A Practical Legal Guide to Profiling, Cookies, Personalised Advertising and Consumer Transparency in Turkey

A consumer searches online for running shoes.

A few minutes later, advertisements for the same shoes begin appearing on Instagram, YouTube and unrelated websites.

Another consumer looks at baby products and subsequently receives advertisements specifically aimed at new parents.

A user visits a website offering hair-transplant services and, for the following week, advertisements for hair transplantation appear across social-media platforms.

None of these advertisements are random.

They are generated through targeted advertising systems that analyse information such as:

• websites visited;
• products viewed;
• previous purchases;
• location;
• age range;
• device identifiers;
• cookies;
• app activity;
• search behaviour;
• demographic characteristics; and
• inferred interests.

For businesses, targeted advertising can dramatically improve marketing efficiency.

For Turkish law, however, it creates two separate legal questions:

First: Was the personal data used to create the advertising profile lawfully processed?

That question is primarily governed by Personal Data Protection Law No. 6698 (“KVKK”).

Second: Was the consumer lawfully and transparently influenced by the personalised advertisement?

That question falls within Consumer Protection Law No. 6502 and the Commercial Advertising and Unfair Commercial Practices Regulation.

As of 1 August 2026, this distinction has become even more important because Turkey has introduced an express regulatory provision governing targeted advertising.

The practical rule for advertisers is therefore simple:

A targeted advertisement must comply with both data-protection law and consumer-protection law. Compliance with one does not cure a violation of the other.

1. Turkey Now Expressly Regulates Targeted Advertising

One of the most significant developments in Turkish digital advertising law occurred with the amendment to the Commercial Advertising and Unfair Commercial Practices Regulation, published on 1 July 2026 and effective from 1 August 2026.

The amendment introduced Article 25/A specifically governing targeted advertising.

According to the provision, targeted advertising includes the presentation of advertisements to specific persons or groups through analysis of information such as:

• consumers’ online behaviour;
• historical preference records;
• location data;
• demographic information; and
• similar personal data.

The Ministry of Trade has confirmed that the new rules are intended to regulate advertising produced by analysing consumers’ online behaviour and personal data.

This is a major development because targeted advertising is no longer regulated only indirectly through general advertising principles.

It now has its own explicit consumer-law transparency rules.

2. Targeted Advertising Has Two Different Legal Layers

The easiest way to understand the Turkish regulatory structure is to divide the process into two stages.

Stage One — Building the Profile

The business collects or obtains information about the individual.

For example:

User visited Product A →
User searched for Product B →
User lives in Istanbul →
User is aged 25–34 →
User previously bought Product C →
Algorithm concludes that user is interested in running →
User is placed in the “high-intent sports customer” segment.

This stage concerns personal data processing.

KVKK applies.

Stage Two — Using the Profile to Influence the Consumer

The business then displays:

“20% discount on running shoes — only today.”

This stage concerns the commercial communication presented to the consumer.

Consumer and advertising law apply.

Therefore, an advertiser may have lawfully collected the data but still publish an unlawful advertisement.

Equally, the advertisement itself may be perfectly truthful while the underlying profiling is unlawful under KVKK.

The two analyses must remain separate.

3. Is Advertising Data Really “Personal Data”?

Very often, yes.

Businesses sometimes assume that targeted advertising does not involve personal data because they do not know the user’s name.

That assumption can be dangerous.

Personal data under KVKK is not limited to:

• name;
• surname;
• Turkish identity number; or
• telephone number.

Information relating to an identifiable or identifiable natural person may constitute personal data.

Advertising systems may therefore process personal data through:

• cookie IDs;
• advertising IDs;
• IP addresses;
• user account IDs;
• location information;
• browser identifiers;
• device fingerprints;
• purchasing history; and
• behavioural profiles.

A marketer may identify a person internally only as:

User ID 7583932

but if the system can distinguish and follow that user across interactions, KVKK questions can still arise.

Replacing a person’s name with an advertising ID is therefore not necessarily true anonymisation.

4. Profiling Is Itself a Personal Data Processing Activity

Targeted advertising normally involves profiling.

A business does not merely record that a consumer viewed a product.

It analyses several data points and makes an inference:

“This person is probably interested in luxury travel.”

or:

“This consumer is likely to buy a new car.”

or:

“This user appears interested in cosmetic surgery.”

