Introduction
Push notifications are one of the most effective digital marketing tools used by mobile applications, e-commerce platforms, delivery apps, travel apps, banking apps, fintech platforms, online marketplaces, mobile games, education apps, subscription services and lifestyle applications. A push notification appears directly on a user’s mobile device, often on the lock screen or notification panel, and can immediately direct the user to a product, service, discount, campaign or in-app purchase.
Because of this direct and intrusive nature, push notification marketing rules in Turkey should be carefully assessed under Turkish advertising law, commercial electronic message rules and personal data protection law. A business cannot assume that push notifications are legally risk-free merely because the user downloaded an app or allowed operating-system notifications. Permission to send technical app notifications does not automatically mean permission to send marketing messages. Likewise, an app user who needs transactional notifications, such as order updates or security alerts, should not be forced to receive promotional messages.
The legal framework is multi-layered. Push notification marketing may be evaluated under Law No. 6563 on the Regulation of Electronic Commerce, the Regulation on Commercial Communication and Commercial Electronic Messages, Law No. 6502 on the Protection of Consumers, the Regulation on Commercial Advertising and Unfair Commercial Practices, and Personal Data Protection Law No. 6698, known as the KVKK. In addition, sector-specific advertising rules may apply where push notifications promote food supplements, cosmetics, healthcare services, financial products, gambling-like services, children’s products or other regulated categories.
The Regulation on Commercial Communication and Commercial Electronic Messages covers commercial communications made through electronic communication tools for the purpose of promoting, marketing or introducing goods, services or businesses. The same regulation defines electronic communication tools broadly as devices such as computers, phones, faxes and automatic calling machines that enable messages to be sent, received or stored over the internet and other communication networks. (lexpera.com.tr)
This article explains the legal rules applicable to push notification marketing in Turkey, including consent, opt-out mechanisms, İYS-related principles, KVKK compliance, app permissions, targeted advertising, children’s profiling, in-app purchases, subscription notifications, misleading advertising risks, dark patterns, sector-specific restrictions and administrative sanctions.
What Is a Push Notification?
A push notification is a message sent by a mobile application, web application or digital service to a user’s device, usually without the user actively opening the app at that moment. It may appear as a banner, lock screen alert, notification center message, badge, sound or in-app prompt.
Push notifications may serve different purposes. Some are transactional or functional, such as order status updates, delivery tracking, password reset warnings, account security alerts, appointment reminders, payment confirmations or service interruption notices. Others are promotional, such as discount campaigns, abandoned cart reminders, product recommendations, limited-time offers, subscription upgrades, loyalty rewards, game purchase prompts, restaurant promotions, hotel deals, travel offers or new product announcements.
The legal classification depends on purpose and content. A message saying “Your order has been shipped” is usually transactional. A message saying “Complete your order now and get 20% off” is promotional. A message saying “Your appointment is tomorrow at 14:00” is functional. A message saying “Book another appointment this week and receive a special discount” is marketing.
This distinction is central. Operational notifications are often necessary for the service. Promotional notifications are commercial communications and should be handled through a stricter consent, advertising and data protection framework.
Are Push Notifications Commercial Electronic Messages?
Turkish legislation does not always discuss push notifications as a separate category in the same way it discusses SMS, e-mail or phone calls. However, the legal definitions are broad enough to require careful assessment. The Ministry of Trade defines commercial electronic messages as data, audio or visual messages sent electronically for commercial purposes through tools such as telephone, call centers, fax, automatic calling machines, smart voice recorder systems, e-mail and SMS. (ticaret.gov.tr)
The Regulation on Commercial Communication and Commercial Electronic Messages also covers commercial communications made through electronic communication tools for promoting or marketing goods and services, and it defines electronic communication tools broadly as devices enabling messages to be sent, received or stored over the internet and other communication networks. (lexpera.com.tr)
For this reason, a push notification sent for direct marketing should be treated as a commercial electronic communication risk area. In practice, not every mobile app push notification may be processed through İYS in the same way as SMS, e-mail or voice calls, but the underlying principles of prior consent, transparency, refusal rights, sender identification, data protection and consumer protection remain highly relevant.
