KVKK compliance for websites in Turkey: privacy notices, cookies and forms

Short answer: any website with a contact form, newsletter, membership or analytics tool processes personal data under Turkey's Law No. 6698 (KVKK). At minimum you need a privacy notice, explicit consent where required and a consent mechanism for non-essential cookies. This is a general guide; consult a lawyer for advice specific to your business.

Privacy notice

Wherever personal data is collected (forms, sign-ups, orders), people must be told who the data controller is, why and on what legal basis the data is processed, who it is shared with, how long it is kept and their rights under Article 11. The notice should be easy to find and linked next to forms.

When is explicit consent required?

Not every processing activity needs explicit consent; replying to a request or entering into a contract can rely on other legal bases. Marketing communication, however, requires explicit consent, and consent must not be a condition of the service — for example, forcing newsletter consent to download a file isn't right. Consent boxes must not be pre-ticked.

Cookies

Strictly necessary cookies don't need consent; analytics, advertising and personalization cookies are expected to require prior consent. A cookie banner should offer "reject" as easily as "accept" and show what is being allowed. If you use no analytics or ad cookies at all, you may not need a banner.

Transfers abroad

Many form services, email marketing tools and hosting providers are abroad, so using them means transferring personal data abroad under KVKK Article 9. Amendments in 2024 introduced new options such as standard contracts; confirm the right route with an expert and state the transfer clearly in your privacy notice.

Commercial electronic messages and İYS

Sending campaign emails or SMS requires prior consent under Law No. 6563 and registering those consents in the Message Management System (İYS). Every message must include an easy way to unsubscribe.

VERBİS

Registration in the data controllers' registry (VERBİS) depends on employee count, annual balance-sheet thresholds and the nature of the activity; many small businesses are exempt. Different rules apply to businesses whose main activity is processing special categories of data (e.g. healthcare), so clinics should check carefully.

What to do on the technical side

Link the privacy notice next to forms, put marketing consent in a separate optional checkbox, serve fonts and files from your own server where possible, remove unnecessary third-party scripts and use HTTPS everywhere. See the setup we use on our own privacy page.

We build this infrastructure into the sites we deliver from day one. Let's talk →