Introduction
Commercial electronic messages are one of the most common marketing tools used by businesses in Turkey. Companies send SMS messages, e-mails, automated calls, campaign notifications, discount announcements, promotional codes, product offers, event invitations, loyalty program messages and customer retention communications to reach consumers quickly and directly. These tools are commercially powerful because they enter the consumer’s personal communication space. For this reason, they are strictly regulated under Turkish law.
The subject of commercial electronic messages in Turkey is important for e-commerce companies, retailers, service providers, banks, insurance companies, clinics, educational institutions, hotels, restaurants, real estate businesses, mobile applications, marketplaces, call centers, marketing agencies and foreign brands targeting Turkish consumers. A business cannot freely send marketing SMS, e-mail or promotional calls to consumers simply because it has obtained a phone number or e-mail address. In most cases, prior consent, proper registration, clear identification, lawful content and an easy opt-out mechanism are required.
The main legal framework is based on Law No. 6563 on the Regulation of Electronic Commerce, the Regulation on Commercial Communication and Commercial Electronic Messages, the Message Management System, known in Turkish as İleti Yönetim Sistemi or İYS, and the Personal Data Protection Law No. 6698, commonly known as the KVKK. These rules should be assessed together because sending a commercial electronic message usually involves both marketing regulation and personal data processing.
The Turkish Ministry of Trade defines commercial electronic messages as data, audio or visual messages sent electronically for commercial purposes through tools such as telephone, call centers, fax, automatic calling machines, smart voice recorder systems, e-mail and SMS. The Ministry also states that complaints about unwanted commercial electronic messages are examined by the Ministry and that administrative fines may be imposed on real or legal persons found to have sent unlawful commercial electronic messages.
This article explains the legal rules on SMS marketing, e-mail marketing, commercial calls, marketing consent, İYS registration, opt-out rights, personal data protection, customer relationship messages, exceptions, complaint mechanisms, administrative sanctions and practical compliance steps for businesses operating in Turkey.
What Is a Commercial Electronic Message?
A commercial electronic message is any electronic message sent for commercial purposes. It may promote goods, services, brands, campaigns, discounts, loyalty programs, events, subscriptions, applications, websites, financial products, healthcare services, educational programs, travel opportunities or other commercial activities.
Commercial electronic messages may be sent through many channels. The most common examples are SMS, e-mail, phone calls, call center communications, automatic voice calls, smart voice recording systems, fax messages, push-like direct communication channels and similar electronic communication tools. The Turkish Ministry of Trade’s electronic commerce FAQ expressly includes telephone, call centers, fax, automatic calling machines, smart voice recorder systems, e-mail and SMS within the definition when the message is sent electronically for commercial purposes.
The legal classification does not depend only on the channel. It depends on the purpose and content of the message. If the message is sent to promote a product, service, business, campaign or commercial activity, it will generally be considered a commercial electronic message. For example, “20% discount this weekend,” “new product launch,” “special offer for members,” “renew your subscription now,” “exclusive campaign,” or “click to buy” are typical commercial messages.
However, not every electronic communication sent by a business is necessarily a commercial electronic message. Operational messages such as order confirmations, delivery updates, invoice notifications, password reset messages, appointment reminders or legally required notices may have a different legal character if they are genuinely necessary for the transaction and do not contain promotional content. The distinction between operational communication and marketing communication is extremely important for compliance.
Main Legal Framework
Commercial electronic messages in Turkey are primarily regulated by Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages. These rules determine when consent is required, what information must be included in the message, how the recipient may exercise the right to refuse future messages and how complaints may be filed.
The Message Management System, or İYS, is a central mechanism created to manage commercial electronic message consents and opt-out processes. The Ministry of Trade states that İYS allows citizens to see, control and revoke all commercial electronic message approvals from a single point, while also giving service providers legal certainty regarding their burden of proof in consent management.
The KVKK is also essential. Phone numbers, e-mail addresses and other contact information are personal data when they relate to an identifiable natural person. The Turkish Personal Data Protection Board has emphasized that although commercial electronic messages are subject to separate legislation, storing phone numbers or e-mail addresses in a data recording system and using them to send commercial messages is also a personal data processing activity. Therefore, commercial electronic message processes must comply with both electronic commerce legislation and personal data protection legislation.
