Turkey’s Data Protection Authority Published Draft Cookie Guidelines
What is the Data Protection Law in Turkey?
The Turkish Personal Data Protection Law No. 6698 (Kişisel Verileri Koruma Kanunu, or KVKK) went into effect on 7 April 2016. The KVKK is the first specific law in Turkey that regulates the protection of personal data in Turkey. Prior to the KVKK, data protection was regulated by sectoral laws as well as the Constitution of Turkey and the Turkish Penal Code.
What is the Turkish DPA?
The Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) is the national data protection authority in Turkey. The Turkish DPA is a legal entity with administrative and financial independence. It was established to carry out the duties delegated to it by the Turkish Data Protection Law, KVKK.
What are the Turkish DPA Cookie Guidelines?
According to the assessment, the Turkish DPA sets out the types of cookies that require explicit consent and those that do not require prior consent.
The following cookies require the prior explicit consent of the data subjects:
- Social media plug-in tracking cookies.
- Online behavioral advertising cookies
The following cookie types may be used without prior explicit consent of the data subjects:
- user-input cookies;
- identity authentication cookies;
- user-centric security cookies;
- multimedia player session cookies;
- load-balancing session cookies;
- user interface customization cookies;
- social plug-in content-sharing cookies;
- cookies used for the explicit consent management platform;
- cookies used for website security; and
- first-party analytics cookies
First Party Analytics Cookies
According to the Draft Guidelines, the first-party analytics cookie may be used without prior explicit consent of data subjects only under certain circumstances. These include:
(i) use of first-party analytics cookies concerns only the generation of anonymous statistics;
(ii) user's internet browsing is not used to track them across different websites;
(iii) cookie lifespan of cookies is reasonable; and
(iv) data collected through cookies must not be communicated to third parties.
How to obtain explicit consent?
The Draft Guidelines set out requirements for obtaining explicit consent. The Turkish DPA specifies that the consent must be specific, informed, and freely given.
Specific consent. The cookies’ purposes, duration, and information about whether they are first or third-party cookies must be provided before consent collection. Providing generic information such as “I consent to the processing of my personal data” would not be specific and thus not valid.
Informed consent. The information must be provided before or at the time of collection of personal data. It must be easily accessible and noticeable, and the content of the information must be simple, easy to understand, and comprehensible.
Freely given. It must be easy to withdraw consent at any time. It is recommended to have a tiny icon or button linked to the cookie settings page remain visible all the time on the website.
It is recommended that the frequency of re-presenting to the users the cookie banner to obtain their cookie consent preferences should be limited. The Turkish DPA states that this would cause “consent fatigue” and affect users’ free will. However, it is not suggested how many months must be elapsed before you should ask for a renewal of consent.
It is further recommended to have the “Accept,” “Reject,” and “Preferences” buttons presented of the same color and size.
The Turkish DPA considers the use of cookie walls to be unlawful. This is because the cookie walls prevent the users from making a free choice based on their free will.
Are Draft Guidelines Binding?
The Draft Guidelines are not legally binding under Turkish law. Still, they are important because they present the Turkish DPA’s approach and expectations on the relevant matter and shed light on the logic behind the decisions of the DPA.
Examples of Cookie Banners
The Draft Guidelines provide examples of compliant and non-compliant cookie banners:
1) The following 2-layer cookie banner is provided as an example of good practice by the Turkish DPA:
2) The following cookie banner is an example of a non-compliant cookie banner:
There is no option to reject the cookies
3) The following cookie banner is an example of a non-compliant cookie banner:
- There are no accept, reject, and cookie preference buttons
- There is no possibility of giving granular consent
- The consent cannot be considered to be freely given
4) The following example is a non-compliant cookie banner:
- The preference center includes pre-selected slide bars (similar to pre-ticked boxes)
How Secure Privacy Can Help You Comply with Turkish DPA Cookie Guidelines?
Secure Privacy comes packed with enterprise-level features that will help you fully comply with Draft Guidelines cookie guidelines and the GDPR (Check out the EU Cookie Guidelines)..
The main features are:
- Advanced ongoing website scanning, which allows you to see all of the cookies on your website
- Cookie consent banners that are highly customizable and stylish, with a universal preference center for users to opt-in and opt-out of the cookies and other tracking technologies
- Unique cross-domain consent capability that allows your users to manage their cookie preferences across different domains in a single step
- Over 70 languages supported
- Real-time logs and consent tracking to ensure you maintain records of the consent you receive from users in case CNIL requests it
Read our blog to get a simplified breakdown of the latest EDPB Cookie Consent Guidelines.
Alternatively, you can sign up for a free trial of our complete GDPR compliance solution here.
Turkey DPA Draft Cookie Guidelines (available in Turkish)
Five Problems that GDPR DPOs Face and How to Solve Them
DPOs often have more than one job in an organization, so it's clear that they can't always keep up with the latest legal and technological changes that are important to their work. Even though they aren't lawyers, they are expected to know the GDPR inside and out. Though they may lack technical expertise, these individuals are frequently tasked with advising on how organizations should use cutting-edge security measures to secure sensitive data. In other words, it's not a simple task.
- Data Protection
Three Free DPIA Templates and How to Use Them
In this article, you will find three DPIA templates: one from the UK, one from the French DPA, and one from the IAPP, the International Association of Privacy Professionals. Because of their expertise, we can rely on the templates they provide.
- Data Protection
What is a Consent Management Platform?
Consent Management Platform (CMP) is a software tool that makes it easy for websites to follow cookie regulations. Before a user gives consent, your website needs to block cookies. In this article, we'll discuss how websites can use CMPs to keep track of the consent they ask for.
- Data Protection