you cannot evidence is a consent you cannot rely on.

The information notice is separate

This is the obligation foreign teams most often miss entirely, because in practice many European implementations fold it into the consent banner.

Under Turkish law the aydınlatma — the information notice — is a distinct obligation from obtaining consent. Compliance guidance is explicit that it is entirely separate from taking consent and that it covers all cookies on your site, including the mandatory ones that require no consent at all.

Three further points from the guidance:

  • Timing. For personal data processing carried out through cookies, the information obligation should be fulfilled at entry to the website.
  • A privacy policy is not an information notice. The Authority has assessed that information must be provided clearly, plainly and comprehensibly with all its elements, and that a complex privacy notice covering many other subjects on the website cannot be interpreted as fulfilling the information obligation.
  • Where consent is the basis, the two processes are handled distinctly. Providing information and obtaining consent are separate operations and should be designed as such.

The practical implication for a Turkish site is that you need a dedicated, plain-language cookie information text — separate from your general privacy policy and separate from the consent interface — reachable at entry.

Third-party tags and shared liability

Marketing stacks run on third-party tags, and Turkish guidance addresses them directly.

Where personal data is processed through third-party cookies, both the website owner and the relevant third party are obliged to ensure users are clearly informed and to obtain their consent. The obligation does not stop at your own domain.

For a foreign brand this has an uncomfortable consequence: every advertising pixel, analytics tag, heatmap tool, chat widget and A/B testing script on your Turkish site is your compliance exposure as well as the vendor’s. The controls that follow are practical rather than legal:

  • Inventory every tag actually firing on the Turkish site, including ones added by agencies or contractors and forgotten.
  • Block non-essential tags until consent. A CMP that displays a banner while tags fire underneath is decorative.
  • Check tag manager configuration specifically, since consent gating is frequently implemented on the banner and not on the container.
  • Include cookie obligations in agency contracts, alongside the other compliance criteria covered in our guide to choosing a digital marketing agency in Turkey.

The e-commerce decision on advertising cookies

Beyond the guide, the Personal Data Protection Board has addressed cookie practices in a specific sector decision.

The Board’s decision numbered 2022/229, dated 10 March 2022, set out the limits of cookie use in the e-commerce sector. Legal commentary on it describes the Board as concluding that advertising and marketing cookies are subject to explicit consent, and that a legitimate interest justification cannot be relied on to operate them.

For a marketing team, that closes the most common workaround. Running advertising or retargeting cookies on a legitimate interest basis — an approach some European implementations have used for analytics or fraud prevention adjacent purposes — is not available for advertising cookies in Turkey.

This bears directly on retargeting programmes, which depend on cookies set before the user has converted. Our guide to retargeting and remarketing in Turkey covers the channel; the constraint here is that your addressable audience is limited to users who actively consented.

Cookie walls — blocking access to content unless the user accepts cookies — are addressed in the Authority’s updated guidance, which notes that such practices may be capable of preventing the user from giving explicit consent through free will, and that this must be carefully assessed in terms of the validity of consent.

That is a caution rather than an outright prohibition, but the direction is clear and it aligns with the broader Turkish principle that consent cannot be made a condition of service. For a commercial site, the safer design is one where declining non-essential cookies leaves the site functional.

This connects to a point worth making to stakeholders who see consent as pure friction: a site that works when cookies are declined loses measurement on those users, not the users themselves.

Cross-border transfer: the part that catches ad tech

Almost every marketing tag sends data outside Turkey, and the guide addresses cross-border transfer as one of its core subjects.

Turkey’s transfer regime was amended in 2024, introducing additional transfer mechanisms alongside the existing framework. If your Turkish transfer analysis predates that change, it is out of date — and for most foreign brands, the analysis was never done at all, because the tags were inherited from a global template.

The practical question to put to your legal advisor is not “are we KVKK compliant” but something more specific: on what basis does each of our marketing vendors receive Turkish personal data outside Turkey, and is that basis documented? Analytics, advertising platforms, CDPs, email platforms and CRM systems all need an answer.

Because the mechanics are technical and recently changed, this is the part of cookie compliance that genuinely requires Turkish counsel rather than a platform configuration.

What this does to your measurement stack

Compliance is not free, and pretending otherwise leads teams to implement badly. Three effects are predictable.

You will measure fewer users. Consent-gated analytics means a share of Turkish traffic is invisible in your reporting. That is not a bug to engineer around; it is the outcome the rule intends. The operational response is to understand your consent rate and interpret data accordingly rather than to treat reported numbers as total traffic. Our GA4 and marketing analytics setup guide for Turkey covers the configuration side.

Retargeting audiences will be smaller. Audience sizes built from consented users only will be a fraction of total traffic. Plan minimum audience thresholds accordingly, and expect some audiences never to reach usable size.

Conversion tracking needs deliberate design. Where conversion measurement depends on cookies set before consent, the measurement fails. Server-side approaches and consent-aware configurations exist, but they change what is measured rather than restoring it — and they carry their own data protection questions that should be reviewed rather than assumed to solve the problem.