This inferred information can itself become part of the user’s personal-data profile.

KVKK expressly recognises rights relating to automated analysis. Article 11 gives individuals the right to object where personal data is analysed exclusively through automated systems and produces a result against the person. Individuals may also request information about processing and seek compensation where unlawful processing causes damage.

Consequently, advertisers should not assume that an inference generated by an algorithm falls outside data-protection legislation merely because the consumer never directly provided that information.

5. Does Targeted Advertising Always Require Explicit Consent?

Not necessarily.

This requires careful distinction.

Article 5 KVKK allows personal data processing where one of the statutory processing conditions exists.

These include, among others:

• explicit consent;
• processing expressly required by law;
• necessity directly connected with conclusion or performance of a contract;
• compliance with a legal obligation;
• establishment, exercise or protection of a right; and
• necessity for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the individual are not harmed.

Accordingly, saying:

“All advertising requires explicit consent”

would be legally inaccurate.

The correct question is:

What data is being processed, through which technology, for what advertising purpose and under which Article 5 processing condition?

However, targeted advertising based on tracking technologies frequently presents a much stronger consent requirement.

6. Advertising and Marketing Cookies Normally Require Particular Care

The Personal Data Protection Authority’s Cookie Practices Guide distinguishes advertising and marketing cookies from strictly necessary cookies.

Advertising cookies may be used by advertising partners to build profiles based on users’ interests and display relevant advertisements.

The distinction is practically crucial.

A cookie allowing a website to remember that the user has logged in may be necessary to provide the service.

A cookie following the consumer across multiple websites so that advertisements can later be shown is fundamentally different.

In its decision dated 10 March 2022, No. 2022/229, the Personal Data Protection Board considered targeting, profiling and behavioural advertising carried out through cookies.

The Board concluded, among other things, that where non-essential cookies used for advertising, marketing and performance purposes lacked another valid processing condition, users had to give valid explicit consent before those cookies were activated.

The Board specifically required an opt-in system, meaning the non-essential advertising cookies should not operate by default before the user performs an affirmative action.

This remains one of the most important decisions for Turkish online advertising practice.

7. “By Continuing to Browse, You Accept Cookies” Is Highly Risky

A common website banner states:

“By continuing to use this website, you consent to cookies.”

For behavioural advertising, that model is highly problematic.

Valid explicit consent under KVKK must be:

• related to a specific subject;
• based on information; and
• freely given.

The Personal Data Protection Board has emphasised that consent should normally involve an active action by the user.

In its 2023 decision concerning an online gaming platform, the Board referred to the Cookie Guide and stated that good practice may involve presenting “accept,” “reject” and “preferences” buttons with comparable prominence.

It also criticised bundled consent arrangements that failed to permit users to make sufficiently specific choices between cookie categories.

Accordingly, the safer structure for targeted-advertising cookies is generally:

Default: marketing tracking OFF

followed by a genuine user choice.

8. Rejecting Advertising Cookies Should Not Be Artificially Difficult

Consent must be freely given.

Businesses should therefore be cautious about consent interfaces such as:

ACCEPT ALL — large button

while:

Reject advertising cookies → Settings → Advanced settings → Advertising → Disable → Confirm

requires five separate steps.

Even where the exact legality depends on the factual circumstances, designing the interface to push the user toward consent creates significant KVKK risk.

The Personal Data Protection Board has specifically referred to equal presentation of acceptance, rejection and preference options as good practice.

A business should therefore avoid treating a consent-management platform as a cosmetic banner.

The technical configuration behind the banner matters.

9. A Privacy Notice and Explicit Consent Are Not the Same Thing

This distinction is frequently misunderstood.

KVKK Article 10 imposes an information obligation on the data controller.

When personal data is collected, the individual must generally be informed about matters including:

• identity of the data controller;
• purpose of processing;
• persons to whom the data may be transferred;
• method and legal basis of collection; and
• rights available under Article 11.

This is not the same as obtaining consent.

For example:

“We process your browsing behaviour for targeted advertising.”

is an information statement.

By itself, it does not necessarily constitute valid explicit consent where consent is the relevant legal basis.

Likewise, obtaining consent does not eliminate the obligation to provide appropriate information.

The Authority has expressly emphasised that the information obligation applies independently of whether processing is based on consent or another legal basis.

