Introduction
The illegal use of personal images online in Turkey has become a serious legal problem in the digital age. A person’s photograph, video, profile image, private picture, intimate image, workplace photo, family photo, identity document image or social media content may be copied, edited, published, shared, sold, used in fake accounts, attached to defamatory posts, included in advertisements or used for fraud without consent. Once an image is uploaded online, it may spread rapidly across social media platforms, messaging applications, websites, forums, fake news pages and search engines.
Turkish law protects personal images through several legal mechanisms. A person’s image may be protected as part of private life, personal data, personality rights, honour and dignity, and sometimes intellectual property or commercial identity. The applicable legal remedy depends on the facts. A public social media photo used in a fake profile is legally different from an intimate image shared without consent. A professional headshot used in a fake investment advertisement is different from a private family photo published to humiliate the victim. A company using an employee’s image in advertisements after consent has ended is different from a hacker publishing private images stolen from a cloud account.
Under Turkish law, the illegal use of personal images may trigger Turkish Penal Code Article 134 on violation of privacy, Article 135 on unlawful recording of personal data, Article 136 on unlawful acquisition, dissemination or delivery of personal data, Law No. 6698 on the Protection of Personal Data, Law No. 5651 access-blocking procedures for privacy violations, civil compensation claims and injunctions. Article 134 punishes violation of private life and also punishes unlawful disclosure of images or sounds relating to private life; Articles 135 and 136 punish unlawful recording and unlawful acquisition or dissemination of personal data.
This article explains the illegal use of personal images online in Turkey from a practical legal perspective. It covers criminal liability, privacy violations, personal data protection, revenge porn, fake accounts, social media misuse, advertising without consent, digital evidence, content removal, civil compensation and defence strategies.
1. What Counts as a Personal Image?
A personal image may include any visual representation that identifies or makes a person identifiable. This can include a portrait photo, selfie, video, profile picture, security camera image, event photo, workplace photo, wedding photo, private family picture, passport photo, identity card image, screenshot from a video call, intimate image, medical image, biometric image or edited image.
Under the KVKK, personal data means any information relating to an identified or identifiable natural person. The official English translation of the KVKK defines personal data broadly and also treats processing as including collection, recording, storage, disclosure, transfer, making available and similar operations. Therefore, a photograph or video showing an identifiable person may qualify as personal data. If the image reveals sensitive details such as health, sexual life, biometric features, religion, political activity or other special categories, the legal risk may be even higher.
In practice, Turkish law does not protect only “secret” images. Even a publicly available photo may not be freely used for any purpose. For example, taking a lawyer’s professional photo from a website and using it in a fake advertisement, fake social media account or scam page may violate personal data rights, personality rights and possibly criminal law. Consent to publish an image in one context does not mean consent to copy, edit, commercialize or republish it in another context.
2. Common Forms of Illegal Image Use Online
Illegal use of personal images appears in many forms. The most common examples include:
A fake social media account using the victim’s photograph.
A former partner publishing intimate images after separation.
A private photo being shared in WhatsApp or Telegram groups.
A person’s face being used in a fake investment or crypto advertisement.
An employee’s image being used by an employer after the employment relationship ends.
A child’s photo being shared without parental authorization.
A person’s identity card image being published online.
A private video call screenshot being used for blackmail.
A photo being edited with humiliating captions or sexual content.
A business using customer photos in marketing without valid consent.
A news page publishing images beyond public-interest limits.
An influencer or public figure’s image being used to sell products without authorization.
Each case requires separate analysis. The legal route will depend on whether the image relates to private life, whether the person is identifiable, whether consent existed, whether the image was used commercially, whether it was published publicly, whether it was obtained by hacking, and whether it caused financial or moral harm.
3. Violation of Privacy Under Turkish Penal Code Article 134
Article 134 of the Turkish Penal Code is one of the most important provisions in cases involving private images. It punishes violation of the privacy of another person’s personal life. If the violation occurs through recording images or sound, the penalty is increased. Article 134 also punishes unlawful disclosure of images or sounds relating to private life.
This provision is especially relevant where the image belongs to the victim’s private sphere. Examples include intimate images, private home images, hidden camera footage, private video call screenshots, private family images, medical images, private messages containing images and photographs taken in confidential environments.
