Introduction
Targeted advertising has become one of the most powerful tools in digital marketing. Businesses no longer show the same advertisement to every consumer. Instead, they use online behavior, search history, purchase records, location data, demographic information, cookie data, device identifiers, interests and previous interactions to deliver personalized advertising content. This practice is generally known as targeted advertising.
In Turkey, targeted advertising and personal data protection are closely connected legal areas. Targeted advertising may be assessed under Turkish advertising law, consumer protection law, unfair commercial practices rules, electronic commerce legislation and, most importantly, the Personal Data Protection Law No. 6698, commonly known as the KVKK. Because targeted advertising often depends on collecting, analyzing and using personal data, businesses must comply not only with advertising transparency rules but also with data protection principles.
The importance of targeted advertising regulation increased significantly in 2026. The Ministry of Trade announced that amendments to the Regulation on Commercial Advertising and Unfair Commercial Practices were published in the Official Gazette dated 1 July 2026 and numbered 33297. According to the Ministry, these amendments introduced new rules in many areas, including targeted advertising, AI-generated advertisements, influencer marketing, discount advertising and consumer reviews. The Ministry also stated that targeted advertising practices involve presenting special advertising content to certain persons or groups by analyzing consumers’ online behavior and personal data.
Targeted advertising is not prohibited in Turkey as a general rule. However, it must be transparent, fair, lawful and compliant with data protection rules. Consumers should know why they are seeing a particular advertisement, which criteria are used to show that advertisement and how those criteria can be changed. The Ministry of Trade expressly stated that advertisers may conduct targeted advertising only if they provide consumers with direct and easily accessible information about the criteria used to show the advertisement and how those criteria can be changed.
This article explains the legal framework of targeted advertising in Turkey, the relationship between advertising law and KVKK, cookies, explicit consent, profiling, children’s data, special categories of personal data, consumer transparency, cross-border data transfer, Advertising Board sanctions and practical compliance steps for businesses.
What Is Targeted Advertising?
Targeted advertising is the practice of preparing, selecting or displaying advertisements based on information about a consumer or a group of consumers. Instead of publishing a general advertisement to everyone, a business uses data to predict which advertisement is more likely to affect a specific person.
For example, a consumer who recently searched for baby products may be shown advertisements for diapers, baby food or children’s clothing. A person who frequently visits travel websites may be shown hotel and flight advertisements. A user who abandoned a shopping cart may later see an advertisement for the same product on another website or social media platform. A consumer who lives in Istanbul may be shown location-specific restaurant or event advertisements.
Targeted advertising may use different types of data. These may include browsing history, search queries, location data, device identifiers, purchase history, viewed products, shopping cart activity, social media interactions, demographic information, loyalty program data, app usage data, cookies and similar tracking technologies.
From a legal perspective, the key issue is that such data can often identify or make identifiable a natural person. Therefore, targeted advertising frequently involves personal data processing. Under KVKK, many activities such as collecting, recording, storing, changing, transferring, classifying or using data are considered personal data processing. The Turkish Personal Data Protection Authority explains that all operations performed on data, including collection, recording, storage, alteration, transfer, classification or use, fall within the concept of personal data processing.
Legal Framework of Targeted Advertising in Turkey
Targeted advertising in Turkey is governed by a combination of legal regimes. The first is advertising and consumer protection law. Law No. 6502 on the Protection of Consumers and the Regulation on Commercial Advertising and Unfair Commercial Practices regulate commercial advertisements and unfair commercial practices. These rules require advertisements to be honest, accurate, clear and not misleading.
The second legal regime is personal data protection law. KVKK regulates how personal data may be processed. A business that collects and analyzes consumer data for advertising purposes must determine the legal basis for processing, inform the data subject, obtain explicit consent where required, comply with data minimization and purpose limitation principles and ensure data security.
The third regime is cookie and tracking technology compliance. Many targeted advertising systems rely on cookies, pixels, SDKs, local storage, device identifiers or similar technologies. These tools may collect behavioral data and enable retargeting, personalization, conversion tracking and audience segmentation.
The fourth regime is electronic commerce and commercial communication law. If targeted advertising is carried out through e-mail, SMS, push notifications or similar channels, commercial electronic message rules may also apply.
