A KVKK-compliant website needs at least five things: a privacy notice available at every point where data is collected, a cookie tool that keeps non-essential cookies off until the visitor consents, explicit consent collected separately where required, forms that collect minimal data, and a review of any third-party tools that transfer data abroad under Law No. 6698.
Important note: this article is general information and is not legal advice; for your site's specific situation, please consult a data protection specialist or lawyer. Here we cover the technical and practical issues a web agency runs into most often, from the point of view of both site owners and developers.
Why and how does KVKK apply to websites?
Turkey's Personal Data Protection Law No. 6698 (KVKK) governs the processing of any information relating to an identified or identifiable individual. Because websites process personal data through contact forms, cookies, IP addresses and analytics or advertising tags, the business that owns the site is in most cases the data controller for that data.
Many businesses assume 'my site has no accounts, so I don't collect data'. But a contact form collects a name, phone number and email; a tool like Google Analytics processes cookie identifiers and device information; an ad tag leaves a trace to retarget the visitor. Each of these is a processing activity that needs to be assessed under KVKK.
What is a privacy notice (aydınlatma metni) and where should it appear?
A privacy notice (aydınlatma metni) is the information that Article 10 of KVKK requires a data controller to give people when collecting their data. The privacy notice must explain in clear language who the controller is, why and on what legal basis the data is processed, who it may be shared with, how it is collected and what rights the person has.
- —The data controller's legal name and contact details.
- —Categories of data processed (identity, contact, transaction security, marketing and so on).
- —Purposes of processing and the legal basis for each purpose.
- —Recipients (hosting provider, email service, analytics and ad providers) and whether data is transferred abroad.
- —Collection method (form, cookies, email, phone).
- —The rights listed in Article 11 of the Law and how to exercise them.
The privacy notice should not just sit as a footer link; it must be reachable wherever data is collected, for instance directly under the contact form. Informing someone is not done by making them tick a box: providing information and obtaining explicit consent are different concepts and should not be merged into one text.
Related services
What should a KVKK-compliant cookie banner look like?
A KVKK-compliant cookie banner does not run non-essential cookies before the visitor agrees, and makes refusing as easy as accepting. According to the Cookie Guidelines published by Turkey's Personal Data Protection Authority, analytics and marketing cookies require explicit consent, while cookies strictly necessary for the site to function do not.
- —Strictly necessary cookies: session, security, load balancing, shopping cart and the cookie that stores the consent choice itself. No consent needed, but they must be disclosed.
- —Functional cookies: language or region preferences that improve the experience. If not strictly necessary, it is safer to put them behind consent.
- —Analytics cookies: visit-statistics tools such as Google Analytics. Explicit consent required.
- —Marketing and advertising cookies: retargeting and conversion tags such as Google Ads or Meta Pixel. Explicit consent required.
- —'Accept' and 'Reject' should appear on the same screen with equal prominence.
- —No pre-ticked boxes; 'by continuing to use this site you accept cookies' does not constitute valid consent.
- —Visitors should be able to choose by category and withdraw consent easily later.
- —Technically, tags must not load before consent; merely showing a banner is not enough.
For developers, the last point is the critical one. On many sites the banner is visible, but Google Analytics and ad tags have already fired the moment the page loaded. Use Google Consent Mode v2 or a consent management platform so tags load, or run in a restricted mode, according to the visitor's consent state.
When is explicit consent required, and when isn't it?
Explicit consent under KVKK is agreement that is specific, informed and freely given, and it is only one of several legal bases for processing. Replying to an enquiry or fulfilling an order usually relies on other bases such as a contract, a legal obligation or legitimate interest, so explicit consent should not be requested for everything.
- —Typically requires explicit consent: analytics and marketing cookies, commercial profiling, certain processing of special categories of data such as health.
- —Typically does not: replying to a quote request, processing an order, issuing an invoice, keeping security logs.
- —Explicit consent must not be a precondition for the service; 'you cannot send the form unless you consent' undermines free will.