This dual structure is important. A company may violate commercial electronic message rules by sending an SMS without İYS approval or proper opt-out information. It may also violate KVKK if it processes the recipient’s phone number or e-mail address without a lawful basis, without proper information notice or without valid explicit consent where required.
SMS Marketing Rules in Turkey
SMS marketing is one of the most frequently used commercial electronic message channels in Turkey. Businesses use SMS to announce campaigns, discounts, appointment promotions, product launches, seasonal offers, loyalty programs and special events. Because SMS is direct and intrusive, compliance rules are strict.
A marketing SMS generally requires prior consent from the recipient unless a specific legal exception applies. Consent must be obtained before the message is sent. A business should not send a marketing SMS first and then ask whether the recipient wants to receive future messages. The consent should be recorded, verifiable and compatible with İYS requirements.
The content of the SMS must also comply with mandatory information rules. The Ministry of Trade states that commercial electronic messages must include identifying information. In short message formats with limited space, merchants must include their MERSİS number, while tradesmen must include name, surname and Turkish identity number. The message must also include at least one accessible contact detail depending on the communication channel, such as telephone, fax, short message number or e-mail address.
The recipient must also be given an easy and free opt-out mechanism. The Ministry of Trade explains that the refusal mechanism must be provided through the same communication channel as the message, easily and free of charge, and that the opt-out right must be included in every commercial electronic message. For example, an opt-out mechanism for an SMS message should also be provided through SMS.
A compliant SMS marketing message should therefore include the sender’s identity, the commercial nature of the message where necessary, clear campaign conditions, contact information and a simple opt-out method. The message should not be misleading, should not hide material terms and should not be sent to persons whose consent is absent, revoked or not recorded in İYS.
E-Mail Marketing Rules in Turkey
E-mail marketing is widely used for newsletters, promotions, abandoned cart reminders, customer loyalty campaigns, digital product offers, software subscriptions, event invitations and B2C communications. Like SMS marketing, e-mail marketing generally requires prior consent unless a legal exception applies.
A marketing e-mail should clearly identify the sender. It should not use misleading subject lines, false sender names or disguised promotional purposes. The Ministry of Trade states that if the nature of the message is not clearly understood from its content, a phrase such as promotion, campaign or information must be included; for e-mails, this identifying phrase should appear in the subject section.
E-mail marketing must also include an opt-out mechanism. The recipient should be able to unsubscribe easily and free of charge. A business should not require the recipient to log into an account, call customer service, send a physical petition or complete a complicated process merely to stop receiving e-mails. The refusal mechanism should be simple, functional and effective.
Businesses should also distinguish between marketing e-mails and transactional e-mails. An order confirmation or invoice e-mail may be necessary for the performance of a contract. However, if the same e-mail includes promotional banners, discount codes, cross-selling content or future campaign invitations, it may become partly commercial. Businesses should avoid mixing operational messages with marketing content unless the legal basis for marketing communication is clear.
Commercial Calls and Voice Messages
Commercial electronic message rules are not limited to written messages. Marketing calls, call center communications, automatic calling machines and smart voice recording systems may also fall within the definition of commercial electronic messages. The Ministry of Trade expressly includes telephone, call center, automatic calling machines and smart voice recorder systems in the definition of commercial electronic messages when used for commercial purposes.
A promotional phone call to sell insurance, banking services, real estate, education programs, health services, subscriptions or other commercial offerings may therefore require prior marketing consent. The caller should identify the service provider, explain the commercial purpose and respect opt-out preferences.
Voice-based marketing creates particular risks because consumers may feel pressure during live calls. Call centers should not use misleading scripts, aggressive sales methods or unclear consent language. If the consumer says they do not want further calls, the business should record and respect that refusal.
Where calls are recorded, additional personal data protection considerations arise. The business should inform the recipient about call recording where required and should process recordings only for lawful and proportionate purposes.
Consent Requirement
Consent is the central concept in Turkish commercial electronic message law. As a general rule, service providers must obtain the recipient’s prior approval before sending commercial electronic messages. The İYS official FAQ states that approval means the service provider obtaining the recipient’s consent before sending commercial electronic messages and that obtaining such consent is legally required. It also states that consent may be obtained physically with signature, electronically or through İYS.