The fifth regime is sector-specific law. Targeted advertising for health services, food supplements, cosmetics, financial products, gambling-related services, alcohol, tobacco or products directed at children may require additional legal review.
Therefore, targeted advertising compliance in Turkey should not be reduced to a simple cookie banner. It requires a coordinated legal assessment involving consumer law, data protection law, advertising law, platform practices and the specific product or service being promoted.
Targeted Advertising Under Turkish Advertising Law
The 2026 amendments to the Regulation on Commercial Advertising and Unfair Commercial Practices are particularly important for targeted advertising. According to the Ministry of Trade, targeted advertising practices involve analyzing consumers’ online behavior and personal data to present special advertising content to certain individuals or groups.
The Ministry further stated that advertisers may conduct such advertising practices if they provide consumers with direct and easily accessible information about which criteria are used to show the advertisement and how those criteria can be changed. This rule introduces a transparency obligation from the consumer protection perspective.
In practice, this means that a consumer should not be exposed to a personalized advertisement without any meaningful explanation. The consumer should be able to understand whether the advertisement was shown because of location, interests, shopping history, previous website visits, demographic characteristics, search behavior or similar criteria.
This requirement is separate from, but related to, KVKK obligations. Even if the business has a valid data protection basis for processing personal data, the advertisement may still be unlawful under consumer protection rules if the targeting criteria are hidden or if the consumer is misled.
For example, if a consumer sees an advertisement for a loan because the platform inferred financial difficulty from browsing behavior, the consumer should not be manipulated by hidden profiling. If a consumer receives repeated advertisements for a health product based on sensitive browsing patterns, additional compliance concerns arise. If an advertisement is shown to a vulnerable consumer group through opaque targeting criteria, the practice may be considered unfair.
Personal Data Processing Conditions Under KVKK
Under KVKK, personal data cannot be processed arbitrarily. The Personal Data Protection Authority explains that Article 5 of Law No. 6698 lists the legal bases for personal data processing and that these legal bases cannot be expanded. These include explicit consent, processing expressly provided by law, necessity for the performance of a contract, necessity for the data controller’s legal obligation, data made public by the data subject, necessity for the establishment or protection of a right, and legitimate interest provided that fundamental rights and freedoms are not harmed.
For targeted advertising, the most commonly discussed legal bases are explicit consent and legitimate interest. However, businesses should be cautious. Behavioral advertising, retargeting, cross-site tracking, third-party advertising cookies and detailed profiling often create significant privacy impact. In many cases, explicit consent may be required, especially when non-essential cookies or tracking technologies are used for advertising purposes.
The Personal Data Protection Authority also emphasizes that if a processing activity can be carried out under a legal basis other than explicit consent, requesting explicit consent unnecessarily may mislead the data subject and constitute misuse of rights. This means that businesses must correctly identify the legal basis for each processing activity. They should not use a generic “we process your data based on consent and all other legal grounds” approach.
A proper targeted advertising compliance assessment should answer these questions:
Which personal data are collected?
Which technologies are used?
Which parties receive the data?
Is the data used for analytics, personalization, retargeting or direct marketing?
Is explicit consent required?
Is the consent freely given, specific and informed?
Can the user withdraw consent easily?
Is the same data used for multiple purposes?
Is the data transferred abroad?
Are children or special categories of data involved?
Aydınlatma Obligation and Transparency
Transparency is one of the central principles of both Turkish advertising law and KVKK. Under KVKK, data subjects must be informed about who processes their data, for what purposes, on what legal basis, by which method the data is collected and to whom it may be transferred. The Personal Data Protection Authority states that data controllers must provide information including the identity of the controller, purposes of processing, recipients of transfers, method and legal basis of collection, and data subject rights under Article 11.
The Authority also clarifies that the obligation to inform applies in every case where personal data are processed, regardless of whether the processing is based on explicit consent or another legal basis. This is highly important for targeted advertising. Even if a business believes it has a valid legal basis, it must still inform the data subject.
In 2026, the Personal Data Protection Board also issued an important principle decision on the separation of privacy notices and explicit consent texts. The Board stated that privacy notices and explicit consent texts must be prepared separately where processing is based on explicit consent, and that vague, overly complex or misleading texts should not be used.