The safest compliance approach is to treat promotional push notifications as consent-based marketing communications. Businesses should not rely only on app installation or operating-system notification permission. They should obtain separate, clear and informed permission for promotional notifications where required and should provide an easy way to disable them.
Difference Between Transactional and Marketing Push Notifications
A compliant push notification strategy begins with separating transactional notifications from marketing notifications.
Transactional notifications are messages necessary for the performance, security or proper functioning of the service. Examples include:
Your payment was successful.
Your courier is arriving.
Your appointment has been confirmed.
Your password was changed.
Your subscription renewal failed.
Your account login was detected.
Your order is ready for pickup.
Marketing notifications are messages intended to promote products, services, discounts, campaigns, subscriptions, upgrades or commercial engagement. Examples include:
Today only: 30% discount.
Complete your basket and get free shipping.
Premium membership is now 50% off.
New collection is live.
Special offer for you.
Upgrade now for more features.
Your favorite restaurant has a campaign.
The legal problem often arises when businesses mix both types of content. A notification that begins as transactional may become promotional if it includes a campaign message. For example, “Your order has been delivered. Buy again today and get 15% off” contains marketing content. A business should not use transactional notification permissions to send promotional messages.
Apps should therefore allow users to manage different notification categories. Security, order and service notifications should be separated from campaign, offer and marketing notifications.
Consent for Push Notification Marketing
Consent is a central issue in push notification marketing. Under Turkish commercial electronic message rules, commercial electronic messages generally require prior approval unless a specific exception applies. The Ministry of Trade states that consent must be obtained before sending commercial electronic messages and remains valid until the recipient uses the right of refusal. (ticaret.gov.tr)
The Regulation on Commercial Communication and Commercial Electronic Messages states that consent may be obtained in writing, through any electronic communication tool or through İYS, and that the consent must include the recipient’s positive declaration of will and electronic communication address. It also states that consent cannot be obtained through a pre-selected option and that a service provider cannot make consent to commercial electronic messages a precondition for providing goods or services. (lexpera.com.tr)
For mobile apps, this means promotional push notification consent should be clear and separate. The user should not be misled into believing that marketing notifications are required to use the app. The consent should not be hidden inside general terms of use. It should not be pre-selected. It should not be bundled with privacy policy acceptance, account creation, payment approval or mandatory service notifications.
A proper consent screen should explain the type of promotional notifications the user may receive. For example, it may state that the app wishes to send campaign, discount, product recommendation and personalized offer notifications. The user should actively choose whether to accept such notifications.
Operating-System Permission Is Not Enough
Mobile operating systems usually ask users whether they allow an app to send notifications. This technical permission is necessary for the app to send device-level notifications, but it should not be treated as a full legal marketing consent in every case.
The operating-system prompt usually says something like “Allow notifications?” It may not explain that the business will send promotional offers, targeted discounts, abandoned cart reminders or personalized campaigns. It also does not necessarily provide the legal information required under Turkish commercial communication and data protection rules.
Therefore, businesses should separate technical notification permission from marketing permission. A user may allow notifications for order tracking, delivery updates or security alerts but may not want campaign messages. A compliant app should provide internal notification preferences and allow the user to opt into or opt out of promotional categories.
The safest design is a two-layer model. First, the app may request operating-system notification permission. Second, the app should provide an internal preference center where the user can separately manage transactional notifications, campaign notifications, personalized offers, location-based promotions and third-party partner notifications.
Opt-Out and Right of Refusal
The right of refusal is essential in Turkish commercial electronic message law. The Regulation states that where a recipient rejects commercial electronic messages, the service provider must stop sending such messages within three business days after receiving the refusal request. (lexpera.com.tr)
For push notification marketing, an app should provide an easy and accessible opt-out mechanism. Users should not be forced to delete the app, contact customer service, send an e-mail or navigate through complicated menus to stop marketing notifications. The app should include a clear notification preference section where promotional notifications can be turned off.