Consent must be specific, informed and provable. A vague statement such as “I accept all communications” may not be sufficient if it does not clearly indicate that the recipient agrees to receive commercial electronic messages. The recipient should understand which communication channels are covered, such as SMS, e-mail or calls, and for what purpose the messages will be sent.
From a KVKK perspective, explicit consent must also be valid where personal data is processed based on consent. The Personal Data Protection Board has repeatedly emphasized that explicit consent must be related to a specific subject, based on information and given freely. In a 2023 decision concerning SMS verification codes in stores, the Board referred to the legal definition of explicit consent as consent relating to a specific subject, based on information and expressed by free will.
Consent should not be forced. A business should not make marketing consent a condition for receiving a product or service unless there is a lawful and necessary basis. Consent boxes should not be pre-ticked. Consumers should not be misled into believing that marketing consent is mandatory for completing a purchase.
İYS Registration and Consent Management
The Message Management System, or İYS, is a key compliance mechanism for commercial electronic messages in Turkey. İYS was created as a central database where service providers register and manage commercial electronic message approvals. The Ministry of Trade states that İYS enables citizens to see, control and revoke all message approvals from one point, and it provides service providers with legal certainty regarding proof of consent.
İYS is important for both consumers and businesses. For consumers, it offers a centralized way to control which businesses may send commercial messages. For businesses, it creates an organized consent management infrastructure and helps prove whether consent existed at the time of communication.
The İYS official information states that it is a national platform where commercial electronic message permissions and complaint processes can be managed under Law No. 6563 and related legislation. It was established by İleti Yönetim Sistemi A.Ş., a company created by the Union of Chambers and Commodity Exchanges of Turkey under the authorization framework of the Ministry of Trade.
A business should not treat İYS as a formality. If its marketing database contains phone numbers or e-mail addresses not properly recorded, updated or synchronized with İYS, it may face legal risk. The İYS FAQ states that commercial electronic messages cannot be sent to recipients whose approval is not found in İYS.
Opt-Out and Right of Refusal
The recipient’s right to refuse future commercial electronic messages is a fundamental consumer protection rule. Consent is not permanent in an absolute sense. A recipient who previously consented may later withdraw consent and stop future marketing communications.
The opt-out mechanism must be easy, accessible and free. The Ministry of Trade explains that the right of refusal must be provided through the same communication channel as the commercial electronic message and must be included in every commercial electronic message.
In practice, SMS messages should include a clear opt-out instruction such as a short code or link. E-mails should include an unsubscribe link or equivalent mechanism. Calls should allow the recipient to state that they do not want to receive future calls. The opt-out request should be processed promptly and reflected in internal systems and İYS records.
A business should not continue sending promotional messages after the recipient withdraws consent. It should also ensure that opt-out preferences are shared with marketing agencies, call centers, CRM systems, e-mail service providers and other third-party processors involved in message delivery.
Opt-out compliance is not only a legal obligation but also a trust issue. Consumers often react strongly to businesses that continue sending messages after unsubscribe requests. Such conduct may lead to complaints, administrative investigations and reputational harm.
Mandatory Content of Commercial Electronic Messages
Commercial electronic messages must include certain mandatory elements. The Ministry of Trade’s guidance provides a practical summary of these elements.
First, the message must include identifying information. For merchants, this includes MERSİS number and trade name. For tradesmen, it includes name, surname and Turkish identity number. In limited-space SMS messages, merchants must include MERSİS number, while tradesmen must include name, surname and Turkish identity number.
Second, the message must include at least one accessible contact detail depending on the communication tool, such as telephone, fax, short message number or e-mail address.
Third, where the nature of the message is not clear from the content, an identifying phrase such as promotion, campaign or information must be included. In SMS messages, it should appear at the beginning; in e-mails, in the subject line; and in voice calls, at the beginning of the conversation.
Fourth, if the message contains discounts, gifts, promotional contests or games, this must be clearly stated, and the relevant conditions must be provided through easily accessible methods such as a URL or customer service number.
Fifth, every commercial electronic message must include the opt-out mechanism.
These rules prevent businesses from sending anonymous, confusing or manipulative marketing messages. They also allow consumers to identify the sender and exercise their rights.