10. The New Consumer-Law Transparency Rule Creates an Additional Obligation

The 2026 amendment creates another transparency requirement completely separate from the KVKK information obligation.

Under Article 25/A of the Commercial Advertising and Unfair Commercial Practices Regulation, targeted advertising may be carried out provided that consumers receive direct and easily accessible information regarding:

• the criteria used to determine why that advertisement is being displayed to them; and
• how those criteria can be modified.

The Ministry of Trade has expressly confirmed this obligation.

This means that an interface such as:

Why am I seeing this ad?

may now have direct legal significance.

The explanation might state:

“You are seeing this advertisement because you previously viewed running products and selected Istanbul as your location.”

The consumer should also be able to understand how such advertising preferences can be changed.

11. KVKK Transparency and Consumer Transparency Are Different

A business may therefore need two overlapping but distinct layers of explanation.

KVKK Layer

The privacy information may explain:

• what personal data is processed;
• purposes;
• legal basis;
• recipients;
• collection method;
• retention;
• international transfers; and
• data-subject rights.

Consumer-Law Layer

The advertising interface should explain:

• why this particular advertisement was selected for the particular consumer; and
• how the targeting criteria can be altered.

One cannot simply substitute the other.

A 20-page privacy policy buried in the footer does not necessarily satisfy the practical consumer-law requirement to tell the user why a specific advertisement appeared.

Similarly, a “Why this ad?” button does not replace the data controller’s Article 10 KVKK obligations.

12. The Consumer Must Not Be Misled Even Where Profiling Is Lawful

Suppose a company legally profiles users interested in holidays.

The profiling itself may comply with KVKK.

But the resulting advertisement states:

“Only 2 hotel rooms left at this price!”

when the company has no evidence that only two rooms remain.

The advertisement may violate Turkish consumer law even though the data processing was lawful.

Article 61 of Consumer Protection Law No. 6502 requires commercial advertising to be honest and accurate and prohibits misleading advertisements and advertisements exploiting consumers’ lack of knowledge or experience.

Advertisers are also required to prove factual claims contained in their advertisements.

Targeting does not reduce these obligations.

Indeed, personalised advertising may increase the impact of a misleading statement because it is shown precisely to consumers most likely to respond.

13. Targeting Vulnerable Consumers Can Become an Unfair Commercial Practice

Article 62 of Law No. 6502 prohibits unfair commercial practices.

A practice may be unfair where it fails to comply with professional diligence and materially distorts, or is likely materially to distort, the economic behaviour of the average consumer or the average member of the targeted group.

This becomes particularly relevant where advertising algorithms identify vulnerable categories.

Consider:

A consumer repeatedly searches for emergency loans.

An advertising system identifies the person as financially distressed and begins aggressively serving high-cost credit advertisements.

Or:

A user repeatedly searches for weight-loss information.

The algorithm categorises the individual as highly susceptible to slimming-related advertising and serves exaggerated weight-loss claims.

Even if the data-processing basis were otherwise defendable, the manner in which the profile is exploited commercially may raise separate consumer-law questions.

14. Children Are Now Subject to a Specific Targeted-Advertising Prohibition

The 2026 amendment introduces one of the clearest rules in the field.

Where a consumer is known to be a child, or where it can reasonably be expected that the consumer is a child, targeted advertising based on personal-data profiling may not be carried out.

The Ministry of Trade expressly describes the new rule as a prohibition on targeted advertisements directed at children through personal-data-based profiling.

This is stronger than merely requiring parental consent for a particular marketing activity.

From the consumer-advertising perspective, the prohibited practice itself is the use of personal-data profiling to target children.

Businesses operating:

• gaming applications;
• children’s websites;
• educational platforms;
• toy stores;
• social-media applications; or
• youth-oriented entertainment services

should therefore review advertising systems carefully.

A platform cannot safely ignore obvious age indicators and later argue that it did not technically verify the child’s age.

The regulation expressly incorporates what the business could reasonably be expected to know.

15. Sensitive Data Creates Even Greater Risk

Targeted advertising becomes substantially more problematic when the profile contains special categories of personal data under Article 6 KVKK.

Special categories include information relating to matters such as:

• race;
• ethnic origin;
• political opinions;
• religion and beliefs;
• association, foundation or trade-union membership;
• health;
• sex life;
• criminal convictions and security measures;
• biometric data; and
• genetic data.

