Under Turkey's Personal Data Protection Law, the KVKK (Kişisel Verilerin Korunması Kanunu, Law No. 6698), a website needs explicit consent before setting any cookie that is not strictly necessary for a service the visitor asked for or used only to transmit a communication. That covers analytics, advertising and social media cookies. The rule comes from the Personal Data Protection Authority's guide on cookie applications, and from 1 January 2026 fines under the law range up to about TRY 17.1 million per violation.
What the KVKK is and how it applies to cookies
The KVKK came into force on 7 April 2016 and is Turkey's main data protection law. It applies to the processing of personal data of people in Turkey, and the Authority treats foreign websites that target Turkish users as within scope.
Cookies that identify a user or a device are personal data when they can be linked to an identifiable person. That brings analytics cookies such as _ga, advertising identifiers such as _fbp and session identifiers such as PHPSESSID within the law.
The Personal Data Protection Authority (KVKK Kurumu), through its Board, has published a "Guide on Cookie Applications" that sets out how websites should handle cookies. Turkey is one of many countries tightening cookie rules, as the privacy laws by region overview shows.
The cookie guide: two exceptions, one rule
The guide's default is that cookies need the user's prior explicit consent, unless they meet one of two narrow exceptions:
- Cookies whose sole purpose is to carry out a communication over an electronic network
- Cookies strictly necessary for a service the user has explicitly requested, such as a shopping basket or a login session
Every other cookie, from analytics to advertising, social media plugins and retargeting, needs active, informed and freely given consent before it is set. Pre-ticked boxes and consent by continued browsing do not count. A cookie banner for Turkish visitors therefore needs a panel where visitors choose cookie categories, with analytics and marketing off by default.
What explicit consent means under Article 3
Article 3 defines explicit consent as "freely given, specific and informed consent". For cookies, all three parts must hold at once.
Freely given means a real choice. Blocking the site unless every cookie is accepted, a so-called cookie wall, undermines it.
Specific means consent per purpose. A single "Accept all" with no category choices is not enough.
Informed means visitors know what they agree to. Your cookie policy should list each cookie's name, purpose, the party responsible (first or third party) and how long it is stored.
Decision 2026/347: consent and information texts must be separate
The Board adopted principle decision 2026/347 on 18 February 2026, and it was published in the Official Gazette No. 33203 on 24 March 2026. According to a summary of the decision, the Board found that presenting the information (aydınlatma) text and the explicit consent text as one document, or one inside the other, is one of the most common breaches, and held it unlawful. Your cookie notice and your consent request now have to be presented separately.
KVKK fines for 2026
Article 18 sets the fines, and they rise each year with Turkey's revaluation rate. For 2026 the rate is 25.49%, published in the Official Gazette No. 33090 of 27 November 2025, which gives these amounts from 1 January 2026, as listed in a summary of the 2026 amounts:
| Violation | Minimum (TRY) | Maximum (TRY) |
|---|---|---|
| Breaching the obligation to inform | 85,437 | 1,709,200 |
| Breaching data security obligations | 256,357 | 17,092,242 |
| Not complying with Board decisions | 427,263 | 17,092,242 |
| Breaching the VERBIS registration and notification obligation | 341,809 | 17,092,242 |
| Not notifying a standard contract for a transfer abroad | 90,308 | 1,806,377 |
A cookie banner that sets analytics before consent, or a cookie policy that misses what the law requires visitors to be told, falls under these headings. Fines can be appealed in the administrative courts under Article 18(3).
VERBIS registration is an extra obligation
Unlike the GDPR, the KVKK has a public Data Controllers' Registry, VERBIS. Article 16 requires those who process personal data to register before they start, declaring their processing activities, categories of data and data subjects, recipients and retention periods.
The Board can exempt controllers using objective criteria, and its decisions exempt some domestic controllers below set size thresholds unless processing special category data is their main activity. Check whether an exemption applies to you before assuming one does, since the registration fine reaches about TRY 17.1 million.
