Regulations

What is Türkiye’s KVKK, and how does it apply to website cookies?

KVKK commonly refers to Türkiye’s Personal Data Protection Law No. 6698. It regulates how personal data is collected, used, disclosed and protected, including information processed through website cookies.

The law was published in the Official Gazette on 7 April 2016, with certain provisions taking effect six months later.

For website operators, three obligations should be distinguished:

Obligation	What it means
Identify a processing condition	Determine which condition under the law permits the processing.
Inform the visitor	Explain the controller, purposes, collection method, legal basis, recipients and applicable rights.
Obtain explicit consent where required	Collect a specific, informed and freely given choice before the relevant processing begins.

The KVKK Authority’s cookie guidance explains how these requirements apply to cookie practices.

A privacy notice and explicit consent serve different functions. Publishing a notice does not itself obtain permission.

For KVKK cookie consent compliance, advertising and tracking cookies that require explicit consent should remain inactive until that consent is given. Using foreign analytics providers also requires a separate assessment of international personal data transfers under the applicable transfer rules.