The 2024 KVKK amendments changed the processing conditions for sensitive data, but special-category information remains subject to a substantially stricter regime and additional safeguards.

Ordinary commercial advertising will rarely provide a convincing justification for exploiting sensitive personal information without a very clear lawful basis.

16. Example: Health-Based Advertising

Suppose a person visits a page titled:

“Symptoms of infertility.”

An advertising network subsequently places the consumer in a segment called:

“Possible infertility patient.”

The user then begins receiving fertility-clinic advertisements.

This creates particularly serious risks.

The advertiser may argue:

“We never received medical records.”

But the system may have inferred health-related information from browsing behaviour.

The legal analysis should therefore examine the substance of the profile rather than merely the original data source.

Targeting individuals because they appear to suffer from:

• cancer;
• infertility;
• depression;
• sexually transmitted diseases;
• obesity;
• addiction; or
• another health condition

can create materially higher KVKK risks than targeting someone because they appear interested in running shoes.

17. Example: Political Profiling

A similar issue arises with political information.

Suppose an advertising platform analyses:

• articles read;
• videos watched;
• political pages followed; and
• petition activity

and infers the user’s political tendency.

Political opinion is expressly classified as special-category personal data under KVKK.

The Personal Data Protection Board has previously treated identifiable political preference data as special-category information and emphasised the need for a valid Article 6 processing condition.

Commercial or political advertisers should therefore exercise extreme caution before using inferred political profiles for targeting.

18. First-Party Customer Data Does Not Automatically Require the Same Analysis as Third-Party Tracking

Consider a clothing retailer with a registered customer.

The retailer knows that the customer previously purchased:

• three men’s shirts;
• two jackets; and
• a pair of shoes.

The company decides to display jacket advertisements when that same customer logs into its own website.

That situation is legally different from allowing numerous third-party advertising networks to follow the customer across hundreds of unrelated websites.

The applicable processing condition must still be assessed, and the general principles of KVKK Article 4 remain relevant:

• lawfulness and fairness;
• accuracy;
• specific, explicit and legitimate purposes;
• relevance, limitation and proportionality; and
• appropriate retention periods.

But not every form of internal personalisation automatically produces the same legal result as cross-site behavioural advertising.

This is why companies should document each advertising processing operation separately rather than write one general statement saying:

“Marketing is based on consent.”

19. Legitimate Interest Is Not an Automatic Marketing Exception

Article 5 allows processing necessary for the legitimate interests of the data controller where the fundamental rights and freedoms of the data subject are not harmed.

Businesses sometimes interpret this as:

“Advertising increases revenue, therefore we have a legitimate interest.”

That analysis is incomplete.

A legitimate-interest assessment requires more than identifying a commercial benefit.

The business should consider matters such as:

• Is the processing genuinely necessary?
• Is there a less intrusive alternative?
• What would the consumer reasonably expect?
• How extensive is the tracking?
• Are third-party websites involved?
• How long is the profile retained?
• Can the user easily object?
• Does the profile reveal sensitive characteristics?
• Does the processing materially interfere with privacy?

The Personal Data Protection Board’s cookie decision is particularly instructive: in the circumstances examined, the company could not rely on legitimate interest to justify non-essential advertising cookies and was required to implement an opt-in mechanism where no other processing condition existed.

20. Meta Pixel, Google Advertising Tools and Similar Technologies Create International Transfer Questions

Many targeted-advertising systems involve foreign technology providers.

Examples include:

• advertising pixels;
• analytics SDKs;
• social-media advertising tools;
• conversion APIs;
• cloud marketing platforms; and
• international data-management platforms.

A Turkish business may therefore collect data in Turkey but transmit identifiers and behavioural data to servers or companies abroad.

That creates a separate international transfer analysis under Article 9 KVKK.

The 2024 amendments fundamentally changed the international-transfer framework.

Under the new system, transfers may rely, depending on the circumstances, on:

• an adequacy decision;
• appropriate safeguards;
• standard contracts;
• binding corporate rules;
• approved undertakings; or
• statutory exceptional transfer situations.

The Personal Data Protection Authority expressly explains that the revised Article 9 introduced mechanisms such as standard contracts and binding corporate rules into the transfer system.

