The framework
Turkey regulates personal data through Law No. 6698 on Protection of Personal Data (KVKK), dating from 2016 and supervised by the KVKK.
For advertisers the consent posture matters most, and Turkey sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
Law No. 6698 on Protection of Personal Data (KVKK), amended 2024
Turkey's KVKK borrows from the pre-GDPR directive but was substantially modernized in March 2024 (effective June 2024), expanding sensitive-data processing grounds and replacing the old consent-or-adequacy transfer rule with a GDPR-style toolkit, including standard contracts with a mandatory filing step many multinationals miss. Commercial email and SMS require opt-in consent registered through the national IYS system. An amended advertising regulation in force since 1 August 2026 adds ad-specific rules: targeted ads must tell consumers which criteria selected them and how to change them, profiling-based targeting of children is banned, and AI-generated endorsements must be labeled.
Marketing and advertising
Explicit consent or a listed basis; electronic marketing needs opt-in consent recorded in the IYS registry. Since 1 August 2026, targeted ads must disclose the criteria behind them, and profiling-based targeting of known children is banned. Most channel decisions here follow from that consent rule.
Cross-border transfers
Rewritten June 2024: adequacy decisions, appropriate safeguards including standard contracts (which must be filed with the Authority within five business days), and limited derogations.
Enforcement and penalties
Administrative fines revalued each year; the 2026 range runs from TRY 85,437 to TRY 17,092,242 per violation.