The word cookie never appears in Turkey's KVKK or its regulations. The cookie regime is built from the Article 3 definition, Article 5 conditions and the Article 10 duty to inform.
This article has to begin with an observation most cookie guides skip: the words “cookie” and “çerez” do not appear anywhere in the text of Personal Data Protection Law No. 6698 (“KVKK”). Nor do they appear in the Regulation on the Registry of Data Controllers, or in the Regulation on the Erasure, Destruction or Anonymisation of Personal Data. In other words there is no such thing as a “cookie provision”. So what is the legal footing of cookie consent? The answer lies in the general provisions of the Law — and this article builds that footing exactly as it is, without inventing anything.
There is no cookie provision in the Law — what does that mean?
In Turkish law the regime governing cookies arises not from a special provision of Law No. 6698 but from the application of its general provisions to cookies. If you look for a direct basis in the Law, the articles you will find are: Article 3 (definitions), Article 4 (general principles), Article 5 (processing conditions) and Article 10 (the duty to inform).
That observation matters, because it means anyone looking for hard rules of the form “cookie consent is obtained in such and such a way, and no consent is needed for these cookies” will not find those rules in the text of the Law. Those details are shaped by decisions of the Board and by guidance from the Authority.
When does a cookie count as processing of personal data?
Not every cookie automatically gives rise to processing of personal data. The criterion is the definition in Article 3(1)(d): “Personal data: any information relating to an identified or identifiable natural person.” If the value a cookie stores makes a particular natural person identifiable, alone or when combined with other data, then processing carried out through that cookie is within the scope of the Law.
By contrast, a value that merely holds a technical preference and cannot in any way be linked to a person may, by definition, not be personal data. But be careful: in practice cookie values are usually held together with the IP address, session information and device and browser data, and that combination rapidly produces identifiability. So make the assessment “this cookie is anonymous” as the outcome of a technical examination, not as an assumption.
What processing means is also defined, in Article 3(1)(e): “... obtaining, recording, storing, retaining, ... transferring, ... making available, classifying ...” Writing a cookie to a browser, reading it and sending it to a third-party provider — all three are inside that definition.
The legal ground for the processing: Article 5
Once it is established that personal data are being processed through a cookie, that processing must rest on a legal ground in Article 5. Article 5(1) sets the rule: “Personal data may not be processed without the explicit consent of the data subject.” Article 5(2) then lists the cases in which explicit consent is not required:
a) It is expressly provided for in laws.
b) It is necessary for the protection of the life or physical integrity of the person themselves or of another person, where that person is unable to give consent due to actual impossibility or whose consent is not given legal validity.
c) It is necessary to process personal data of the parties to a contract, provided that the processing is directly related to the conclusion or performance of that contract.
ç) It is necessary for the data controller to fulfil its legal obligation.
d) The data have been made public by the data subject themselves.
e) Data processing is necessary for the establishment, exercise or protection of a right.
f) Data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
The structure of the Law can be read from this: explicit consent is the rule, and the seven cases in Article 5(2) are the exception. If you are saying “I did not obtain consent” for a cookie-based processing operation, you must be able to show in writing which subparagraph of Article 5(2) you rely on. If there is no subparagraph to rely on, what remains is explicit consent.
What explicit consent is is defined in Article 3(1)(a): “Explicit consent: consent relating to a specific subject, based on information, and declared with free will.” All three elements are required. The requirement that it relate to “a specific subject” makes blanket consent taken wholesale through a single button questionable; and the element of “free will” comes under scrutiny where refusing consent blocks access to the service.
The duty to inform arises for cookies too (Article 10)
Even where you do not rely on consent, the duty to inform is a separate obligation and does not disappear. Article 10(1): “During the obtaining of personal data, the data controller or the person authorised by it is obliged to inform data subjects about; a) the identity of the data controller and of its representative, if any, b) the purpose for which the personal data will be processed, c) to whom and for what purpose the processed personal data may be transferred, ç) the method and legal ground of collecting the personal data, d) the other rights listed in Article 11.”