A compliant opt-out system should:
Be easy to find.
Separate marketing notifications from necessary notifications.
Apply promptly.
Synchronize across devices where possible.
Reflect the user’s preference in marketing systems.
Stop third-party campaign notifications where applicable.
Preserve opt-out records.
The opt-out right should also be respected in practice. If a user disables marketing notifications, the app should not continue sending campaign messages through another channel such as SMS or e-mail unless the user has valid consent for that channel.
İYS and Push Notifications
The İleti Yönetim Sistemi, known as İYS, is the national platform for managing commercial electronic message approvals and refusal processes. The Ministry of Trade states that İYS allows citizens to view, control and revoke all commercial electronic message approvals from a single point and provides legal certainty to service providers regarding proof of consent. (ticaret.gov.tr)
İYS is especially associated with SMS, e-mail and voice-call permissions. For push notifications, businesses should carefully assess whether the particular communication channel and stored contact identifier fall within İYS processes. Even where a technical push notification is managed outside İYS, the business should not ignore the consent and refusal principles behind İYS.
A practical compliance model should therefore include both İYS compliance for SMS/e-mail/call marketing and in-app preference management for push notifications. If the same campaign is sent through multiple channels, each channel should be checked separately. A user who accepts push notifications may not have accepted SMS. A user who accepts e-mail may not have accepted app push notifications. Consent should not be assumed across channels.
KVKK and Personal Data in Push Notification Marketing
Push notification marketing almost always involves personal data processing. A business may process device identifiers, app user IDs, advertising IDs, phone numbers, e-mail addresses, IP addresses, location data, app behavior, purchase history, favorite products, abandoned carts, segmentation data and notification engagement records.
Under KVKK, personal data must be processed lawfully, fairly, for specific purposes and in accordance with data minimization principles. The user should be informed through a privacy notice, and explicit consent may be required for certain advertising, profiling or tracking activities.
The Ministry of Trade’s general information page also notes that messages sent without consent may raise issues under KVKK and that consumers may apply to the Personal Data Protection Authority in relation to messages sent without explicit consent. (ticaret.gov.tr)
Push notification marketing is not only about sending a message. It is also about deciding who receives the message, why they receive it, what data was used, whether the notification is personalized and whether third-party SDKs or advertising networks are involved. All of these steps may involve personal data processing.
Cookies, SDKs and Mobile Tracking
Mobile apps often use SDKs, advertising identifiers, analytics tools, deep links, pixels and tracking technologies to personalize push notifications. For example, an app may send a push notification when the user abandons a cart, views a product category, enters a location, reaches a game level or stops using the app for several days.
The KVKK Cookie Practices Guide explains that strictly necessary cookies are used for providing information society services, while other cookies may be used for advertising, marketing, functionality and personalization only if explicit consent is obtained. The guide’s good-practice example includes an “accept all,” “reject all” and “configure cookie settings” structure and states that non-essential cookies may be used for advertising and marketing activities if explicit consent is given. (kvkk.gov.tr)
Although this guide focuses on cookies, the same compliance logic is relevant to mobile tracking tools and SDKs. If a mobile app uses tracking technologies for advertising, marketing, personalization or behavioral profiling, the app should provide clear information and obtain valid consent where required. Users should also be able to change preferences later.
A business should know which SDKs are installed in the app, what data they collect, whether they send data abroad, whether they support targeted advertising and whether they process children’s data. SDK governance is a critical part of push notification compliance.
Targeted Push Notifications
Targeted push notifications are messages sent to specific users or groups based on data analysis. For example:
A shopping app sends a discount for shoes after the user views shoes.
A food delivery app sends a restaurant offer based on location.
A travel app sends hotel deals after flight search activity.
A game sends a paid item offer after the user fails a level.
A finance app sends a loan offer based on app behavior.