For targeted advertising, this means that businesses should not combine all cookie, consent, privacy and marketing information into one confusing text. The consumer should be able to distinguish between information given under the obligation to inform and consent requested for optional advertising data processing. Consent must not be hidden inside general terms of use or privacy policies.
Cookies and Targeted Advertising
Cookies are one of the most commonly used tools in targeted advertising. They may be used to remember user preferences, measure traffic, analyze behavior, retarget users, create advertising audiences and show personalized content.
The Personal Data Protection Authority’s Cookie Practices Guide distinguishes between different cookie types. It explains that strictly necessary cookies are used for functions such as logging in, filling forms or remembering privacy preferences and should not be used for marketing purposes.
The same guide also defines advertising and marketing cookies as cookies used for advertising and marketing purposes in the online environment. These cookies are directly relevant to targeted advertising because they allow businesses to analyze user behavior and display personalized advertisements.
The Personal Data Protection Board’s 2022/229 decision is especially important for e-commerce and digital advertising. In that decision, the Board stated that strictly necessary cookies may be used without explicit consent, but cookies used for advertising, marketing and performance purposes are subject to explicit consent. The Board also noted that advertising and retargeting cookies may involve personal data processing where they are used to present personalized content, campaigns and products.
Therefore, cookie banners used in Turkey should not be merely decorative. They must enable real, informed and freely given choices. Advertising cookies should not be placed before valid consent where consent is required. Users should be able to reject non-essential cookies as easily as they accept them. Pre-ticked boxes, forced consent, unclear buttons, hidden rejection options and manipulative designs may create legal risk.
Profiling and Consumer Autonomy
Profiling is the process of analyzing personal data to evaluate or predict aspects of a person’s behavior, preferences, interests, economic situation, location, health, habits or purchasing tendencies. In targeted advertising, profiling is often used to determine which advertisements a person is likely to respond to.
Profiling can benefit consumers when it shows relevant advertisements. However, it can also harm consumer autonomy if it is opaque, excessive, discriminatory or manipulative. A consumer may not know that a platform has categorized them as financially vulnerable, health-conscious, new parent, luxury buyer, price-sensitive, frequent traveler or gambling-interested. If advertisements are then designed to exploit these categories, the practice may become unfair.
The 2026 advertising amendments respond to this risk by requiring advertisers to provide consumers with information about the criteria used for targeted advertising and how these criteria can be changed. This is an important consumer protection measure because it gives consumers more control over advertising exposure.
From a KVKK perspective, profiling should also comply with purpose limitation, data minimization and lawfulness principles. Businesses should not collect more data than necessary. They should not use data collected for one purpose for a completely different advertising purpose without a proper legal basis and information notice. They should not retain advertising profiles indefinitely. They should not share profile data with third parties without proper legal analysis.
Children and Targeted Advertising
Children are a special concern in targeted advertising. They may not understand how profiling works, why they are seeing an advertisement or how their online behavior is used to influence them. For this reason, the Turkish advertising framework has introduced a strict rule.
The Ministry of Trade announced that targeted advertising through profiling methods based on personal data is prohibited for children. This is one of the most important developments in Turkish digital advertising law.
This rule is highly relevant for gaming platforms, video applications, educational apps, toy brands, family influencers, children’s content platforms, mobile games, social media platforms and e-commerce businesses selling children’s products. If a business knows or can reasonably understand that the consumer is a child, it should not use personal data-based profiling to show targeted advertisements to that child.
The practical consequences are significant. Businesses should review audience segmentation, platform settings, age signals, app design, cookies, SDKs, ad networks and retargeting tools. They should avoid creating behavioral advertising profiles for children. They should not use children’s online behavior, interests, location or engagement patterns to personalize commercial messages.
Even where general advertising to children is legally possible, targeted advertising based on personal data profiling is a much higher-risk area. The safest approach is to avoid behavioral targeting for children entirely and to use contextual, non-personalized advertising where legally appropriate.
Special Categories of Personal Data
Targeted advertising may become especially risky if it involves special categories of personal data. Under Turkish law, special categories include sensitive data such as health data, biometric data, genetic data, religious belief, political opinion, association or union membership and similar categories.