The central question is whether the image relates to private life. A person photographed in a public event may have a different legal position from a person secretly recorded at home. However, context matters. A photograph taken in public may still violate personal rights if it is used in a defamatory, humiliating, misleading or sexually suggestive way.
A key principle is that consent is limited by purpose and context. A person may consent to a private photo being taken, but not to its public disclosure. A person may share an image with one person, but not authorize that person to send it to others. A person may allow a professional photo to be used on a company website, but not on fake accounts or unrelated advertisements.
4. Personal Data Crimes: Articles 135 and 136
Personal images may also be protected under Turkish Penal Code provisions on personal data. Article 135 punishes unlawful recording of personal data. Article 136 punishes unlawfully obtaining, disseminating or giving personal data to another person. The official English text of the Turkish Penal Code states that unlawful acquisition, dissemination or giving of personal data is punishable by imprisonment.
This is highly relevant for online image misuse. If someone downloads, stores, republishes or sends another person’s image without legal basis, Article 136 may be considered depending on the facts. If a person collects images from social media and creates a database of women, children, employees, customers or public officials, Article 135 may also become relevant.
Examples may include:
Copying a person’s profile photo and sending it to third parties.
Publishing a victim’s identity card image online.
Using a person’s photograph in a fake account.
Sharing private photos in a messaging group.
Obtaining images from a hacked cloud account.
Publishing a customer’s image without legal basis.
Using a person’s face in scam advertisements.
If the image is intimate or connected to private life, both Article 134 and Article 136 may need to be evaluated. If the image was obtained through account hacking, Articles 243 and 244 on cybercrimes may also become relevant.
5. KVKK Protection for Personal Images
The KVKK protects personal data and sets obligations for natural and legal persons processing personal data. Its purpose is to protect fundamental rights and freedoms, particularly the right to privacy, with respect to personal data processing. Since identifiable images may constitute personal data, their collection, storage, publication, transfer and use must comply with KVKK principles and processing conditions.
The KVKK requires personal data processing to be lawful, fair, accurate where necessary, processed for specified and legitimate purposes, limited and proportionate, and retained only for the necessary period. It also provides that personal data shall not be processed without explicit consent unless one of the legal processing conditions applies.
For example, a company may need consent to use a customer’s image in an advertisement. An employer may need a valid legal basis to publish employee photos on a website or social media page. A school must be careful when using children’s images in promotional content. A clinic must be especially cautious when publishing before-and-after photos because such images may reveal health-related information, which can constitute special category personal data.
KVKK compliance is not only about obtaining a signature. Consent must be specific, informed and freely given. A broad clause hidden inside a long form may not always be sufficient for sensitive or commercial image use. The data controller should explain where the image will be used, for what purpose, for how long, and whether it will be shared with third parties or published online.
6. Rights of the Data Subject
A person whose image is processed may have several rights under KVKK Article 11. These include the right to learn whether personal data is processed, request information about processing, learn the purpose of processing, know third parties to whom data is transferred, request correction, request erasure or destruction under legal conditions, object to certain automated results and claim compensation for damage arising from unlawful processing.
These rights are important in image misuse cases. A victim may apply to the data controller and request removal of images, deletion of unlawfully processed photographs, information on where the images were shared, correction of misleading image use and compensation for damage. If the data controller refuses, gives an insufficient response or fails to respond within the legal period, a complaint to the Personal Data Protection Board may become possible after exhausting the required application route.
However, KVKK remedies do not replace criminal complaints. If the image was used for blackmail, revenge porn, fake accounts, fraud or privacy violation, criminal law should also be considered.
7. Image Use in Advertising and Commercial Content
Commercial use of personal images is a frequent source of legal disputes. A person’s photo may be used in an advertisement, banner, website, social media post, catalogue, promotional video, testimonial, training material, real estate listing, clinic “before-after” gallery, influencer campaign or fake investment ad.
Commercial image use usually requires clear authorization. Even where a photo was taken with consent, the scope of that consent must be examined. Consent to attend an event does not automatically mean consent to use the person’s face in paid advertisements. Consent to be photographed for an internal company event does not necessarily allow indefinite publication on social media. Consent to use an employee’s image during employment may not continue after the employee leaves unless the agreement clearly provides a lawful basis.