KVKK and Commercial Electronic Messages
Commercial electronic message compliance cannot be separated from KVKK compliance. Phone numbers and e-mail addresses are personal data when they identify or make identifiable a natural person. Collecting, storing, using, transferring or deleting such data for marketing purposes is personal data processing.
The Personal Data Protection Board has expressly stated that although commercial electronic messages are subject to separate legislation, using phone numbers and e-mail addresses to send commercial messages through a data recording system is also a personal data processing activity. Therefore, commercial electronic message processes must comply with both the specific legislation on commercial electronic messages and personal data protection legislation.
This means that a business must determine the legal basis for processing contact data. It must provide a privacy notice, obtain explicit consent where required, process data for specific and lawful purposes, avoid excessive retention, ensure data security and respect data subject rights.
In a 2022 decision, the Personal Data Protection Board examined a complaint where a person received a marketing SMS without a commercial relationship or consent, and without privacy notice or explicit consent. The decision summary shows that the Board treated the sending of a marketing SMS as a personal data processing issue under KVKK.
Businesses should therefore avoid using contact details collected for one purpose, such as invoicing, delivery or membership creation, for another purpose, such as marketing, unless the legal basis and consent requirements are satisfied.
Consent Must Be Separate and Freely Given
A recurring compliance problem is bundling marketing consent with other actions. Businesses may ask customers to enter an SMS verification code at checkout, in a store or during membership registration, and the same action may be used to approve a contract, confirm identity, accept personal data processing and grant marketing consent. This is legally risky.
The Personal Data Protection Board’s 2025 principle decision on SMS verification codes expressly states that practices where different processing activities such as membership contract approval, personal data processing permission and commercial electronic message consent are completed through a single action must be ended. The Board also emphasized that separate choices must be offered and separate explicit consents must be obtained where consent is required.
The same principle decision states that consent for processing personal data for commercial electronic message purposes should not be presented as a mandatory element for completing the provision of goods or services, and that data controllers must take necessary technical and administrative measures to ensure this.
In a 2023 decision, the Board also found that obtaining consent for processing personal data for advertising SMS during shopping may create the impression that such consent is part of the shopping process, which could harm the free-will element of explicit consent. The Board instructed the data controller to revise the practice so that consumers are properly informed and so that it does not appear to be part of the purchase process; it also stated that privacy notice and explicit consent approval code should not be presented in the same SMS.
These decisions are highly important for retail stores, e-commerce websites, loyalty programs, mobile apps and call centers. Marketing consent must be separated from contract approval, payment, delivery, identity verification and mandatory service steps.
Customer Relationship Messages and Exceptions
Not every message sent by a business is marketing. Some messages are necessary for the customer relationship. For example, order confirmation, delivery tracking, invoice notification, password reset, appointment reminders, account security alerts and warranty service updates may be operational messages.
However, the content must remain operational. If an order confirmation message also includes “special discount for your next purchase,” it may become commercial. If an appointment reminder includes a new campaign offer, it may require marketing consent. If a password reset e-mail includes product advertising, the message may be treated differently from a pure security communication.
The safest approach is to separate operational and marketing communications. Transactional messages should contain only necessary information. Marketing content should be sent only to recipients with valid commercial electronic message consent and İYS approval.
Certain categories may be outside the scope of commercial electronic message complaint rules. The Ministry of Trade lists examples of excluded messages, including some messages by electronic communications operators to their subscribers, messages by foundation universities to students and parents, certain messages by professional organizations and public-benefit entities, public information messages by public authorities, and unlawful categories such as gambling, sexual chat and fraud messages.
Businesses should not rely on exceptions broadly. Each message should be assessed based on sender, recipient, purpose, content and applicable legislation.
Marketing Agencies and Third-Party Service Providers
Many businesses outsource SMS, e-mail and call campaigns to marketing agencies, CRM providers, bulk SMS companies, call centers, e-mail service providers and data analytics companies. Outsourcing does not eliminate legal responsibility.
The business that determines the purpose and means of sending commercial electronic messages will often remain responsible for ensuring that recipients have valid consent, İYS approval exists, opt-outs are respected and personal data is processed lawfully. Agencies and service providers should also comply with contractual obligations and data protection standards.
Contracts with marketing agencies should include clauses on consent verification, İYS compliance, opt-out synchronization, data security, confidentiality, permitted use of contact lists, prohibition of unauthorized data enrichment, audit rights, deletion obligations and liability for unlawful sending.