Therefore:

“The user consented to advertising cookies”

does not by itself resolve every international-transfer issue.

The transfer mechanism must separately comply with Article 9.

21. Advertising Platforms and Advertisers Must Determine Their Own KVKK Roles

A business running advertisements through a major technology platform should ask:

Who determines why and how personal data is processed?

The answer cannot always be determined merely by reading the title of a contract.

Depending on the architecture:

• the advertiser may be a data controller;
• the advertising platform may independently be a data controller;
• one party may operate as a data processor for specific activities; or
• different roles may apply to different processing stages.

For example:

A retailer uploads its own customer list to an advertising platform in order to create a custom audience.

The retailer cannot necessarily defend an unlawful upload by stating:

“The advertising platform is responsible for data protection.”

The retailer itself decided to use its customer database for advertising and initiated the transfer.

Its own KVKK obligations must therefore be examined.

22. Custom Audiences Require Particular Care

A common advertising technique works as follows:

1. a company has 50,000 customer email addresses;
2. it uploads them to an advertising platform;
3. the platform matches those emails with existing accounts;
4. advertisements are shown to matching users.

Even if the emails are converted into hashed values before transmission, companies should not automatically assume that the data has become anonymous.

If the platform can match the values back to identifiable users, the process may still constitute personal data processing.

Businesses should therefore analyse:

• the original purpose for which the email addresses were collected;
• the applicable Article 5 processing condition;
• whether advertising use is compatible with that purpose;
• whether adequate information was given;
• the recipient platform;
• international transfer implications; and
• applicable retention periods.

23. Lookalike Audiences Can Also Be Legally Relevant

A second technique is a lookalike audience.

The advertiser provides a group of existing customers.

The advertising platform then identifies other consumers who share similar characteristics.

For example:

Existing customers are mainly women aged 30–45 living in Istanbul who follow luxury-fashion content.

The platform identifies thousands of similar users and shows them the advertisement.

The final recipients may never have interacted with the advertiser before.

Nevertheless, personal-data processing may have occurred at both the audience-generation and advertising-selection stages.

The fact that an algorithm rather than a human employee selected the recipients does not place the activity outside KVKK or consumer law.

24. SMS and Email Marketing Introduce a Third Regulatory Layer

Targeted advertising displayed inside a website or social-media feed should be distinguished from:

• promotional SMS;
• commercial email;
• marketing calls.

These may additionally fall under Law No. 6563 on the Regulation of Electronic Commerce and the rules governing commercial electronic communications.

The Ministry of Trade explains that commercial electronic messages to consumers generally require prior approval and that the approval continues until the recipient exercises the right to refuse. Commercial electronic communication permissions are managed through the Commercial Electronic Message Management System (İYS).

Consequently, a company may theoretically satisfy KVKK yet still violate electronic-marketing rules.

For example:

The company may lawfully possess the customer’s telephone number for delivery purposes.

That does not automatically mean that it may send promotional SMS messages.

The legal basis for possessing the telephone number and the commercial electronic communication permission are different questions.

25. KVKK Consent and İYS Marketing Approval Should Not Be Confused

This distinction is extremely important in practice.

A company may require:

KVKK processing basis

for processing the telephone number and associated marketing profile.

And separately:

Commercial electronic communication approval

for sending the advertising SMS, email or call under Law No. 6563.

Obtaining one does not automatically prove that the other has been satisfied.

Businesses should therefore avoid consent forms that indiscriminately merge:

• privacy notice;
• KVKK explicit consent;
• commercial electronic communication permission;
• membership terms; and
• advertising preferences

into one mandatory checkbox.

26. Retargeting After a Consumer Rejects Marketing Cookies Can Be Dangerous

Consider the following scenario.

A consumer enters an online shop.

The cookie banner appears.

The consumer selects:

Reject advertising cookies.

Nevertheless, the retailer’s advertising pixel fires and records that the consumer viewed a particular laptop.

The following day the consumer receives advertisements for that laptop on another platform.

This is a classic example where the business’s public interface and actual technical implementation may contradict each other.

The 2022 KVKK decision demonstrates that the Board examines not merely what the privacy policy claims, but whether targeting cookies are actually active and processing data.

Therefore, legal compliance teams should test the website technically.

A beautifully drafted cookie policy cannot correct a pixel that fires before consent.