The honest framing for stakeholders is that Turkish measurement will show less than a non-compliant implementation would, and that the alternative is an unlawful basis for the data you are reporting.

Choosing and configuring a CMP

A consent management platform is the practical instrument, but the configuration matters more than the vendor.

What to require of the implementation:

  • Genuine blocking. Non-essential tags must not fire before consent, verified by inspecting network requests rather than by trusting the CMP dashboard.
  • Equal options. Accept, reject and preferences presented on an equal footing in the first layer.
  • Category-level control so users can consent to some purposes and not others.
  • Turkish language for the banner, the categories and the information text — not a translated string file with untranslated category names.
  • A persistent settings entry point on every page.
  • Consent logging with timestamp and the specific purposes consented to, retained for an appropriate period.
  • A separate cookie information text, distinct from the privacy policy.

Implementing this correctly is web development work sitting alongside legal review: the texts come from Turkish counsel, and the tag gating, container configuration and logging are a build. That combination of web and software capability alongside marketing is the kind of work agencies such as Medyae handle, though the legal texts themselves should always come from a qualified Turkish lawyer.

One caution on vendor selection. Several international CMPs market themselves as KVKK-ready. Treat that as a starting point rather than a conclusion — the defect is almost always in how the specific site is configured, not in the platform’s capability.

Common mistakes

Reusing the European banner unchanged. Button parity, the separate information notice and the transfer analysis do not carry over.

Firing tags before consent. A banner over a live tag manager is not compliance.

Treating the privacy policy as the information notice. The Authority has assessed that a complex notice covering many subjects does not discharge the obligation.

Running advertising cookies on legitimate interest. Board decision 2022/229 addresses this directly for the e-commerce sector.

Omitting mandatory cookies from the information text. The notice covers all cookies, including those needing no consent.

No persistent settings link. Withdrawal must be as easy as consent.

Not logging consent. Records for an appropriate period are on the Authority’s own checklist.

Assuming cookie consent covers commercial messaging. İYS obligations under Law No. 6563 are separate, as our guide to email marketing in Turkey sets out.

Frequently asked questions

Does KVKK require cookie consent?

Yes, for cookies that process personal data, subject to narrow exceptions. Strictly necessary cookies — those mandatory for a site’s basic functions and for providing a requested information society service — do not require explicit consent, and cookies used to carry out communication over an electronic communications network are also treated as processable without it. Analytics, advertising, retargeting and social plugin cookies require consent before being set.

Is my GDPR cookie banner enough in Turkey?

Usually not without changes. Turkish guidance indicates accept, reject and preferences options should be presented equally, treats the information notice as a separate obligation covering all cookies including mandatory ones, and has its own cross-border transfer mechanics amended in 2024. Review the banner, the information text and the transfer basis for each vendor.

Can I rely on legitimate interest for advertising cookies in Turkey?

Commentary on the Personal Data Protection Board’s decision numbered 2022/229, dated 10 March 2022, describes advertising and marketing cookies in the e-commerce sector as subject to explicit consent and not operable on a legitimate interest basis. Treat consent as the required route and confirm your specific position with Turkish counsel.

Are cookie walls allowed in Turkey?

The Authority’s guidance notes that cookie wall practices may be capable of preventing users from giving explicit consent through free will, and that this must be carefully assessed for the validity of consent. The safer design is a site that remains functional when non-essential cookies are declined.

Do I need a separate cookie policy as well as a privacy policy?

In practice yes. The information obligation is separate from consent, covers all cookies including strictly necessary ones, should be fulfilled at entry to the site, and the Authority has assessed that a complex privacy notice covering many other subjects does not discharge it.

What happens to my analytics and retargeting if users decline?

You measure fewer users and build smaller audiences. Consent-gated analytics will under-report Turkish traffic relative to actual visits, and retargeting pools will be limited to consented users. Plan audience thresholds and interpret reporting with your consent rate in mind rather than engineering around the requirement.

Conclusion

Cookie compliance in Turkey is one of the few areas where a foreign brand can be substantially non-compliant while believing it has already solved the problem, because the European banner looks like the answer. The divergences are narrow but real: equal accept and reject options, a separate information notice covering every cookie, an explicit consent requirement for advertising cookies with no legitimate interest fallback, and a cross-border transfer regime that was amended in 2024.

The work is a sequence rather than a purchase. Audit the tags actually firing on your Turkish site, classify each against the processing conditions, get Turkish counsel to write the information text and confirm the transfer basis for each vendor, then configure the CMP to block properly and log consent. Verify by inspecting network requests, not by trusting a dashboard.

Expect to measure less than you did before, and plan around that honestly. The alternative is reporting on data you have no lawful basis to hold.

This article is general information based on published guidance and reported regulatory decisions as at the date shown. It is not legal advice. Guidance documents, Board decisions and transfer rules change, and the treatment of any specific implementation depends on its facts. Confirm your position with qualified Turkish legal advisors before acting.