Most news websites that want to send a newsletter ask this question through the lens of the KVKK. But the law that really governs newsletters is not Law No. 6698 — it is Law No. 6563 on the Regulation of Electronic Commerce. Article 6(1) of Law No. 6563 establishes the prior consent requirement, Article 7 determines the content of the message, Article 8 regulates the right to refuse and the deadline for complying with it, and Article 11(5) makes it compulsory for consents to be transferred to a central system. Personal Data Protection Law No. 6698 (“KVKK”) is added to that picture as well — because the email address you collect is also personal data. This article sets up both regimes together.
What is a commercial electronic message?
Article 2(1)(c) of Law No. 6563: “Commercial electronic message: means messages with data, sound and image content that are sent electronically for commercial purposes using means such as telephone, call centres, fax, automatic dialling machines, smart voice recording systems, electronic mail and short message service.”
The decisive element of the definition is “commercial purpose”. A newsletter containing advertising, promotions, an announcement of sponsored content or a subscription campaign undoubtedly falls within the definition. The position of a newsletter consisting purely of news headlines and carrying no commercial element at all is assessed according to the actual content of the send; in practice, since most news newsletters carry a commercial element at some point, the safe course is to apply the Law No. 6563 regime from the outset.
The prior consent requirement — Article 6 of Law No. 6563
This is the heart of the Law. “Condition for sending commercial electronic messages — ARTICLE 6 – (1) Commercial electronic messages may be sent to recipients only on condition that their prior consent has been obtained. This consent may be obtained in writing or by any kind of electronic communication means. Where the recipient has provided their contact details for the purpose of being contacted, no separate consent is required for commercial electronic messages concerning changes to, use of and maintenance of the goods or services supplied.”
“(2) Commercial electronic messages may be sent to tradesmen and merchants without obtaining prior consent.”
Note three consequences. First, the model is opt-in: no sending may take place without consent, and the “unsubscribe if you don't want it” approach is contrary to the Law. Second, the form of consent is free — it may be written or electronic; but the burden of proof is on you. Third, the last sentence of Article 6(1) introduces a narrow exemption: no separate consent is required for notices about changes to, use of and maintenance of a service that has been purchased. That covers a subscription renewal reminder; it does not cover an announcement of a new campaign.
The content of the message — Article 7 of Law No. 6563
“ARTICLE 7 – (1) The content of the commercial electronic message must be in accordance with the consent obtained from the recipient. (2) The message shall contain information enabling the service provider to be identified, together with accessible contact details such as a telephone number, fax number, short message number and electronic mail address, depending on the type of communication. (3) Depending on the type of communication, the message shall also contain information about the subject and purpose of the message and, where it is sent on behalf of another, on whose behalf it is sent.”
The first paragraph is often overlooked: the scope of the consent and the content of the message must match. Sending an advertisement for a third party's product on the basis of consent obtained for a “daily news bulletin” is contrary to Article 7(1). And the requirement in the third paragraph — “where it is sent on behalf of another, on whose behalf it is sent” — is directly binding for sponsored newsletters.
The right to refuse and the three-business-day rule — Article 8 of Law No. 6563
“The recipient's right to refuse commercial electronic messages — ARTICLE 8 – (1) Recipients may at any time refuse to receive commercial electronic messages without giving any reason. (2) The service provider is obliged to ensure that the notice of refusal can be transmitted easily and free of charge by electronic communication means, and to provide the necessary information about this in the message it sends. (3) Following receipt of the request, the service provider shall stop sending electronic messages to the recipient within three business days.”
| Obligation | Content | Legal basis |
|---|---|---|
| Prior consent | No sending without consent | Law 6563 Art. 6(1) |
| Exemption for tradesmen and merchants | No prior consent required | Law 6563 Art. 6(2) |
| Content matching the consent | The message may not exceed the scope of the consent obtained | Law 6563 Art. 7(1) |
| Identity and contact details | The message must contain accessible contact details | Law 6563 Art. 7(2) |
| Subject, purpose, on whose behalf | Stated expressly in the message | Law 6563 Art. 7(3) |
| Right to refuse | Exercisable at any time, without reasons | Law 6563 Art. 8(1) |
| Refusal channel | Must be easy and free of charge, and shown in the message | Law 6563 Art. 8(2) |
| Deadline for complying with a refusal | 3 business days | Law 6563 Art. 8(3) |
| Transfer of consents to the system | Consents not transferred are invalid | Law 6563 Art. 11(5) |
İYS — the Message Management System (Law No. 6563, Article 11(5))
The paragraph added in 2017 by Law No. 7061 provides for consents to be recorded in a central system: “(5) The Ministry is empowered to establish, or have established, an electronic system enabling commercial electronic message consents to be obtained and the right of refusal to be exercised. Consents obtained within the framework of this Law shall be transferred to the system within the period determined by the Ministry. Consents not transferred to the system shall be deemed invalid. Recipients shall check the consents recorded in the system within the period determined by the Ministry. Commercial electronic messages sent after the expiry of that period shall be deemed consented to. The right of refusal shall be exercised by recipients through this system. The establishment of the system, the transfer and storage of consents, the exercise of the right of refusal through the system and other procedures and principles concerning the operation of the system shall be determined by regulation.”