A marketplace sends a price-drop notification for a viewed product.
Targeted push notifications are powerful, but they raise advertising and data protection concerns. The 2026 amendments to the advertising regulation specifically address targeted advertising. The Ministry of Trade states that advertisers may present targeted ads based on online behavior and personal data analysis only if they provide consumers with direct and easily accessible information about the criteria used to show the advertisement and how those criteria can be changed. (ticaret.gov.tr)
This rule is highly relevant to push notifications. If a user receives “Special offer for you” because of location, purchase history, browsing behavior, segment membership or abandoned cart data, the app should be able to explain the targeting criteria and allow the user to change relevant preferences.
Children and Push Notification Marketing
Children require special protection in digital advertising. Mobile games, educational apps, entertainment apps, video apps, children’s shopping platforms and family apps may reach children directly. Children may not understand advertising, personalization, virtual currency, limited-time offers or in-app purchase pressure.
The 2026 amendments expressly prohibit targeted advertising directed at children through profiling methods based on personal data. (ticaret.gov.tr)
For push notification marketing, this means a child-facing app should not profile a child’s behavior and send personalized commercial push notifications based on that profile. A mobile game should not analyze a child’s gameplay behavior and then push paid item offers. An educational app should not profile a child’s learning performance and send commercial upgrades. A video app should not profile a child’s viewing behavior to push targeted merchandise or game offers.
Even non-targeted push notifications directed at children should be carefully reviewed. Messages should not exploit fear, peer pressure, urgency or parental pressure. Expressions such as “ask your parents now,” “your friends already bought this,” “limited chance to be the best,” or “buy now to win” may raise consumer protection concerns.
Push Notifications and In-App Purchases
Push notifications are often used to promote in-app purchases. Mobile games, fitness apps, language apps, productivity apps, dating apps, streaming platforms and education apps may send offers for premium plans, coins, tokens, filters, storage, game items or additional content.
Price information must be transparent. If a notification says “50% off today,” the discount should be real and the previous price should be documentable. If it says “free trial,” the post-trial price and automatic renewal should be clear before the user subscribes. If it says “limited time,” the limitation should be genuine.
The Ministry of Trade’s 2026 advertising amendments state that conditional sales advertisements providing discounts or other benefits are subject to discount advertising rules. They also include rules on the reference price that can be used as the pre-discount price. (ticaret.gov.tr)
Therefore, in-app purchase push notifications should not use artificial discounts, fake countdown timers or misleading “free” claims. The final payable amount should be clear before payment.
Push Notifications and Subscription Marketing
Subscription apps frequently use push notifications to encourage upgrades, renewals, reactivation or premium conversion. Examples include:
Your free trial ends soon. Upgrade now.
Premium is 40% off today.
Continue your subscription to keep your data.
Reactivate your membership.
Unlock all lessons now.
These messages must be accurate and not manipulative. A push notification should not exaggerate the consequences of non-renewal. It should not hide automatic renewal. It should not make cancellation difficult. It should not imply that the user will lose rights that they will not actually lose.
Subscription marketing should clearly disclose price, billing period, renewal, cancellation method and trial conditions before the user confirms payment. Push notifications may create the first commercial contact, but the landing screen must provide full and accurate information.
Misleading Push Notifications
A push notification may be misleading if it gives a false or incomplete impression. Common examples include:
“Only 1 item left” when stock is not actually limited.
“Last chance” when the campaign continues.
“Free gift” when the price has been increased.
“Your reward is waiting” when payment is required.
“Special for you” when the offer is generic.
“Guaranteed result” without evidence.
“Doctor approved” without lawful basis.
“Lowest price” without proof.
Because push notifications are short, businesses may be tempted to use aggressive wording. However, limited space does not justify misleading content. If material conditions cannot fit into the notification, the notification should be drafted more carefully and the landing page should immediately disclose conditions.
A push notification should not pressure consumers through false urgency or fear. This is especially important for children, elderly users, patients, debtors, financially vulnerable consumers and users of health or finance apps.