27. Example: An E-Commerce Company That Does It Correctly

Consider a more compliant structure.

A Turkish online retailer opens with:

Cookie Preferences

The consumer can choose:

• Necessary cookies — always active;
• Functional cookies — optional;
• Analytics cookies — optional;
• Advertising cookies — optional.

Advertising cookies remain disabled unless selected.

The privacy information explains:

• what advertising data is collected;
• why it is processed;
• which advertising providers receive it;
• international transfers;
• retention periods; and
• relevant KVKK rights.

When a targeted advertisement is displayed, the consumer can select:

Why am I seeing this advertisement?

The interface explains:

“This advertisement was selected because you previously viewed men’s running products and your advertising preferences indicate an interest in sports products.”

The consumer can modify these criteria.

The advertisement itself is truthful and complies with pricing and consumer rules.

This is the type of architecture produced by combined KVKK and consumer-law compliance.

28. Example: A Legally High-Risk Campaign

Now consider the opposite scenario.

A cosmetic clinic installs advertising pixels.

A visitor reads:

“Hair-loss treatment for men.”

Without requesting permission, the website immediately transmits browsing information to several advertising networks.

The visitor is classified as:

“Male – likely experiencing hair loss – cosmetic procedure intent.”

For ten days, the consumer receives advertisements saying:

“Your hair loss will become permanent unless you act now — book surgery today.”

The campaign creates several legal questions simultaneously:

KVKK

Was tracking lawful?

Was valid consent required?

Was the consumer properly informed?

Was sensitive health information inferred?

Were data transfers abroad compliant?

Consumer Law

Were fear and vulnerability being exploited?

Was the advertising claim medically supportable?

Was the consumer told why the advertisement was being shown?

Could the targeting criteria be modified?

A single campaign may therefore generate enforcement risk under several different legislative regimes.

29. Consumer Profiling Should Be Included in the Company’s Data Inventory

Businesses should map targeted advertising as a specific data-processing operation.

The data inventory should identify:

• data subjects;
• source of data;
• cookies or tracking technologies;
• identifiers collected;
• profiling categories;
• processing purpose;
• legal basis;
• recipients;
• advertising platforms;
• international transfers;
• retention period;
• consent mechanism; and
• deletion procedure.

Where VERBİS registration obligations apply, the company’s data inventory and registry disclosures should also remain consistent with actual processing.

Maintaining a generic category such as:

“customer data — marketing”

may be insufficient for internally understanding a sophisticated behavioural advertising system.

30. Consumers Have KVKK Rights Against Profiling

A consumer may apply to the data controller and request information concerning processing.

Article 11 KVKK includes rights to:

• determine whether personal data is processed;
• request information about processing;
• learn the processing purpose;
• determine whether data is used consistently with that purpose;
• learn recipients in Turkey or abroad;
• request correction;
• request deletion or destruction where legal requirements exist;
• request notification of corrections or deletions to recipients;
• object to adverse results arising from exclusively automated analysis; and
• seek compensation where unlawful processing causes damage.

Targeted-advertising systems should therefore be built so that these rights can actually be exercised.

A company cannot effectively respond to a data-subject request if it does not know which advertising partners received the user’s information.

31. Consumers Can Also Complain to the Advertising Board

Targeted advertising may additionally be examined by the Advertising Board (Reklam Kurulu).

The Advertising Board has authority concerning advertisements and unfair commercial practices contrary to Law No. 6502.

It may order measures including:

• suspension of unlawful advertising;
• correction;
• administrative fines; and
• in appropriate circumstances, temporary suspension measures.

Consumers, institutions and competitors may file complaints, while the Board can also begin investigations ex officio.

For 2026, administrative fines applicable to misleading advertisements and unfair commercial practices can reach substantial amounts, depending on factors including the medium and seriousness of the violation. The Ministry has announced a 2026 range reaching up to TRY 39,916,524 for relevant advertising and unfair-commercial-practice violations.

A campaign may therefore simultaneously attract:

• a KVKK complaint;
• an Advertising Board investigation; and
• individual consumer claims.

32. The KVKK Board Can Impose Separate Sanctions

The Personal Data Protection Board independently supervises compliance with Law No. 6698.

