The resolution dated 10.06.2025 and numbered 2025/1072 (“Resolution”) of the Personal Data Protection Authority (“Authority”) dated 10.06.2025 and numbered 2025/1072 was published in the official gazette dated 26.06.2025.
The resolution evaluates the processing of personal data by requesting the contact information of the relevant persons and sending a verification code via SMS during the processes related to product and service offerings, which is seen to be a common practice in the notifications and complaints received by the Personal Data Protection Board (“Board”). In this context, the practices regarding obtaining permission to send commercial electronic messages during the following and similar transactions in product and service offerings were evaluated.
- Payment
- Registrary
- Create a membership
- Create an offer
It has been evaluated that during the said transactions; the contact information of the relevant persons was requested, subsequently a verification code was sent to the relevant persons via SMS, and the said code was requested to be notified to the officer/entered into the system on the grounds that it was necessary for the completion of their payments, creation of an invoice, delivery of the invoice to the contact address or updating their information, and following the said transaction, commercial electronic messages were sent to the relevant persons regarding the activities of the data controller.
Since it was assessed in the resolution that the provision of the SMS code in question could lead to misleading the relevant persons if it was presented as a mandatory element of the shopping;
- The data subject should be informed about the purpose of the SMS code sent and what the consequences will be in terms of personal data if the code is given,
- It is necessary to put an end to practices where multiple distinct data processing activities—such as obtaining consent for the membership agreement, processing of personal data, and approval for commercial electronic messages—are carried out through a single action, such as sending a verification code via SMS to data subjects. For data processing activities that require explicit consent, data subjects must be presented with separate options and explicit consent must be obtained individually for each purpose,
- In cases where personal data is processed based on explicit consent, such consent must include the elements specified in the Turkish Personal Data Protection Law (“Law”).
- It has been concluded that obtaining explicit consent for the processing of personal data for the purpose of sending commercial electronic messages should not be presented to data subjects as a mandatory requirement for the provision of products or services, and that data controllers must take the necessary technical and administrative measures to ensure this.
In the event that it is determined that the above-mentioned requirements are not complied with, it is stated that necessary actions will be taken against the relevant data controllers, including the imposition of administrative fines, within the framework of Article 18 of Law.
You can access the principle decision and its full text, published in the Official Gazette dated 26.06.2025 and on the Authority’s official website, via the link below.
For detailed information and professional support during the compliance process, feel free to contact us.
This Legal Alert has been prepared for general information purposes only on current legal issues, and the evaluations contained in this Legal Alert do not constitute legal advice or a legal opinion. It is not possible to impose any liability on SRP-Legal Law Office due to the content of this Legal Alert. It is recommended to obtain the opinion of a legal advisor regarding your questions and enquires within the scope of this Legal Alert.