The harshest sentence of the paragraph is the one in the middle: consents not transferred to the system are deemed invalid. In other words, having a properly drafted consent checkbox on your site is not enough on its own; if the consent has not been transferred to the system, that consent is legally null.
The personal data provision of Law No. 6563 was repealed in 2022
For a time Law No. 6563 had a personal data provision of its own. Today there is no such provision: “Protection of personal data — ARTICLE 10 – (Repealed: 1/7/2022-7416/Art. 4)”
The practical consequence is clear: in the context of e-commerce and commercial messaging, personal data protection is now subject directly to Law No. 6698. In your newsletter operation the two laws run in parallel and neither replaces the other.
| Question | Which law | Which provision |
|---|---|---|
| May I send a message to this person? | 6563 | Art. 6(1) prior consent · Art. 11(5) İYS |
| What must the message contain? | 6563 | Art. 7 |
| Within how many days must I act on an opt-out? | 6563 | Art. 8(3) — 3 business days |
| Is my processing of the email address lawful? | 6698 | Art. 5 processing conditions |
| What must I explain when collecting the data? | 6698 | Art. 10 duty to inform |
| What if the person wants their data erased? | 6698 | Art. 7 · Art. 11(1)(e) · Art. 13(2) (30 days) |
| What do I do if the list leaks? | 6698 | Art. 12(5) notification |
The KVKK dimension: an email address is personal data
Under Article 3(1)(d) any information relating to an identified or identifiable natural person is personal data; a person's email address is inside that definition. There must therefore be a processing condition under Article 5 for the newsletter list. Consent obtained under Article 6(1) of Law No. 6563 in most cases coincides with explicit consent under Article 5(1); but the two concepts are not identical — one is the condition for sending a message, the other the condition for processing the data.
The duty to inform in Article 10 also arises for the newsletter form: the identity of the data controller, the purpose of processing, the parties to whom data are transferred (particularly your email delivery provider), the method of collection and the legal ground, and the rights in Article 11. We gave a template for that document in the article on the privacy notice for reader data. And we covered how the newsletter activity enters the VERBİS inventory in the article on the VERBİS registration obligation.
The exemption in Article 28(1)(c) of KVKK, which applies to publishing activity, does not cover the newsletter: keeping a newsletter list is not processing within the scope of freedom of expression but commercial processing. We set out the limits of the exemption in detail in journalistic activity and the KVKK exemption.
What should the consent record contain?
Article 6(1) of Law No. 6563 requires that consent has been obtained; in a dispute it falls to the sender to prove it. The record structure below is designed so that you can show the existence, the scope and the timing of the consent. It is not a list enumerated word for word in the Law but an operational template suggested for ease of proof.
NEWSLETTER CONSENT RECORD — FIELDS TO KEEP
(operational suggestion; for ease of proof)
CONSENT RECORD
recipient_email : ................................
consent_date_time : 2026-01-01 14:32:07 (+03:00)
consent_channel : web form / mobile / in writing
consent_ip : ................................
consent_text_version : v3 (2025-11-10)
consent_scope : "daily news bulletin + campaigns"
double_opt_in : yes (confirmation e-mail clicked)
confirmation_date : 2026-01-01 14:35:11
iys_transfer_status : transferred / pending
iys_transfer_date : ................................
REFUSAL (UNSUBSCRIBE) RECORD
refusal_date_time : ................................
refusal_channel : link in the message / e-mail / IYS
removed_from_list_at : ................................
elapsed_time : ....... (must be within 3 BUSINESS DAYS)
UNSUBSCRIBE FLOW
1. Every message carries an easy and free-of-charge
refusal link [Law 6563 Art. 8(2)]
2. The link is clicked -> no extra login or password asked
3. Removed from the list in a single step
4. A confirmation message is shown on screen
5. A system record is created (the fields above)
6. Sending stops within THREE BUSINESS DAYS at the latest
[Law 6563 Art. 8(3)]
7. Refusal may also be exercised through IYS
[Law 6563 Art. 11(5)]
8. If the person additionally requests erasure under
KVKK Art. 11(1)(e), the request is concluded within
30 days at the latest [KVKK Art. 13(2)]
NOTE: Refusal and erasure are different. Refusal stops the
sending; the record may be kept for the purpose of proof.
An erasure request is directed at the data itself and is
assessed separately.Build the distinction in that closing note into your list infrastructure as well: “sending stopped” and “record erased” must be two different states. Otherwise you will either have complied with the refusal request but lost your record of proof, or you will believe you have met an erasure request while continuing to hold the data.
Sanctions
Under Article 12(1) of Law No. 6563 (as amended by Law No. 7416 of 1/7/2022), an administrative fine of “from one thousand Turkish lira to five thousand Turkish lira” is imposed on service providers and intermediary service providers who act contrary to the first paragraph of Article 6 or the first paragraph of Article 7. Under subparagraph (c) of the same paragraph, service providers who “act contrary to the obligations in the second and third paragraphs of Article 8” are fined from two thousand Turkish lira to fifteen thousand Turkish lira.
On the KVKK side, Article 18(1)(a) provides for an administrative fine of from 5,000 Turkish lira to 100,000 Turkish lira for those who fail to comply with the duty to inform, and Article 18(1)(b) a fine of from 15,000 Turkish lira to 1,000,000 Turkish lira for those who fail to comply with the obligations relating to data security.