Current Approaches to KVKK Compliance in Cookie Management
Güncelleme tarihi: 16 saat önce
Explicit Consent, Transparency Obligations and Data Controller Responsibilities on Websites
October 2026 | Alper Law Office
Introduction
Cookies play an important role in the operation of digital services. Used for various purposes, including managing user sessions, measuring website performance and delivering personalised content, cookies give rise to a range of obligations under personal data protection law.
Under Turkish Personal Data Protection Law No. 6698 (the “KVKK”), the lawfulness of personal data processing activities carried out through cookies must be assessed particularly in light of the decisions of the Turkish Personal Data Protection Board (the “Board”) and the Guidelines on Cookie Practices published by the Turkish Personal Data Protection Authority (the “Authority”).
In this context, merely publishing a cookie policy on a website may not be sufficient for companies to fulfil their legal obligations. Depending on the nature of the cookies used, it is important to identify an appropriate legal basis for processing, fulfil transparency obligations and obtain explicit consent where required.
1. Legal Nature of Cookies and Their Assessment under the KVKK
Cookies are technologies that may be placed on website visitors’ devices, enabling certain information to be stored or accessed.
Although the use of cookies does not automatically constitute personal data processing in every case, cookies that can be associated with IP addresses, user identities, device identifiers or online behavioural data may fall within the scope of the KVKK.
Cookies are generally categorised according to their purposes as strictly necessary cookies, functional cookies, performance and analytics cookies, and advertising and marketing cookies.
However, the classification of a cookie should be based not merely on its technical designation but on its actual purpose and functionality.
2. Is Explicit Consent Required for Strictly Necessary Cookies?
For cookies that are strictly necessary to enable the essential functions of a website, explicit consent may not be required where the relevant personal data processing activity can be based on an appropriate legal ground under Article 5 of the KVKK.
For example, cookies used to maintain session security, authenticate users or enable the essential operation of a website may fall within this category.
Nevertheless, the fact that a website operator considers a particular cookie useful does not necessarily mean that the cookie qualifies as strictly necessary under the law.
Whether a cookie is genuinely necessary must be determined by considering the nature of the service provided and the specific purpose for which the cookie is used.
3. Explicit Consent for Analytics and Marketing Cookies
One of the principal compliance issues encountered on websites is the use of non-essential cookies before obtaining valid explicit consent from visitors.
In its decisions dated 10 March 2022, numbered 2022/229, and 8 August 2024, numbered 2024/1361, the Turkish Personal Data Protection Board emphasised the importance of appropriate explicit consent mechanisms in relation to personal data processing through non-essential cookies.
Accordingly, analytics, advertising and marketing cookies for which no valid legal basis other than explicit consent is available should not be activated before the visitor has provided active consent.
Merely visiting a website, continuing to browse its pages or relying on pre-ticked consent options does not, in itself, establish valid explicit consent.
Under the KVKK, explicit consent must relate to a specific matter, be based on adequate information and be freely given.
4. How Should Cookie Consent Banners Be Designed?
The design of cookie consent banners is important not only from a user experience perspective but also for ensuring the validity of explicit consent.
The Authority's guidelines emphasise that users must be presented with clear and understandable choices.
In this regard, recommended practices include:
Providing clearly identifiable options to Accept, Reject and Manage Preferences.
Ensuring that acceptance and rejection options are equally accessible from a visual and functional perspective.
Keeping cookies that require explicit consent disabled by default.
Allowing users to make separate choices for different categories of cookies.
Enabling users to withdraw previously given consent.
Particular attention should be paid to avoiding misleading design practices that encourage or pressure users into accepting cookies.
5. Transparency Obligations and Cookie Policies
Under Article 10 of the KVKK, data controllers are required to inform data subjects about the processing of their personal data at the time such data is collected.
In the context of cookies, fulfilling this obligation requires providing clear and understandable information about the cookies used, including their names, purposes, providers, retention periods and legal bases for processing.
Accordingly, a cookie policy containing only general statements may not always be sufficient to satisfy the applicable legal requirements.
A website's Cookie Policy must accurately reflect the technologies actually deployed on the website.
Furthermore, personal data transfers carried out through third-party cookies, including potential international transfers of personal data, must be assessed under the relevant legal framework.
6. Managing Cookie Compliance within Companies
Cookie compliance involves considerably more than simply adding a pop-up banner to a website.
Companies should regularly identify the cookies deployed on their websites, assess newly integrated analytics or marketing tools and review the effectiveness of their existing consent mechanisms.
Where a website is operated through third-party service providers or external platforms, particular attention should be paid to identifying which cookies are placed by the applications and technologies being used.
In this context, companies are advised to:
Maintain an up-to-date inventory of cookies and similar tracking technologies.
Ensure that privacy notices and cookie policies accurately reflect actual personal data processing activities.
Regularly review the legal bases for processing personal data through cookies.
Implement technical mechanisms to prevent cookies requiring explicit consent from being activated before valid consent is obtained.
Review third-party integrations and potential international data transfers.
Periodically assess the effectiveness of cookie consent and preference management systems.
An effective compliance framework requires legal requirements and technical implementation to be considered together.
Conclusion
Cookie management constitutes an important component of personal data protection compliance for companies operating in the digital environment.
The decisions of the Turkish Personal Data Protection Board demonstrate that merely publishing a cookie policy or providing general information about cookies does not necessarily satisfy the applicable legal requirements.
Companies should therefore assess their use of cookies from both legal and technical perspectives, manage activities requiring explicit consent through appropriate mechanisms and regularly review their website infrastructure.
Effective cookie management contributes not only to regulatory compliance but also to strengthening users' control over their personal data.
Legal References
Turkish Personal Data Protection Authority, Guidelines on Cookie Practices. Official Source – KVKK
Turkish Personal Data Protection Board, Decision dated 10 March 2022, No. 2022/229. Official Source – KVKK
Turkish Personal Data Protection Board, Decision dated 23 December 2022, No. 2022/1358. Official Source – KVKK
Turkish Personal Data Protection Board, Decision dated 8 August 2024, No. 2024/1361. Official Source – KVKK
This article has been prepared for general informational purposes only and does not constitute legal advice.
© 2026 Alper Law Office. All rights reserved.
Yorumlar