The Turkish DPA published draft cookie guidelines on 11 January 2022 for public consultation. The draft guidelines set out requirements related to the use of cookies and provide recommendations for website operators. Check out the cookie guidelines of Turkey’s DPA here.
Turkish DPA - KVKK has published its draft cookie guidelines in early 2022. The draft guidelines aim to shed light on how the supervisory authority would treat the use of cookies by website operators and operators of mobile applications.
The Turkish Personal Data Protection Law No. 6698 (Kişisel Verileri Koruma Kanunu, or KVKK) went into effect on 7 April 2016. The KVKK is the first specific law in Turkey that regulates the protection of personal data in Turkey. Prior to the KVKK, data protection was regulated by sectoral laws as well as the Constitution of Turkey and the Turkish Penal Code.
Explore more privacy compliance insights and best practices
The Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) is the national data protection authority in Turkey. The Turkish DPA is a legal entity with administrative and financial independence. It was established to carry out the duties delegated to it by the Turkish Data Protection Law, KVKK.
On 11 January 2022, the Turkish DPA published the Draft Guidelines on the use of cookies for public consultation. The Draft Guidelines are not final yet and may be subject to changes based on the comments received from other stakeholders.
The main focus of the Draft Guidelines is determining whether the use of various cookie types requires explicit consent of the data subjects. The assessment is based on two criteria: The first criterion covers the use of cookies for the sole purpose of carrying out or facilitating the transmission of communication over an electronic communications network; and
According to the assessment, the Turkish DPA sets out the types of cookies that require explicit consent and those that do not require prior consent.
The following cookies require the prior explicit consent of the data subjects:
The following cookie types may be used without prior explicit consent of the data subjects:
According to the Draft Guidelines, the first-party analytics cookie may be used without prior explicit consent of data subjects only under certain circumstances. These include:
(i) use of first-party analytics cookies concerns only the generation of anonymous statistics;
(ii) user's internet browsing is not used to track them across different websites;
(iii) cookie lifespan of cookies is reasonable; and
(iv) data collected through cookies must not be communicated to third parties.
The Draft Guidelines set out requirements for obtaining explicit consent. The Turkish DPA specifies that the consent must be specific, informed, and freely given.
Specific consent. The cookies’ purposes, duration, and information about whether they are first or third-party cookies must be provided before consent collection. Providing generic information such as “I consent to the processing of my personal data” would not be specific and thus not valid.
Informed consent. The information must be provided before or at the time of collection of personal data. It must be easily accessible and noticeable, and the content of the information must be simple, easy to understand, and comprehensible.
Freely given. It must be easy to withdraw consent at any time. It is recommended to have a tiny icon or button linked to the cookie settings page remain visible all the time on the website.
It is recommended that the frequency of re-presenting to the users the cookie banner to obtain their cookie consent preferences should be limited. The Turkish DPA states that this would cause “consent fatigue” and affect users’ free will. However, it is not suggested how many months must be elapsed before you should ask for a renewal of consent.
It is further recommended to have the “Accept,” “Reject,” and “Preferences” buttons presented of the same color and size.
Besides, the cookie banner should include a link to the privacy policy, and cookies that require prior consent must be un-ticked. Learn how to make a compliant cookie banner.
The Turkish DPA considers the use of cookie walls to be unlawful. This is because the cookie walls prevent the users from making a free choice based on their free will.
The Draft Guidelines are not legally binding under Turkish law. Still, they are important because they present the Turkish DPA’s approach and expectations on the relevant matter and shed light on the logic behind the decisions of the DPA.
The Draft Guidelines provide examples of compliant and non-compliant cookie banners:
1) The following 2-layer cookie banner is provided as an example of good practice by the Turkish DPA:
Layer 1
Layer 2
2) The following cookie banner is an example of a non-compliant cookie banner:
There is no option to reject the cookies
It is not clear whether the “More information” link redirects to the cookie preference panel or cookie policy (it must be clearly distinguishable)
3) The following cookie banner is an example of a non-compliant cookie banner:
4) The following example is a non-compliant cookie banner:
Secure Privacy comes packed with enterprise-level features that will help you fully comply with Draft Guidelines cookie guidelines and the GDPR (Check out the EU Cookie Guidelines)..
The main features are:
A future-proof GDPR compliance solution that is also compliant with CCPA in California and LGPD in Brazil
Read our blog to get a simplified breakdown of the latest EDPB Cookie Consent Guidelines.
Book a call today if you want more information about Secure Privacy and GDPR Cookie Consent compliance or if you would like our data protection expert to perform a quick 'check-up' of your website, cookie consent banner, or cookie policy.
Schedule a call to learn more
Turkey DPA official website
Turkey DPA Draft Cookie Guidelines (available in Turkish)