- —Commercial electronic messages (newsletters, campaign SMS) also require separate opt-in under Law No. 6563 and registration with the Message Management System (İYS).
How should contact form data be handled?
The core KVKK rule for a contact form is data minimisation: the form should ask only for what is genuinely needed to answer the request, send data over an encrypted connection, store it where unauthorised people cannot reach it, and delete it after a defined period once the purpose is fulfilled. A link to the privacy notice belongs right next to the form.
- —Cut required fields: a name and one contact channel are often enough; don't ask for things like national ID numbers without reason.
- —Serve the site over HTTPS; don't keep form data in unencrypted email chains or publicly shared spreadsheets.
- —Protect the inbox and admin panel that receive form data with two-factor authentication.
- —If you want to send marketing messages, use a separate, optional, unticked consent checkbox.
- —Remember that anti-spam tools such as reCAPTCHA process data too, and mention them in the privacy notice.
Read next
What should you watch for with Google Analytics, Google Ads and WhatsApp?
Tools like Google Analytics, Google Ads and WhatsApp may process visitor data on the provider's servers abroad, so they need to be assessed for both cookie consent and cross-border transfer. An amendment in force since 1 June 2024 rewrote Article 9 of KVKK, and explicit consent is no longer the general basis for transferring data abroad.
Under the new regime, transfers abroad rely first on an adequacy decision by the Board and, absent one, on appropriate safeguards such as standard contracts, binding corporate rules or a written undertaking approved by the Board. When a standard contract is signed, the Authority must be notified within five business days. Explicit consent remains only as an exceptional route for occasional, non-recurring transfers.
- —Google Analytics: don't run it before consent, shorten data retention, disclose the cross-border transfer in the privacy notice, and check whether the provider offers a transfer mechanism that works under KVKK.
- —Google Ads conversion and remarketing tags: classify them as marketing cookies that only run after consent.
- —WhatsApp button: a plain wa.me link sets no cookies on your site, but once a visitor starts chatting the data is processed on Meta's infrastructure. Mention this channel in the privacy notice. If a conversion tag fires on the button click, that tag needs consent too.
- —Live chat, maps, video and social embeds: most set third-party cookies; showing a placeholder until consent and loading them afterwards is the safest approach.
Does every site owner have to register with VERBİS?
Not every website owner has to register with VERBİS. The obligation to register with the Data Controllers Registry Information System depends not on having a website but on the business's headcount, annual balance sheet size and whether its main activity involves processing special categories of data. The Board has exempted businesses below certain thresholds from registration.
Because the Board can update these thresholds by decision, confirm your business's position against the Authority's current announcements or with a specialist. A VERBİS exemption does not remove other duties, such as the duty to inform, data security measures and answering data subject requests within thirty days at the latest.
Local support
KVKK checklist for developers and business owners
A KVKK-compliant website is a joint effort between the developer and the business owner: the developer technically ensures tags respect consent, forms are secure and data collection is minimal, while the business owner decides the content of the privacy notice, the legal bases, retention periods and supplier contracts.
- —Developer — every cookie and third-party request on the site has been listed using the browser's network tab.
- —Developer — non-essential tags do not load before consent; Consent Mode or an equivalent mechanism has been tested.
- —Developer — 'Reject' is as visible as 'Accept' on the banner, and the choice can be changed later.
- —Developer — forms run over HTTPS with minimal fields and a privacy notice link next to them.
- —Developer — admin panels and form notification inboxes are protected with strong passwords and two-factor authentication.
- —Business owner — the privacy notice and cookie policy reflect the current list of tools.
- —Business owner — a legal basis has been set for each purpose; explicit consent is requested only where needed.
- —Business owner — suppliers that transfer data abroad have been reviewed against the 2024 transfer rules.
- —Business owner — the VERBİS obligation has been checked against current thresholds.
- —Business owner — someone is responsible for handling data subject requests and any breach notifications.
Compliance is not a one-off task: whenever a new analytics tool, chat widget or ad tag is added, the cookie list and privacy notice must be updated too. The most practical approach is to build a KVKK review into the site's maintenance routine at least once a year.