The Turkish Data Protection Authority Publishes Draft Guide on Applications of Cookies

The Draft Guideline on Applications of Cookies (“Guide”) by the Turkish Personal Data Protection Authority (“Authority”) was published on the Authority’s website on January 11, 2022.

The Authority has prepared a Guide for the purpose of creating an advisory and guiding document for data controllers who process personal data through cookies. The cookies that are not used in the processing of personal data are out of the scope of this Guide. Nevertheless, the Guide will not only be valid for cookies used on websites, but also for applications used on smart phones, tablets etc. that can connect to the internet.

It is emphasized that cookies do not require informed consent if any of the conditions that stipuleted below are met according to the Guide:

  • The use of the cookies only for the purpose of providing communication over the electronic communication network,
  • The use of cookies is strictly necessary for information society services that the subscriber or user explicitly requests to receive services.

The use of cookies that do not require explicit – prior consent are listed as follows in the Guide:

  • Cookies with user input,
  • Authentication cookies,
  • User-centered security cookies,
  • Multimedia player session cookies,
  • Load balancing session cookies,
  • Cookies for personalizing the user interface,
  • Social plugin content sharing (like, share, comment) cookies,
  • Cookies used for the explicit consent management platform,
  • First-party analytics cookies,
  • Cookies used for the security of the website.

The use of cookies that require explicit – prior consent are as follows:

  • Social plugin tracking cookies,
  • Online behavioral advertising cookies.

It is emphasized in the Guide that consents that are not based on any active action of the user cannot be considered as explicit consent. For this reason, simply accessing the website does not mean that explicit consent has been given to the cookies running on the said site.

While obtaining explicit consent within the scope of cookies, it is presented as a good practice example that a cookie management panel appears as soon as the site is entered and the "accept", "reject" and "preferences" buttons are equally presented on the said panel in terms of color, size and font.

In cases where consent to cookies is imposed on the person concerned as a prerequisite for the service by placing a cookie wall for access to the site, the cookie wall may injure the free will of the person concerned, and in this case, the explicit consent obtained will not be a valid expilict consent.

It is emphasized in the Guide that in order to start the processing of personal data with the site visit, the clarification must be made at the stage of entering the website, regardless of the personal data processing condition.

In addition, it is recommended that the name of the cookies, its purpose and duration of use, and whether it is a first or third party information should be clearly included in the clarification text.

The Guide was shared with the public for 30 days on the website of the Authority. In order to collect the opinions of the parties who may be interested in the Guide, it is possible to send the opinions and evaluations regarding the Draft Guidelines on Applications of Cookies in writing to the Institution and/or by e-mail to cerez@kvkk.gov.tr until 10.02.2022.

You can find the announcement text of the Guide here.

You can find the Guide here.

You can access the feedback form regarding the Guide here.

Kind regards,

Zumbul Attorneys at Law

info@zumbul.av.tr