KVKK: Türkiye's cookie and consent rules

What is the KVKK?

Law No. 6698 on the Protection of Personal Data, known by the initials of the Authority that enforces it, KVKK, was published in Türkiye's Official Gazette on 7 April 2016. It was modeled on the EU's 1995 Data Protection Directive rather than the GDPR, which explains some differences: a stronger role for explicit consent, a public registry of controllers (VERBİS), and a Board that publishes decisions and fines. Law No. 7499, in force since 1 June 2024, modernized the rules on special categories of data, cross-border transfers (adequacy decisions, standard contracts, binding corporate rules) and appeals against Board decisions, bringing the law closer to the GDPR. The Authority's Guideline on Cookie Practices, first published on 20 June 2022 and reissued in an updated edition in July 2025, is the reference for websites.

Who does the KVKK apply to?

The law applies to natural persons whose personal data is processed and to the natural and legal persons that process it, with no size threshold. It does not contain an explicit territorial clause, but the Board applies it to foreign controllers that process the data of people in Türkiye, who must appoint a representative and register in VERBİS, and it has fined foreign companies, including Amazon's Turkish entity in 2020 and several global platforms since.

What does the KVKK require for cookies and consent?

Article 3 defines explicit consent as freely given, specific and informed consent. Article 5 makes it the default condition for processing, with exceptions in Article 5(2) when the law provides for the processing, when it is necessary for a contract with the data subject, to comply with a legal obligation, when the data was made public by the data subject, to establish or protect a right, or when it is necessary for the legitimate interests of the controller without harming the data subject's fundamental rights. Article 10 requires the controller to inform data subjects, when the data is obtained, of its identity, the purposes, the recipients, the method and legal basis of collection and their rights.

The cookie guideline translates this for websites. Cookies that process personal data need a condition of processing, and the guideline borrows two exemption criteria from the European ePrivacy framework:

• Criterion A: the cookie is used solely to carry out the transmission of a communication over an electronic communications network (load balancing session cookies, for example).
• Criterion B: the cookie is strictly necessary to provide an information society service explicitly requested by the user. The guideline lists user-input cookies, authentication cookies, user-centered security cookies, media player session cookies, interface personalization cookies, cookies used by the consent management platform itself, first-party analytics cookies and website security cookies as examples that can meet criterion B and therefore do not need explicit consent, provided they do nothing beyond that purpose.

Everything that does not meet criterion A or B needs explicit consent, and the guideline names the two main cases: social plug-in tracking cookies set for people who are not logged in or did not request the plug-in, and online behavioral advertising cookies, including those used for frequency capping, attribution, click fraud detection and market research, because none of those is a service the user asked for.

Explicit consent must be specific, informed and freely given. The guideline says that a general statement such as "I accept the processing of my personal data" is not explicit consent, that merely visiting a site does not express consent, that the purpose, the lifetime and the first- or third-party nature of each cookie must be explained, that consent must be as easy to withdraw as to give, with a small icon or band to reopen the panel, and that asking on every visit creates consent fatigue, so the choice should be remembered and refreshed in proportion to the cookie lifetime. A cookie wall that blocks the content until all cookies are accepted can invalidate consent unless fair alternatives exist. The guideline's model is a panel at site entry with Accept, Reject and Preferences buttons of equal size, color and font, plus the Article 10 information.

What must a compliant banner do?

• Set no non-essential cookie before the visitor's active choice.
• Present Accept, Reject and Preferences with equal prominence on the first layer, in Turkish for visitors in Türkiye.
• Explain each cookie's purpose, lifetime and whether it is first or third party, and link to the Article 10 information notice.
• Remember the choice, offer withdrawal through a visible icon, and keep records of consent.
• Cover cross-border transfers: most analytics and advertising providers process data abroad, which since 1 June 2024 requires an adequacy decision, a standard contract notified to the Authority within five business days, or another safeguard under Article 9.

Enforcement and fines

Article 18 sets administrative fines in bands that the Authority re-values every year with the official revaluation rate: the 2016 amounts were TRY 5,000 to 100,000 for breaches of the duty to inform, TRY 15,000 to 1,000,000 for data security breaches, TRY 25,000 to 1,000,000 for ignoring Board decisions and TRY 20,000 to 1,000,000 for registry breaches. With the 25.49% rate published for 2026, the ceilings are TRY 1,709,200 for the duty to inform and TRY 17,092,242 for data security, Board decisions and registry breaches. Fines are per breach, and the Board publishes decision summaries.

The reference cookie decision is the Board's decision 2020/173 of 27 February 2020 on Amazon Turkey, which the guideline itself analyzes. The Board imposed TRY 1,200,000 in total: TRY 1,100,000 for failing to take the data security measures required by Article 12 (consent for marketing emails and transfers abroad was not validly obtained) and TRY 100,000 for breaching the duty to inform under Article 10, because the site gave no information about processing through cookies and asked for no consent through a pop-up or similar means. The Board has since published many decisions on unlawful marketing messages and transfers, and the updated 2025 guideline signals that cookie compliance remains on its agenda.

How Cookiequiet handles the KVKK

Türkiye is in Cookiequiet's list of regulated countries, so with geo-targeting on, Turkish visitors see the consent banner with Turkish strings picked from the browser language. The default layout matches the guideline's model: Accept all and Reject all of the same size and weight, a Customize button that opens per-category toggles switched off by default, nothing pre-ticked, and a way back to the preferences center on every page. Scripts and embeds are held until consent for their category, and the consent log records each choice. Cookiequiet's policy templates are written for the GDPR and other laws, not specifically for the KVKK's Article 10 notice, so prepare the Turkish information notice and the transfer paperwork with your advisor. See also switching from CookieYes if you are replacing an existing banner.