Regulatory differences
This section is general information, not legal advice. Rules change, so check specific cases with your counsel.
Bulk messages need consent and İYS
Campaign texts, emails and similar commercial electronic messages require prior consent. Senders must register with İYS, Türkiye's message management system, and consents not recorded there are treated as invalid. You can message tradespeople and merchants without prior consent, but only after adding their addresses to İYS and checking they have not opted out. Payment reminders and delivery notices do not need consent, but they cannot carry promotion.
Source: Law No. 6563 on the Regulation of Electronic Commerce, Arts. 6 and 8 (mevzuat.gov.tr); Regulation on Commercial Communications and Commercial Electronic Messages, Arts. 5, 6 and 7, as amended in Official Gazette No. 30998 of January 4, 2020 (resmigazete.gov.tr)
A VERBİS exemption is not a data protection exemption
Businesses with fewer than 50 employees a year and an annual balance sheet total under 100 million Turkish lira are exempt from registering with VERBİS, the data controllers' registry, as long as their main activity is not processing special categories of data. Those who do not keep balance sheet books look at employee count alone, and much lower thresholds apply if special category data is your main activity. The exemption covers the registry and nothing else: if you collect customer details, you still have to say who you are and why you need them.
Source: Personal Data Protection Law No. 6698, Arts. 10 and 16 (mevzuat.gov.tr); Personal Data Protection Board Decision 2025/1572, Official Gazette No. 33034 of October 1, 2025 (resmigazete.gov.tr); Authority announcement of January 12, 2026 (kvkk.gov.tr)
Forms, consent and cookies
Do not tie “we will reply to you” and “we will send you campaigns” to a single checkbox. Türkiye's Personal Data Protection Board found that bundling unlawful in one decision, and a March 2026 principle decision requires the privacy notice and the explicit consent text to be separate. Cookie rules depend on purpose: the Board has found a non-essential analytics cookie unlawful without consent, while the Authority's July 2025 guide treats first-party analytics separately under narrow conditions. Please review the tools on your site against this with counsel.
Source: Personal Data Protection Board Decision Summary 2024/1361 (kvkk.gov.tr); Principle Decision 2026/347, Official Gazette No. 33203 of March 24, 2026 (resmigazete.gov.tr); Guide on Cookie Practices, July 2025 (kvkk.gov.tr)
Advertising rules do not shrink with you
A discount ad must state the previous price and the campaign dates. For goods, the previous price means the lowest price in the 10 days before the discount. Influencers who post in exchange for a product or service must mark the content with “Reklam” or “Tanıtım,” the Turkish words for advertisement and promotion. If you use AI-generated characters that cannot be told from humans, you must say so clearly, and you cannot run an ad in which a digital copy of a real person falsely recommends you.
Source: Regulation on Commercial Advertising and Unfair Commercial Practices, Arts. 14, 18(8), 23/A and 27(12), Official Gazette No. 33297 of July 1, 2026, in force since August 1, 2026 (resmigazete.gov.tr)
If you sell through your site
If contracts are formed on your website, you have to tell buyers up front who you are, what steps the contract involves and what your privacy rules are. Consumers must be informed before a distance purchase, and the rules on the right of withdrawal apply. Adding a cart is more than a technical step, so have counsel read your terms before you start selling.
Source: Law No. 6563 on the Regulation of Electronic Commerce, Art. 3 (mevzuat.gov.tr); Consumer Protection Law No. 6502, Art. 48 (mevzuat.gov.tr); Distance Contracts Regulation (mevzuat.gov.tr)