Illegal commercial image use may lead to removal requests, KVKK complaints, civil compensation and sometimes criminal liability if the image was obtained or published unlawfully. If the image is used in a fraudulent advertisement, such as a fake crypto investment platform or fake legal service advertisement, criminal fraud and personal data offences may also be relevant.
8. Fake Accounts and Impersonation
Fake social media accounts are among the most common forms of illegal image use. A perpetrator may use the victim’s photo, name, profession, workplace, school or family information to create an account. The account may then send messages, request money, publish sexual content, insult others, damage reputation or deceive third parties.
The legal classification depends on how the account is used. If the image and identity information are used without consent, personal data offences and personality rights may be relevant. If the account publishes private images, Article 134 may apply. If the fake account requests money from others, fraud may arise. If the account was created after hacking the victim’s real account, cybercrime provisions may also be considered.
Victims should preserve the fake account URL, username, profile screenshots, posts, messages, follower interactions and any evidence showing that third parties were deceived. Merely taking a screenshot of the profile picture may not be enough; the exact URL and account identifiers are important for investigation and platform removal.
9. Intimate Images, Revenge Porn and Sextortion
The illegal online use of intimate images is one of the most serious violations. It may occur after a relationship ends, during blackmail, through hacked accounts, hidden recordings or fake profiles. The victim may be threatened with publication unless they pay money, send more images, continue a relationship, withdraw a complaint or remain silent.
These cases may involve multiple offences:
Violation of privacy under Article 134.
Unlawful dissemination of personal data under Article 136.
Blackmail under Article 107.
Threat under Article 106.
Unauthorized access under Article 243 if accounts were hacked.
System interference or data transfer under Article 244 if data was copied or moved.
The fact that the victim voluntarily shared an intimate image with one person does not authorize that person to distribute it. Consent is not unlimited. Publication or threat of publication can create serious criminal and civil consequences.
Victims should preserve all messages, usernames, phone numbers, IBANs, crypto wallet addresses, URLs and screenshots before seeking removal. They should also avoid sending more content or paying without legal advice, because payment often leads to further demands.
10. Children’s Images Online
Images of children require special caution. Children’s photographs may be used by schools, sports clubs, influencers, parents, relatives, media pages or platforms. Even where parents share images, legal and ethical risks exist if the image exposes the child’s privacy, school, location, health condition, family situation or vulnerability.
If a child’s image is used for harassment, sexual exploitation, fake accounts, bullying or commercial content without proper authorization, the legal consequences may be serious. Depending on the facts, child protection rules, privacy offences, personal data crimes, sexual offences, obscenity provisions and content removal mechanisms may be relevant.
Organizations working with children should obtain clear permissions, minimize image use, avoid unnecessary identification, restrict public sharing and act immediately if a child’s image is misused online.
11. Law No. 5651 and Urgent Access Blocking
If personal images are published online in a way that violates private life, Law No. 5651 Article 9/A may provide an urgent access-blocking route. Article 9/A allows persons claiming that their privacy is violated due to internet content to apply directly to the Authority and request blocking of access to the content. The request must include the full URL, an explanation of how the right is violated and information proving identity; missing information may prevent processing.
Article 9/A is especially relevant for intimate images, private videos, hidden camera footage, private family photos, private medical images, identity document images and other content that directly violates private life. The mechanism is designed to be fast. The translated text states that access providers must fulfill the request within four hours at the latest, and the applicant must submit the request to the criminal judgeship of peace within twenty-four hours; the judge must decide within forty-eight hours, otherwise the measure becomes void automatically.
This procedure should be used carefully. The applicant should identify exact URLs, image links, video links and platform pages. Evidence should be preserved before removal or blocking is requested.
12. Article 9 Annulment and Personality Rights Cases
For years, Law No. 5651 Article 9 was widely used for online personality-right violations. However, the Constitutional Court annulled Article 9. The Constitutional Court’s press release states that the relevant annulment decision concerning Law No. 5651 would be effective after nine months from its publication in the Official Gazette. Legal commentary also explains that Article 9, which allowed persons claiming violation of personal rights to seek removal or access blocking, was annulled because it lacked sufficient safeguards and created disproportionate restrictions on freedom of expression and the press.
