The Personal Data Protection Board (“Board”), in its Principal Decision dated 10 June 2025, numbered 2025/1072, and published in the Official Gazette on 26 June 2025, (“Decision”), has evaluated the practice of requesting personal contact information from subjects for the purpose of sending verification codes via SMS during processes related to the provision of products and services. The Board has examined claims that contact numbers, to which verification codes are sent during payment completion, invoice issuance, invoice delivery, or information update processes, are subsequently used for commercial communication purposes after the code is declared to personnel or entered into the system.
As a result of this Decision, the Board has resolved to inform the public that, in the event of non-compliance with the following obligations or misleading of data subjects, administrative sanctions will be imposed pursuant to Article 18 of Law No. 6698:
- Data subjects must be duly informed regarding the purpose of the SMS and verification code sent during product and service provision processes, including the consequences in terms of personal data processing if the code is shared.
- Practices that combine multiple processing activities—such as contract approval, obtaining consent for personal data processing, and approval for commercial electronic communications—into a single action via SMS verification must be discontinued. Explicit consent must be separately obtained for each processing activity that legally requires it. Furthermore, it is mandatory that the obligation of providing information (disclosure) and the obtaining of explicit consent are carried out as distinct and separate processes.
- For processing based on explicit consent regarding the sending of commercial electronic messages, such consent must meet the criteria set forth under the Personal Data Protection Law. The Law defines explicit consent as consent that is related to a specific subject, given based on informed choice, and declared with free will.
- Even if the request for personal data for the purpose of sending commercial electronic messages is based on explicit consent, it must not be communicated to the data subjects as a mandatory element for the provision of the product or service. Explicit consent for sending commercial electronic messages should be obtained after the provision of the product or service is completed, and it must be ensured that such consent is not perceived as a compulsory element of the product or service provision.
The full text of the relevant Decision is available at: https://kvkk.gov.tr/Icerik/8338/2025-1072
Best Regards,
Balay, Eryiğit & Erten