A business should not buy or rent marketing contact lists unless it can lawfully verify the source, consent status, İYS compatibility and KVKK compliance. Using scraped e-mails, publicly visible business addresses or third-party lists for marketing can create serious risk.
The Personal Data Protection Board has examined situations where work e-mails obtained from internet searches were used for commercial electronic messages without explicit consent. The existence of an e-mail address online does not automatically authorize marketing use.
B2B Commercial Electronic Messages
Businesses often assume that B2B marketing is completely free. This assumption is risky. Commercial electronic message rules may also apply where messages are sent to real persons in a professional context, especially if the contact information relates to an identifiable individual.
For example, sending marketing e-mails to a named employee’s work e-mail address may involve personal data processing. The fact that the address is used for business purposes does not remove KVKK protection. If the message is sent for commercial marketing purposes, the sender should evaluate commercial electronic message rules and personal data protection requirements.
Corporate communications to generic addresses such as info@company.com may raise different issues, but businesses should still be cautious, especially where the address is linked to a natural person or where opt-out requests have been made.
A compliant B2B strategy should avoid scraping professional contact details, using purchased lists without verification, ignoring unsubscribe requests or sending repeated unsolicited messages. Even where a narrow exception may be argued, the sender should ensure that data processing, message content and opt-out mechanisms are lawful.
E-Commerce, Membership and Loyalty Programs
E-commerce businesses frequently collect phone numbers and e-mail addresses during account creation, checkout, delivery and customer support. These contact details may be necessary for the transaction, but that does not mean they can automatically be used for marketing.
A customer who provides a phone number for delivery tracking has not necessarily consented to promotional SMS. A customer who provides an e-mail address for invoice delivery has not necessarily consented to newsletters. A person who joins a loyalty program should be clearly informed whether membership includes marketing communications, and consent should be obtained separately where required.
Loyalty programs are especially sensitive because businesses may combine purchase history, preferences, demographics and contact data to send personalized campaigns. This may involve targeted advertising and personal data profiling. A business should ensure that privacy notices, explicit consent mechanisms, İYS records and opt-out processes are aligned.
Push Notifications and Mobile Applications
Mobile applications often send push notifications. Some push notifications are operational, such as security alerts, delivery updates or account notifications. Others are commercial, such as discount alerts, campaign announcements, product recommendations, abandoned cart reminders or promotional messages.
If a push notification functions as a commercial electronic message, businesses should assess whether commercial electronic message consent and İYS requirements apply. Even where the technical channel is different from SMS or e-mail, the legal question remains whether the message is an electronic communication sent for commercial purposes.
Mobile apps should not use default notification settings to send promotional messages without clear consent. Users should be able to manage notification preferences easily. If push notifications are personalized based on user behavior, additional KVKK and targeted advertising issues may arise.
Complaint Mechanism
Recipients of unwanted commercial electronic messages may file complaints. The Ministry of Trade states that complaints may be submitted through the Commercial Electronic Message Complaint System, integrated with e-Devlet, or in writing to the provincial directorate where the complainant resides.
Consumers may also manage their permissions through İYS. The Ministry of Trade states that İYS allows citizens to see and control all message approvals from a single point and to exercise the right of refusal.
From a business perspective, complaints should be taken seriously. If a consumer complains, the business should be able to prove when, where and how consent was obtained; whether the recipient’s consent existed in İYS; what message was sent; whether the message included mandatory elements; whether an opt-out mechanism was provided; and whether any withdrawal request was respected.
A company without proper records may be unable to defend itself even if it believes the message was lawful.
Administrative Sanctions and Legal Risks
Unlawful commercial electronic messages may lead to administrative fines under electronic commerce legislation. The Ministry of Trade states that complaints about unwanted commercial electronic messages are examined and that administrative fines may be imposed on real or legal persons found to have sent messages in violation of the law.
There may also be KVKK sanctions if personal data is processed unlawfully. If contact information is collected without proper information, used for marketing without a valid legal basis, transferred to third parties unlawfully, processed after withdrawal, or stored insecurely, the Personal Data Protection Board may become involved.
Legal risk may also include consumer complaints, reputational damage, blacklisting by e-mail systems, termination by SMS providers, platform restrictions, contract disputes with agencies and unfair competition allegations by competitors.