This matters for personal image cases. If the issue is a privacy violation, Article 9/A may still be relevant. If the issue is broader personality rights, reputation, honour or misleading commercial use without a direct private-life violation, the legal route may require civil-law remedies, criminal complaint, KVKK application, platform takedown requests or interim injunctions rather than relying on the former Article 9 mechanism.
Therefore, the correct legal route must be selected carefully. A private intimate image case is different from a public professional photo used in a misleading advertisement. Both may be unlawful, but the procedural route may differ.
13. Digital Evidence in Online Image Misuse Cases
Evidence is decisive. Online images can be deleted quickly, accounts can change usernames, websites can disappear and messages can be removed. Victims should preserve evidence before contacting the perpetrator or platform.
Important evidence includes:
The full URL of the image, video, profile or post.
Screenshots showing the date, time, platform and username.
The account profile page.
Comments, captions and hashtags.
Messages containing threats or demands.
E-mail headers if the image was sent by e-mail.
Phone numbers, IBANs or wallet addresses if blackmail is involved.
Witness statements from persons who saw the content.
Platform complaint records.
Evidence showing original ownership or context of the image.
Notarial determination where appropriate.
Screenshots should not be overly cropped. A strong screenshot shows the platform, account name, URL if possible, date and surrounding context. If the image is part of a fake account or advertisement, the entire page should be preserved, not only the image.
14. Criminal Complaint Strategy
A criminal complaint should be detailed and legally structured. It should not simply say, “My photo was used without permission.” It should explain what image was used, where it was published, who published it if known, whether the image relates to private life, whether it was obtained unlawfully, whether the victim is identifiable, whether the content caused harm, and what evidence exists.
A strong complaint should include:
Victim identity information.
Description of the image or video.
Where and when the image was published.
The URL, username and platform.
Whether the image is private, intimate, professional or public.
Whether consent existed.
Whether consent was limited or withdrawn.
Whether the image was edited or used misleadingly.
Whether blackmail, threat or fraud occurred.
Whether a fake account was created.
Whether personal data or identity documents were included.
Requests for platform, IP and account records.
Legal qualification under Articles 134, 135, 136 and other relevant provisions.
Request for urgent content removal or access blocking where applicable.
If the suspect is known, the complaint should explain the relationship between the parties, access opportunity and motive. If the suspect is unknown, the complaint should focus on platform and technical records.
15. Civil Compensation Claims
Illegal use of personal images may cause both material and moral damages. Material damages may include commercial loss, loss of professional opportunities, cost of reputation management, legal expenses, cybersecurity costs and financial losses caused by fraud. Moral damages may arise from humiliation, anxiety, reputational harm, violation of privacy, exposure of intimate content, family pressure and psychological distress.
A civil compensation claim may be directed against the person who published the image, the person who used it commercially, the person who created a fake account, a company that unlawfully used the image in advertising, or another responsible party depending on the facts.
The KVKK also preserves the right to claim compensation for damage arising from unlawful processing of personal data. Article 11 includes the right to claim compensation for damage caused by unlawful processing. In addition, civil-law personality rights remedies may be used to request cessation of unlawful use, prevention of future use, removal of effects and compensation.
16. Employer Use of Employee Images
Employers often use employee images on websites, social media pages, ID cards, internal platforms, event posts and marketing materials. This can be lawful if based on a valid legal ground, clear information and proper scope. However, problems arise when employee images are used beyond the original purpose, used in advertising without clear consent, kept online after employment ends, or shared in a way that harms dignity or privacy.
Employers should define:
Which images will be used.
Where they will be published.
For what purpose.
For how long.
Whether the employee may withdraw consent.
Whether images will be used after employment ends.
Whether the images will be shared with agencies or third parties.
Because employment relationships involve imbalance of power, consent should be handled carefully. The employer should avoid forcing broad image-use consent where it is not necessary.
17. Clinics, Before-and-After Photos and Health Data
Clinics, doctors, dentists, aesthetic centers and hospitals often use before-and-after images. These images may reveal health data, biometric details, facial identity and medical treatment information. Health data is special category personal data under the KVKK. The official KVKK text identifies data concerning health, sexual life, biometric and genetic data among special categories of personal data.