Sanctions may arise from issues such as:

• unlawful personal data processing;
• failure to fulfil information obligations;
• inadequate data-security measures;
• non-compliance with Board decisions; or
• other statutory violations.

The Authority publishes annually updated administrative fine amounts under Article 18 KVKK.

Therefore, payment of an Advertising Board fine does not prevent a separate KVKK investigation concerning the same advertising campaign.

33. A Practical Compliance Test for Targeted Advertising

Before launching a targeted campaign in Turkey, a business should be able to answer the following questions.

Data Collection

What personal data are we collecting?

Identification

Can the data identify or single out a natural person?

Profiling

Are we making predictions or inferences about the consumer?

Legal Basis

Which KVKK Article 5 or Article 6 processing condition applies?

Cookies

Do marketing or tracking cookies activate before valid consent?

Information

Does the KVKK privacy information accurately describe the activity?

Advertising Transparency

Can consumers easily understand why they received the advertisement?

Preference Control

Can consumers change the criteria used for targeted advertising?

Children

Could the targeted audience include consumers known or reasonably expected to be children?

Sensitive Data

Are we targeting based on health, political, religious, biometric or other special-category characteristics?

Platforms

Which advertising companies receive the information?

International Transfer

Does information leave Turkey and, if so, which Article 9 transfer mechanism applies?

Electronic Messages

If SMS, email or calls are used, is the required commercial electronic communication permission available?

Advertising Content

Can every factual advertising claim be proven?

Consumer Vulnerability

Could the profiling exploit financial distress, health concerns, age or another vulnerability?

If the company cannot answer these questions before the campaign launches, the compliance process is incomplete.

34. The Most Important Rule: Consumer-Law Permission Is Not a KVKK Legal Basis

Article 25/A now expressly permits targeted advertising subject to consumer transparency requirements.

However, this should not be interpreted as:

“Targeted advertising is now permitted, therefore personal data can automatically be processed for it.”

That would confuse two separate legal regimes.

Article 25/A regulates how targeted advertising may be presented to consumers.

KVKK separately regulates whether and how the underlying personal data may be collected, analysed, profiled and transferred.

Accordingly:

Consumer-law compliance does not create a new KVKK processing condition.

If advertising cookies require valid consent in a particular scenario, Article 25/A does not eliminate that requirement.

35. The Reverse Is Also True: KVKK Consent Does Not Legalise Misleading Advertising

Imagine a consumer freely gives valid explicit consent to profiling.

The advertiser then targets that consumer with a false statement:

“This investment guarantees a 30% return.”

Valid KVKK consent does not legalise the advertisement.

The advertiser must still comply with:

• Law No. 6502;
• advertising regulations;
• sector-specific advertising restrictions; and
• rules prohibiting unfair commercial practices.

This produces the fundamental compliance formula:

Lawful Data + Unlawful Advertisement = Violation

and equally:

Unlawfully Collected Data + Truthful Advertisement = Violation

Only:

Lawful Data Processing + Lawful Advertising

creates a compliant targeted-advertising model.

Conclusion: Targeted Advertising in Turkey Is Now a Two-Law Compliance Exercise

Targeted advertising has moved beyond ordinary digital marketing.

It combines:

personal data processing + profiling + automated analysis + consumer influence.

For that reason, Turkish businesses should no longer examine targeted advertising solely through a privacy-policy perspective.

As of 1 August 2026, Article 25/A of the Commercial Advertising and Unfair Commercial Practices Regulation expressly requires transparency regarding why a targeted advertisement is being shown and how the relevant targeting criteria can be modified. Personal-data-based profiling for targeted advertising to children is expressly prohibited.

At the same time, KVKK continues to determine whether the underlying data collection and profiling are lawful.

The correct legal analysis therefore asks two separate questions:

1. Were we legally entitled to build this consumer profile?

and:

2. Are we legally entitled to use that profile in this particular way to influence the consumer?

For businesses using sophisticated digital marketing systems, the compliance process should consequently integrate:

KVKK compliance, cookie management, profiling rules, international data transfers, consumer advertising transparency, unfair-commercial-practice controls and commercial electronic communication rules.

The practical lesson is straightforward:

A consumer should be able to know not only that an advertisement is an advertisement, but increasingly also why that particular advertisement was shown to that particular consumer.

And the advertiser must be able to demonstrate that both the data behind the advertisement and the advertisement itself were lawful.