Although targeted advertising systems may not always directly ask for sensitive information, they may infer sensitive characteristics from behavior. For example, repeated visits to certain medical websites may reveal health concerns. Searching for religious products or political content may imply sensitive preferences. Using location data around hospitals, clinics or places of worship may reveal sensitive patterns.
Using such data or inferences for targeted advertising can create serious legal risk. Businesses should avoid building advertising segments based on health conditions, political views, religious beliefs, biometric data or similar sensitive categories unless a very specific and lawful basis exists. In many cases, using special categories of personal data for advertising will be difficult to justify and may be disproportionate.
This issue is also connected to fairness. Even if a business believes that data were lawfully obtained, using sensitive inferences to target vulnerable consumers may violate consumer protection principles. For example, targeting persons inferred to have a medical condition with unverified treatment advertisements may be both a data protection and advertising law problem.
Third-Party Ad Networks and Data Sharing
Targeted advertising often involves third parties. Businesses may use advertising networks, analytics providers, social media pixels, retargeting platforms, data management platforms, affiliate networks, mobile SDKs and measurement partners. These third parties may collect or receive personal data through websites and applications.
This creates several legal questions. Who is the data controller? Who is the data processor? Is there joint controllership? Which data are transferred? Is data transferred abroad? Are users informed? Is explicit consent required? Are contracts in place? Are technical and administrative security measures sufficient?
The Personal Data Protection Board’s 2022/229 decision also addressed third-party advertising and retargeting cookies in the context of e-commerce. The Board noted that the data controller’s cookie policy included explanations about matching cookie data with other personal data to provide personalized content, campaigns and products, and that third-party cookies were used for advertising and retargeting.
Businesses should therefore map all advertising technologies used on their websites and mobile applications. They should identify each third-party tool, its purpose, the data collected, the legal basis, the consent requirement, the transfer mechanism and the retention period. Without a data mapping exercise, targeted advertising compliance is usually incomplete.
Cross-Border Data Transfers
Many advertising technologies involve international data transfers. Global ad networks, analytics providers, cloud platforms, social media pixels and mobile SDKs may transfer data to servers outside Turkey. Cross-border transfer is a separate compliance issue under KVKK.
The Personal Data Protection Board’s 2022/229 decision emphasized that where personal data are transferred abroad through cookies, the transfer must comply with Article 9 of KVKK. In that case, the Board noted that where adequate protection countries had not been determined and no undertaking had been submitted, transfer abroad could only be carried out based on explicit consent, and that the relevant processing needed to be brought into compliance.
For targeted advertising, this means that businesses should not ignore international data flows. Cookie consent alone may not be sufficient if the consent text does not properly cover transfer abroad or if the transfer mechanism is legally inadequate. Businesses should review the latest KVKK rules and Board decisions on cross-border data transfers before using global advertising technologies.
Targeted Advertising and Dark Patterns
Targeted advertising can become unlawful not only because of data processing problems but also because of manipulative user interface design. For example, a website may make it easy to accept advertising cookies but difficult to reject them. A platform may use bright colors for “accept all” and hide “reject all.” A mobile app may block access unless the user accepts tracking that is not necessary for the service.
Such designs may undermine free consent. They may also constitute unfair commercial practices if they manipulate consumer decisions. In May 2026, the Advertising Board emphasized that manipulative interface designs negatively affecting consumers’ decision-making are treated as unfair commercial practices. The same meeting resulted in 146 unlawful files out of 156 reviewed files, approximately 23 million TL in administrative fines and access blocking decisions for 17 advertisements.
Therefore, consent management platforms and cookie banners should be designed fairly. A business should not use dark patterns to push users into accepting personalized advertising. The user’s refusal should be respected and should not be made unnecessarily difficult.
Sanctions and Legal Risks
Unlawful targeted advertising may create multiple layers of risk.
First, the Advertising Board may impose sanctions for misleading advertisements or unfair commercial practices. For 2026, the Ministry of Trade announced that administrative fines for misleading advertisements and unfair commercial practices may range from 99,339 TL to 39,916,524 TL, depending on factors such as the medium, the unfairness of the violation, the benefit obtained, harm caused, fault and the economic situation of the violator.