Therefore, before-and-after images require strict legal care. Consent must be specific, informed and limited. The patient should know where the image will be published, whether the face will be visible, whether the image will be used in advertisements, whether it will be shared on social media, and whether it may be withdrawn. Anonymization or masking may be necessary, but it must be effective; a partially blurred image may still identify the person.
Unlawful use of medical images may create KVKK liability, civil compensation and criminal issues if privacy is violated.
18. Defence Strategies in Image Misuse Allegations
A person accused of illegal image use may raise several defences depending on the facts. Not every use of an image is automatically criminal. The legal analysis must consider consent, public interest, context, identifiability, purpose, privacy level and evidence authenticity.
Possible defence arguments include:
The image was used with valid consent.
The image was not identifiable.
The image was already lawfully public and used within its public context.
The accused did not upload or control the account.
The account was fake or hacked.
The screenshot is manipulated or incomplete.
The image does not relate to private life.
There was a legitimate journalistic or public-interest purpose.
The use was necessary for legal claims or defence rights.
The matter is civil or data protection-related, not criminal.
The complaint period or procedural requirements were not met where applicable.
However, “the image was already online” is not always a complete defence. Public availability does not create unlimited permission to republish, commercialize, sexualize, humiliate or impersonate the person.
19. Practical Checklist for Victims
A victim of illegal image use online in Turkey should:
Preserve the URL and screenshots.
Save the full profile or page, not only the image.
Record the username, account ID, phone number or e-mail.
Preserve messages containing threats or demands.
Do not delete original conversations.
Identify witnesses who saw the content.
Request urgent platform removal where necessary.
Consider Law No. 5651 Article 9/A if private life is violated.
File a criminal complaint if privacy, personal data, blackmail or fraud is involved.
Apply to the data controller under KVKK where relevant.
Document psychological, reputational and financial harm.
Change passwords if the image may have been obtained through account hacking.
Monitor fake accounts and repeated reposts.
Fast action is critical because personal images can spread quickly.
20. Practical Checklist for Companies
Companies using personal images should:
Obtain clear and specific consent where required.
Inform persons about purpose, platform and duration.
Avoid broad and indefinite image-use clauses.
Keep records of consent.
Remove images when the legal basis ends.
Avoid using employee images after employment ends unless lawful.
Use children’s images only with special care and proper authorization.
Treat medical, biometric and intimate images as high-risk.
Implement image removal procedures.
Respond to data subject requests within legal timelines.
Avoid misleading commercial use.
Train marketing teams on KVKK and personality rights.
Maintain contracts with photographers, agencies and influencers.
Companies should treat image rights as a compliance issue, not merely a marketing matter.
Conclusion
The illegal use of personal images online in Turkey may create criminal, civil, data protection and internet-law consequences. Article 134 of the Turkish Penal Code protects private life and punishes unlawful disclosure of images or sounds relating to private life. Articles 135 and 136 protect personal data against unlawful recording, acquisition, dissemination and delivery. The KVKK treats identifiable images as personal data when they relate to an identified or identifiable person and grants data subjects important rights, including information, deletion under legal conditions and compensation for unlawful processing.
For urgent online privacy violations, Law No. 5651 Article 9/A may provide a fast access-blocking route, especially for intimate images, private videos, private family images, identity document images and other private-life content. However, because Article 9 on general personality-right-based access blocking has been annulled, the correct legal route must be selected carefully for non-private image misuse cases.
For victims, the strongest response is evidence preservation, quick legal classification, criminal complaint where appropriate, KVKK applications where a data controller is involved, and civil compensation claims where damage occurred. For companies, lawful image use requires specific purpose, valid legal basis, transparency, limited retention and careful consent management. For suspects and defendants, the key issues are consent, context, identifiability, privacy level, authenticity of evidence and whether criminal elements are truly present.
In Turkey’s digital environment, a personal image is not a freely usable object merely because it appears online. It is connected to privacy, dignity, personal data and personality rights. Effective legal protection depends on speed, evidence and a strategy combining criminal law, data protection law, internet law and civil remedies.
Yanıt yok