Dark Patterns in Push Notification Marketing
Dark patterns are manipulative interface designs that distort user choice. In push notification marketing, dark patterns may appear in notification permission screens, in-app preference centers, subscription flows and opt-out processes.
Examples include:
Making “allow marketing notifications” visually dominant.
Hiding the “reject” option.
Using guilt-based wording such as “No, I do not want savings.”
Asking repeatedly after refusal.
Combining service notifications and marketing notifications into one setting.
Making opt-out harder than opt-in.
Sending marketing messages after opt-out.
Using fake notification badges to create urgency.
A compliant app should give users genuine control. Refusing marketing notifications should be as easy as accepting them. Users should be able to change their preferences later. The design should not manipulate users into accepting commercial messages.
Location-Based Push Notifications
Location-based push notifications are common in retail, food delivery, transportation, travel, tourism and event apps. For example, a shopping app may send a discount when the user enters a mall, or a restaurant app may send a nearby offer.
Location data is sensitive from a privacy perspective. Businesses should clearly explain whether location data is used for marketing, not only for service functionality. If precise location is not necessary for the service, it should not be collected or used for advertising without a proper legal basis.
Location-based push notifications also require advertising transparency. A user should be able to understand that the message is based on location and should have the ability to disable location-based promotions.
Sector-Specific Restrictions
Push notifications are subject to sector-specific advertising rules when they promote regulated products or services.
Healthcare push notifications should not create unlawful demand for medical services or guarantee treatment results. Food supplement notifications should not claim disease prevention or treatment. Cosmetics notifications should not present products as medicines. Financial push notifications should not promise guaranteed profit or risk-free investment. Gambling and illegal betting promotions are high-risk and may be prohibited. Children’s products should not exploit child vulnerability or profile children.
The 2026 amendments also expanded restrictions on illegal games of chance advertisements. (ticaret.gov.tr)
Businesses should therefore classify the promoted product or service before sending push notifications. A generic discount notification may be acceptable for ordinary retail goods but risky for medical, financial or child-directed services.
Complaint and Enforcement Mechanisms
Consumers may complain about unwanted commercial electronic messages. The Ministry of Trade states that complaints about commercial electronic messages are examined and that administrative fines are imposed on real or legal persons found to have sent unlawful commercial electronic messages. Complaints may be submitted through the Ministry’s electronic complaint system integrated with e-Devlet or to the relevant provincial directorate. (ticaret.gov.tr)
Push notification complaints may also raise KVKK issues if the notification involved personal data processed without a lawful basis. The Ministry of Trade’s general information page notes that messages sent without explicit consent may also be relevant under KVKK. (ticaret.gov.tr)
In addition, misleading push notifications may be examined under advertising and unfair commercial practices rules. If a push notification contains false discount information, hidden fees, misleading health claims, fake scarcity or targeted advertising violations, the Advertising Board may become relevant.
Administrative Sanctions
Unlawful push notification marketing may create multiple sanction risks.
First, if the message is treated as an unlawful commercial electronic message, administrative fines may apply under electronic commerce legislation. The Ministry of Trade states that unlawful commercial electronic message senders may be subject to administrative fines. (ticaret.gov.tr)
Second, if the notification is misleading advertising or an unfair commercial practice, Advertising Board sanctions may apply. For 2026, administrative fines for misleading advertisements and unfair commercial practices may range from 99,339 TL to 39,916,524 TL, depending on factors such as the nature of the violation, benefit obtained, harm caused, fault, economic situation of the violator and advertising medium. (tuketici.ticaret.gov.tr)
Third, if personal data is processed unlawfully, KVKK sanctions may apply. This risk is especially relevant where push notifications are based on profiling, location, behavioral analytics or third-party SDK data.
Practical Compliance Checklist for Push Notification Marketing
Businesses sending push notifications in Turkey should apply the following checklist:
Separate transactional and marketing notifications.