Second, the Personal Data Protection Board may impose sanctions under KVKK if personal data are processed unlawfully, if explicit consent is not obtained where required, if the obligation to inform is not fulfilled, if data security measures are insufficient or if cross-border transfers are unlawful.
Third, consumers may file complaints. Competitors may also complain if targeted advertising creates unfair competition, uses unlawful data advantages or misleads consumers.
Fourth, reputational harm may occur. Consumers are increasingly sensitive to privacy. A business that secretly tracks users, uses intrusive profiling or makes rejection difficult may lose consumer trust.
Fifth, platform-level consequences may arise. Social media platforms, app stores and advertising networks may suspend campaigns or accounts if policies on consent, targeting, sensitive categories or children are violated.
Practical Compliance Checklist
Businesses using targeted advertising in Turkey should implement a structured compliance program. The following checklist may be used before launching a campaign:
Identify all personal data used for advertising.
Map cookies, pixels, SDKs and third-party advertising tools.
Determine the legal basis for each processing activity.
Obtain explicit consent where required, especially for advertising and marketing cookies.
Prepare a clear privacy notice before processing starts.
Separate privacy notices and explicit consent texts where consent is relied upon.
Explain targeted advertising criteria directly and accessibly to consumers.
Allow consumers to change targeting criteria and advertising preferences.
Do not use profiling-based targeted advertising for children.
Avoid using special categories of personal data or sensitive inferences for advertising.
Review international data transfers.
Avoid dark patterns in cookie banners and consent screens.
Ensure that consent withdrawal is easy.
Keep records of consent, preferences and disclosures.
Review all advertising claims for accuracy and substantiation.
Conduct legal review for high-risk sectors such as health, finance, cosmetics and children’s products.
This checklist should be applied before the campaign goes live. In digital advertising, unlawful processing may happen instantly and at scale. Once personal data are collected and shared with advertising networks, later correction may not fully eliminate legal risk.
Best Practices for Businesses
A legally compliant targeted advertising strategy should be based on transparency and control. Consumers should know that targeting is taking place, why they are seeing an advertisement and how they can change or refuse such targeting.
Cookie banners should be simple, balanced and non-manipulative. Privacy notices should be written in clear language. Consent should be specific, informed and freely given. Data should not be collected “just in case.” Advertising profiles should not be kept longer than necessary. Data sharing with third parties should be limited and documented.
Businesses should also establish internal governance. Marketing teams, legal counsel, IT teams, data protection officers and external agencies should work together. Many compliance failures occur because marketing tools are installed without legal review. Every new pixel, SDK, analytics tool or advertising network should be assessed before activation.
Contracts with agencies and advertising technology providers should include data protection clauses, confidentiality obligations, data security commitments, transfer rules, audit rights and responsibility allocation. However, contractual clauses do not replace the data controller’s own legal obligations.
Conclusion
Targeted advertising and personal data protection in Turkey are now inseparable. Modern advertising depends heavily on data, but data-driven marketing must comply with Turkish advertising law, consumer protection principles and KVKK.
The 2026 amendments to the Regulation on Commercial Advertising and Unfair Commercial Practices introduced a clearer framework for targeted advertising. Advertisers must provide consumers with direct and easily accessible information about the criteria used to show targeted advertisements and how those criteria can be changed. Profiling-based targeted advertising directed at children is expressly prohibited.
At the same time, KVKK requires a lawful basis for personal data processing, proper privacy notices, explicit consent where necessary, data minimization, purpose limitation, security measures and lawful cross-border transfers. The Personal Data Protection Board’s cookie-related decisions show that advertising, marketing and performance cookies generally require explicit consent when they are not strictly necessary.
For businesses operating in Turkey or targeting Turkish consumers, targeted advertising should be treated as a high-priority compliance area. A successful campaign should not only be personalized and commercially effective; it should also be transparent, lawful, fair and respectful of consumer autonomy.
The safest approach is to build targeted advertising systems around consumer choice. When consumers are clearly informed, given real control and protected from manipulative profiling, targeted advertising can be both effective and legally compliant. In the Turkish market, privacy-friendly advertising is not merely a regulatory requirement; it is also a foundation for long-term consumer trust.
No Responses