KVKK (Türkiye)
The law as we understand it on 5 November 2026. See the overview for what these pages are and are not.
What the law asks
Cookies on a website that reach people in Türkiye fall under the Personal Data Protection Law No. 6698 (KVKK). The Personal Data Protection Authority's cookie guideline (first published June 2022, updated edition July 2025) explains how it applies.
Without explicit consent you may only use cookies that transmit a communication, or that are strictly necessary for a service the visitor explicitly asked for. The guideline also counts the consent tool's own cookie here, and first-party analytics when it is limited to audience measurement, produces anonymous statistics only, is minimised (for example a masked IP) and does not track across sites.
Everything else — behavioural advertising above all, including ad measurement and frequency — rests on a legal ground of Article 5 or 6, which in practice means explicit consent (açık rıza). The guideline says valid explicit consent is:
- an active act — entering the site is not consent;
- specific: the purpose, duration and first or third party of each cookie are stated;
- informed and free: not bundled into terms of use, not a condition of a contract;
- obtained before the cookie is set.
It describes good practice for the banner: Accept, Reject and Preferences of the same colour, size and font, consent-based cookies off by default, a small icon or band that reopens the panel so consent can be withdrawn at any time, and not asking again on every visit. A cookie wall may make consent invalid.
Two duties sit next to consent:
- The notice (aydınlatma) must be given at the latest when data is collected, whatever the legal ground, and you carry the burden of proof. It is a separate step from asking for consent; a Board principle decision published on 24 March 2026 again requires the two texts to be drafted separately.
- Transfers abroad (Article 9, in force since 1 June 2024) need an adequacy decision or a safeguard such as the Authority's standard contract, which must be notified to the Authority within five business days of signature. The guideline applies this to cookies whose data goes to providers abroad.
The KVK Board enforces; fines are revalued every year.
How ConnectWiz handles it
| The rule | In ConnectWiz |
|---|---|
| Explicit consent before non-essential cookies | Everything is denied before the visitor chooses. Türkiye cannot be opened by a region rule. |
| Equal Accept / Reject / Preferences | Drawn exactly alike on the first layer, whatever the template; every box starts empty. |
| Specific: purpose, duration, party | One row per category with its purpose, providers, the countries data may go to, and each cookie's name, provider, duration and party. |
| Withdrawal at any time | The cookie button stays on every page. |
| Not asking on every visit | A choice is kept 1–12 months after a yes, 6–12 months after a refusal. |
| Burden of proof | Every choice is recorded with its banner version and time. |
| Data abroad | The banner names the country each provider's data goes to. |
ConnectWiz does not use the guideline's analytics exemption: analytics stays off in Türkiye until the visitor accepts it.
What you still need to do
- Write your aydınlatma metni (privacy notice) and your cookie policy, and link the policy from the banner. The banner informs; it does not replace the notice.
- Transfers abroad: the banner shows where data goes, but the legal step is yours — usually a standard contract with each provider abroad and a notice to the Authority. ConnectWiz's own data is processed on servers in the United States; see the data processing agreement and the sub-processors.
- Keep the cookie list complete: scan your site and put the live cookie declaration on your cookie policy page.
- Commercial messages are a separate consent. A cookie choice is not permission to send e-mail, SMS or WhatsApp marketing; that goes through İYS.