Do not treat app installation as marketing consent.
Do not treat operating-system notification permission as complete legal consent.
Obtain clear consent for promotional push notifications where required.
Do not use pre-selected consent options.
Do not make marketing notification consent a condition of using the service.
Provide an in-app notification preference center.
Allow users to disable marketing notifications easily.
Stop sending marketing notifications promptly after opt-out.
Separate push, SMS, e-mail and call permissions.
Check İYS compliance for SMS, e-mail and voice-call campaigns.
Provide clear KVKK privacy notices.
Identify SDKs, tracking tools and advertising identifiers used in the app.
Obtain explicit consent where required for advertising and marketing tracking.
Provide information about targeted advertising criteria.
Allow users to change targeted advertising preferences.
Do not use profiling-based targeted advertising directed at children.
Avoid misleading discount, urgency, “free,” price and reward claims.
Disclose subscription, renewal and trial conditions clearly.
Review sector-specific restrictions.
Preserve consent logs, notification records, campaign screenshots and opt-out logs.
Best Practices for Mobile Apps
A compliant push notification strategy should be built into app design. Legal compliance should not be added after marketing automation is already active. Product teams, marketing teams, legal counsel, data protection officers and software developers should work together.
The app should include clear notification categories: order updates, security alerts, service notifications, campaign notifications, personalized offers, location-based promotions and partner offers. Users should be able to manage each category separately.
Marketing automation workflows should include legal triggers. For example, before sending an abandoned cart push notification, the system should check whether the user consented to promotional push notifications, whether personalized targeting is permitted, whether the user opted out, whether the campaign is accurate and whether sector-specific rules apply.
Businesses should also audit third-party tools. Many push notification platforms and analytics SDKs process user data. Contracts should include data protection obligations, confidentiality, security, retention, international transfer assessment and deletion rules.
Conclusion
Push notification marketing in Turkey is a powerful but legally sensitive digital marketing method. A push notification may appear simple, but it can involve commercial electronic message rules, advertising law, unfair commercial practices, KVKK, targeted advertising rules, child protection rules and sector-specific restrictions.
The key distinction is between necessary transactional notifications and promotional marketing notifications. Transactional messages support the service; marketing notifications promote goods, services, campaigns or commercial activity. Promotional push notifications should generally be handled through a consent-based, transparent and preference-based compliance model.
Turkish commercial electronic message rules require prior approval for commercial messages in many cases, recognize refusal rights and impose duties on service providers. The regulation covers commercial communications made through electronic communication tools for promoting or marketing goods and services. (lexpera.com.tr) The Ministry of Trade also defines commercial electronic messages broadly as electronic data, voice or image messages sent for commercial purposes and states that unlawful messages may result in administrative fines. (ticaret.gov.tr)
For mobile apps, KVKK compliance is equally important. Advertising SDKs, tracking tools, location-based notifications, abandoned cart reminders, behavioral segmentation and personalized push notifications may all involve personal data processing. The KVKK Cookie Practices Guide shows the importance of explicit consent and user control for advertising and marketing tracking technologies. (kvkk.gov.tr)
The 2026 amendments to Turkish advertising rules further strengthen the importance of targeted advertising transparency and prohibit profiling-based targeted advertising directed at children. (ticaret.gov.tr) These rules are directly relevant to mobile app push notifications because apps often use personalization, profiling, location data and behavioral analysis.
For businesses operating in Turkey or targeting Turkish users, the safest approach is clear: obtain proper permission, separate marketing from service notifications, provide easy opt-out, respect KVKK, avoid manipulative design, do not profile children for targeted ads, and ensure every push notification is truthful and transparent.
A lawful push notification strategy protects consumers from unwanted and manipulative messages, reduces administrative and data protection risk, and strengthens long-term app trust. In Turkey’s mobile-first digital market, successful push notification marketing should not depend on pressure, hidden consent or intrusive targeting. It should depend on lawful permission, accurate content and respect for user choice.
No Responses