Adapted to cookies this means: you have to show which cookies are written for which purpose, which third parties the data go to, and which legal ground you rely on, before the cookie is written. You will already have given part of this information in your privacy notice for reader data; setting up the cookie section as a separate heading within that document is the cleanest solution.
A breach of the duty to inform attracts an administrative fine of from 5,000 Turkish lira to 100,000 Turkish lira under Article 18(1)(a). Those amounts are the nominal amounts in the text of the Law; the current figure is determined by the revaluation rate.
How do the general principles work for cookies? (Article 4)
The five principles in Article 4(2) are binding for cookie processing as well. Two of them are particularly testing. (ç) “Being relevant, limited and proportionate to the purposes for which they are processed”: carrying measurement tags left over from a single editorial experiment for years, when they are not needed for the site to work, is incompatible with that principle. (d) “Being retained for the period ... necessary for the purpose”: defining cookie lifetimes valid for years is indefensible if it exceeds the period needed to achieve the purpose.
Furthermore, under Article 12(1) the security of data collected through cookies is also the data controller's obligation; and under Article 12(2) you are jointly responsible with third-party providers who process that data on your behalf. Processing carried out by your advertising or measurement provider does not remove your responsibility.
A practical approach for a news website
Even in areas where we cannot give a hard rule, solid preparation grounded in the Law is possible. The steps below are derived entirely from Articles 3, 4, 5, 10 and 12.
text
COOKIE PREPARATION STEPS — THE MINIMUM SET BASED ON THE LAW
1. INVENTORY (basis: Art. 3, Art. 4)
Scan your site with the browser developer tools and fill in
for each cookie:
- name : ...........................
- written by : my own site / third party: .....
- value stored : ...........................
- does it make a person identifiable? : yes / no
(assess its combination with IP, session, device data too)
- purpose : ...........................
- lifetime : ...........................
- where the data goes : ...........................
2. MATCHING THE LEGAL GROUND (basis: Art. 5)
Write down, one by one, for every cookie that processes
personal data:
[ ] explicit consent (Art. 5(1))
[ ] Art. 5(2)(a) expressly provided for in laws
[ ] Art. 5(2)(c) conclusion or performance of a contract
[ ] Art. 5(2)(ç) legal obligation
[ ] Art. 5(2)(e) establishment, exercise, protection of a right
[ ] Art. 5(2)(f) legitimate interest
(provided it does not harm fundamental
rights and freedoms)
If none can be ticked -> explicit consent is required.
3. INFORMING (basis: Art. 10)
Make it accessible BEFORE the cookie is written, containing:
[ ] the identity of the data controller
[ ] the purpose of each group of cookies
[ ] the third parties to whom data are transferred and why
[ ] the method of collection and the legal ground
[ ] the full list of rights in Art. 11
4. PROPORTIONALITY AND DURATION (basis: Art. 4(2)(ç), 4(2)(d))
[ ] Unused tags and cookies removed
[ ] The lifetime of every cookie reset according to purpose
5. SECURITY AND SUPPLIERS (basis: Art. 12(1), 12(2))
[ ] The data processor relationship with third-party
providers put in writing
[ ] The data items transferred listed in the contract
6. CHECKING THE CURRENT SOURCES
[ ] Board decisions and the Authority's guidance checked
Date: ../../20.. Checked by: ...............
NOTE: The detailed rules on consent architecture, banner
design and cookie classification are not in the Law but
in those sources.
Plan the sixth step not as a one-off task but as a regular review item. If you run your site's overall compliance tracking through the legal compliance checklist for internet news sites, add the cookie check to the same list.
Does the publishing exemption cover cookies?
No. The exemption in Article 28(1)(c) of KVKK concerns the case where personal data are “processed within the scope of freedom of expression”. Writing a measurement or advertising cookie to a reader's browser is not processing within the scope of freedom of expression; it is processing relating to the commercial and technical operation of the site. Cookie processing is therefore entirely outside the exemption and subject to all the provisions of the Law.
Finally, if data collected through cookies leaks, the notification obligation in Article 12(5) arises; we set out that flow step by step in the article on personal data breach notification. Reducing the load of third-party tags is the single most effective step for both compliance and performance — and that is directly bound up with your hosting and infrastructure decisions.