The Cookie Practices Guide (“Guide”) published on the official website of the Turkish Personal Data Protection Board (“Board”) on 20.06.2022, contains a number of recommendations for the proper fulfillment of the data processing activities of the data controllers who process personal data via cookies in accordance with the Personal Data Protection Law No. 6698 (“Law” or “Law No. 6698”) The guide generally contains parallel regulations with the previously published draft.

First of all, it is recommended to consider the following criteria in the processing of personal data via cookies:

  • Criterion A: The use of cookies is necesarry only for the purpose of providing communication over the electronic communication network. Load Balancing Session Cookies are shown as an example of such cookies.
  • Criterion B: The use of cookies is strictly necessary for information society services that the subscriber or user explicitly requests to receive services. Some examples of such cookies are as follows: User Input Cookies, Authentication Cookies, User-Centered Security Cookies, Multimedia Player Session Cookies, Social Plugin Content Sharing Cookies, Open Consent Management Platform Cookies, and Cookies Used for Website Security.

If the personal data processing activity via cookies falls within the scope of Criteria A or B, it seems possible for the data controller to rely on the personal data processing conditions other than express consent in the Law regarding this data processing activity. In other words, when personal data is processed via cookies within the scope of Criteria A and B, the explicit consent of the data subject is not required.

On the other hand, it is pointed out that the explicit consent of the data subject is required for cookies that are not within the scope of the above-mentioned criteria. Examples of such cookies are: Social Plugin Tracking Cookies, Online Behavioral Advertising Cookies.

In the guide, in cases where express consent is required, issues such as how to obtain explicit consent, how to clarify about cookies whether explicit consent is required or not), and the transfer of data abroad through cookies are discussed in detail.

In addition, the checklist on the use of cookies for data controllers, the use of tape on the website as an example of correct practice and the consent management platform, the sample clarification text are attached to the guide.

You can access the Guide (in Turkish) from the link below:

https://www.kvkk.gov.tr/Icerik/7353/Cerez-Uygulamalari-Hakkinda-Rehber

Batuhan Şahmay
Partner | [email protected]
Naz Ergörün
Associate | [email protected]
Behiç Ateş Gülenç
Associate | [email protected]