How the KVKK compares with the GDPR
The KVKK was modelled on the EU's Data Protection Directive (95/46/EC) rather than the GDPR, so the two share principles but differ in detail.
| Feature | KVKK (Turkey) | GDPR (EU) |
|---|---|---|
| Cookie consent | Explicit consent, except communication and strictly necessary cookies | Consent under the ePrivacy Directive, except strictly necessary storage |
| Data protection officer | Not required by the law | Required in some cases |
| Breach notification | 72 hours (Board Decision 2019/10) | 72 hours (Article 33) |
| Registry | VERBIS registration, unless exempt | No central registry |
| Maximum fines | About TRY 17.1 million per violation in 2026 | EUR 20 million or 4% of worldwide turnover |
| Transfers abroad | Adequacy, standard contracts, BCRs, explicit consent only for incidental transfers | Adequacy, SCCs, BCRs, derogations |
Transfers abroad since the 2024 amendment
Article 9 was rewritten by Law No. 7499 in 2024, and Turkey now has a GDPR-style set of tools. A transfer abroad needs a legal basis under Articles 5 or 6 and either an adequacy decision by the Board, or one of the appropriate safeguards: binding corporate rules approved by the Board, a standard contract published by the Board, or a written undertaking the Board approves. A standard contract must be notified to the Authority within five business days of signature. Explicit consent, after being told of the risks, is now one of the routes only for incidental transfers.
That matters for cookies because analytics and advertising data usually leaves Turkey. If cookie data goes to Google Analytics servers abroad, check which Article 9 route covers it.
A cookie checklist for websites with Turkish visitors
- Audit all cookies: run a cookie scan to find every cookie, including those from third-party scripts.
- Classify them: separate strictly necessary cookies from analytics, marketing and functional ones.
- Block non-essential cookies by default: analytics and marketing must wait for explicit consent.
- Offer category choices: visitors accept or reject each category.
- Write a detailed cookie policy: name, purpose, responsible party and retention for each cookie.
- Keep consent and information texts separate, as Decision 2026/347 requires.
- Record consent: keep a consent log with the time and scope of each choice.
- Make withdrawal easy: changing or withdrawing consent should be as easy as giving it.
- Check VERBIS: register unless a Board exemption clearly covers you.
- Review transfers abroad: match each flow of cookie data to an Article 9 route.
Setting up the banner for Turkish visitors
The banner should appear before any non-essential cookie is set, explain why cookies are used and link to the full cookie policy. The category panel should default to off for analytics, marketing and social media, with only strictly necessary cookies switched on and locked.
If your site serves several countries, region rules with geo-detection let you show Turkish visitors this opt-in setup while applying other rules elsewhere. Google Consent Mode v2 can pass the visitor's choices to Google tags.
Questions about cookie consent in Turkey
Does the KVKK apply to websites based outside Turkey?
The Authority treats controllers that process the personal data of people in Turkey as within scope wherever they are established, so a website that targets Turkish users or collects their data should expect the KVKK to apply.
Are analytics cookies like Google Analytics allowed without consent in Turkey?
No. Analytics cookies meet neither exception in the KVKK cookie guide: they are not strictly necessary for a service the user requested, nor used only to transmit a communication. They need explicit consent first.
What is VERBIS and do I need to register?
VERBIS is Turkey's Data Controllers' Registry. Article 16 requires processors of personal data to register unless a Board exemption applies, and some domestic controllers below size thresholds are exempt. The 2026 fine for breaching the obligation reaches about TRY 17.1 million.
Can I use a cookie wall to force consent in Turkey?
Explicit consent under Article 3 must be freely given. Blocking access unless all cookies are accepted removes that choice, so a cookie wall is hard to reconcile with the law.
How does the KVKK differ from the GDPR for cookie consent?
Both require prior consent for non-essential cookies. The KVKK has VERBIS registration and no DPO requirement, uses fixed fine ranges revalued every year, and since 2024 offers adequacy, standard contracts and BCRs for transfers, with explicit consent only for incidental transfers.
What changed with KVKK Decision 2026/347?
The principle decision, adopted on 18 February 2026 and published on 24 March 2026, holds that combining the explicit consent text with the information text in one document is unlawful. Consent requests and privacy information must be presented separately.
Give Turkish visitors an opt-in banner
Kukie.io scans your site, sorts its cookies into categories, blocks non-essential ones until visitors choose and records each choice, with region rules for visitors from Turkey.