In practice, unlawful messaging often arises from poor database management. Old contact lists, merged customer databases, unsynchronized opt-out records, third-party lists, unclear consent forms and agency mistakes are common causes of violations. Businesses should therefore treat consent management as a technical, legal and operational compliance system.
Practical Compliance Checklist
Businesses sending commercial electronic messages in Turkey should apply the following checklist:
Identify whether the message is commercial or purely operational.
Determine the communication channel: SMS, e-mail, call, voice message, fax, push notification or another electronic channel.
Obtain prior consent unless a specific legal exception applies.
Record consent through a verifiable method and ensure İYS compatibility.
Do not send commercial messages to recipients whose approval is not found in İYS.
Separate marketing consent from contract approval, payment, delivery, membership and verification processes.
Provide a proper KVKK privacy notice before processing personal data.
Do not bundle different consents into one action.
Do not make marketing consent mandatory for the provision of goods or services.
Include mandatory sender identity information.
Clearly indicate campaign, promotion or information nature where necessary.
Clearly disclose promotional conditions, discounts, gifts, contests or games.
Include an easy and free opt-out mechanism in every commercial electronic message.
Process opt-out requests promptly and synchronize all systems.
Avoid purchased, scraped or unverifiable contact lists.
Review agency and service provider contracts.
Preserve consent records, message logs, İYS records, opt-out logs and campaign approvals.
Train sales, retail, call center and marketing teams.
Audit CRM, SMS, e-mail and call center systems regularly.
Best Practices for Businesses
The safest approach is to build a consent-first marketing system. A business should not collect contact details casually and later decide to use them for advertising. The purpose of collection should be clear from the beginning.
Consent screens should be simple and separated. For example, account creation, privacy notice, contract acceptance and marketing consent should not be combined into one checkbox. SMS verification codes should not simultaneously approve membership, KVKK processing and commercial electronic message consent. The Personal Data Protection Board’s 2025 principle decision expressly warns against completing different processing activities through a single action.
Businesses should also run regular database audits. They should remove invalid contacts, update opt-out records, check İYS synchronization, verify consent sources and delete unnecessary marketing data. A company that cannot prove consent should not send messages.
Marketing teams should prepare lawful message templates. Every template should include sender information, campaign conditions and opt-out instructions. E-mail subject lines should not be misleading. SMS messages should not hide the sender identity. Call scripts should identify the business and respect refusal requests.
Finally, companies should adopt a privacy-friendly culture. The goal is not only to avoid fines. Respecting consumer communication preferences strengthens brand trust and reduces complaint risk.
Conclusion
Commercial electronic messages in Turkey are governed by a strict legal framework. SMS marketing, e-mail marketing, commercial calls and similar electronic communications may be effective, but they require careful compliance with Law No. 6563, the Regulation on Commercial Communication and Commercial Electronic Messages, İYS rules and KVKK.
A commercial electronic message is broadly understood as a data, voice or visual message sent electronically for commercial purposes through tools such as telephone, call centers, automatic calling systems, e-mail and SMS. Businesses generally need prior consent, proper İYS registration, accurate sender identification, clear campaign information and an easy, free opt-out mechanism.
İYS plays a central role by allowing consumers to manage approvals from a single point and by providing service providers with legal certainty in proving consent. However, İYS compliance alone is not enough. Because phone numbers and e-mail addresses are personal data, the entire process must also comply with KVKK. The Personal Data Protection Board has clearly stated that sending commercial electronic messages through stored contact data is a personal data processing activity and must comply with data protection rules.
For businesses operating in Turkey or targeting Turkish consumers, the safest rule is simple: do not send marketing messages unless the recipient’s consent is valid, recorded, current and respected. Do not hide marketing consent inside purchase flows. Do not treat operational contact information as marketing permission. Do not ignore opt-out requests. Do not use unverifiable lists. Do not separate legal compliance from technical CRM processes.
A compliant commercial electronic message strategy protects consumers from unwanted communications, reduces administrative and KVKK risk, and strengthens brand credibility. In the Turkish market, lawful digital marketing is not based on reaching everyone at any cost; it is based on reaching the right people with valid consent, transparent content and respect for the consumer’s right to refuse.
No Responses