If your site has a contact form, a Google Analytics code or a WhatsApp button, you are processing personal data. A KVKK-compliant website is no longer a luxury reserved for large companies; a small business’s site is subject to the same rules.
In July 2025 the Personal Data Protection Authority published the updated version of its Guidelines on Cookie Practices; in 2024, important amendments to Law No. 6698 on special categories of data and cross-border transfers came into force. In this article we explain step by step where a website carries KVKK risk, the difference between a privacy notice and explicit consent, what a proper cookie banner should look like and what you need to fix on the technical side.
What personal data does a website process?
The first step toward KVKK compliance is honestly listing where your site collects data. Most businesses only think of the contact form, yet personal data is processed in far more places than you might think:
- Forms: contact, quote, appointment, job application, newsletter sign-up. Names, emails, phone numbers and even extensive data such as CVs.
- Cookies and tracking codes: Google Analytics, Meta pixel, Google Ads conversion tag, heatmap tools. These collect online identifiers and behavioural data.
- Server logs: IP address, browser information, access time. Traffic logs kept under Law No. 5651 also fall into this group.
- Third-party plugins: embedded YouTube videos, Google Maps, live chat and WhatsApp widgets, social media share buttons.
- Membership and e-commerce: account details, addresses, order history. Payment card data is usually processed directly by the payment institution.
Once you have this list, answer three questions for each piece of data: Why am I collecting it, which legal basis am I relying on, and how long do I keep it? These answers form the backbone of the privacy notice and cookie policy we’ll discuss shortly.
A privacy notice and explicit consent are not the same thing
The most common mistake on websites is combining the privacy notice and explicit consent into a single checkbox. The phrase “I have read and accept the KVKK text” mixes up two separate obligations.
Privacy notice: mandatory in every case
Under Article 10 of the law, you must inform people when collecting data: the identity of the data controller, the purposes of processing, to whom and for what purpose the data may be transferred, the method of collection and legal basis, and the person’s rights under Article 11. The notice is information; it does not ask for consent. So instead of an “I have read and accept” box, a clearly visible link right below the form is enough.
Explicit consent: only when there is no other basis
Explicit consent is consent relating to a specific matter, based on information and given freely. The data controller should first check whether another processing condition applies, such as entering into a contract, a legal obligation or legitimate interest; only if none applies should it rely on explicit consent. For example, replying to someone who filled in a quote form doesn’t require explicit consent, but sending that same person campaign emails requires separate consent.
| Situation | Privacy notice | Explicit consent |
|---|---|---|
| Replying to a contact form | Required | Usually not required |
| Newsletter and campaign emails | Required | Separate consent required (along with İYS registration) |
| Strictly necessary cookies (session, cart, security) | Required | Not required |
| Advertising and remarketing cookies | Required | Required |
| Special category data, such as health information in a job application | Required | Depends; conditions were broadened by the 2024 amendment |
Explicit consent cannot be made a precondition of the service. If someone who doesn’t consent to the newsletter can’t submit the contact form, the consent is no longer freely given. Checkboxes must also be unticked by default.
The right cookie banner according to KVKK’s cookie guidelines
KVKK’s July 2025 Guidelines on Cookie Practices are the most concrete roadmap for website owners. The guidelines’ core message is this: not every cookie requires explicit consent, but cookies that do require consent must not run until the user agrees.
Which cookies can be used without consent?
The guidelines treat examples such as session and form input cookies, authentication, user-centric security, load balancing, interface preferences like language, and shopping cart cookies as falling under processing conditions other than explicit consent. They state that first-party analytics cookies may also be considered within this scope, provided they are limited to measuring how the site works, the data is minimised through measures such as IP masking, and there is no cross-site tracking. Advertising, remarketing and third-party tracking cookies, however, require explicit consent.
What should a good cookie management panel look like?
- Equal buttons: The guidelines cite presenting the “Accept”, “Reject” and “Preferences” buttons in the panel shown on entry with equal colour, size and font as good practice. Burying the reject option in a small grey link goes against this principle.
- Off by default: Cookie categories based on explicit consent should be inactive at first on the preferences screen.
- Consent first, code second: Advertising pixels and tracking tags should not load until the user consents. Just showing a banner while running everything in the background is not compliance.
- Withdrawable consent: Users should be able to change their preference easily later; the guidelines cite a small icon or banner in a corner of the page as a good example.
- No cookie walls: “Cookie wall” practices that make access to the site conditional on accepting all cookies can undermine free will and may not count as valid consent.
- Consent fatigue: Instead of asking again on every visit, it is recommended to re-prompt at intervals proportionate to the cookie’s lifetime.
The cookie policy, on the other hand, is a separate page linked from the panel: it lists the cookies used, their purpose, duration, whether they are first- or third-party and how to manage them. The guidelines also stress that phrases such as “by using this site you are deemed to accept cookies” do not constitute valid consent.
A cookie banner isn’t decoration; it’s a key: the door shouldn’t open until the user says “yes”.
Contact forms, newsletters and commercial message permissions
Forms are the most visible part of KVKK-compliant website design, and when set up properly they don’t harm the user experience. The structure we recommend is as follows:
- Step 1 — Right below the form, add a short sentence such as “Your personal data is processed in accordance with our Privacy Notice.” with a link to the text. A checkbox is not required.
- Step 2 — If you need marketing permission, add a separate, optional box that is unticked by default. Submitting the form should not depend on this box.
- Step 3 — If you want to send commercial electronic messages, don’t forget the obligations under Law No. 6563 and the Message Management System (İYS); consents obtained must be registered in İYS.
- Step 4 — Determine where form data goes: an email inbox, a CRM, Google Sheets or a form tool hosted abroad. This directly concerns the cross-border transfer issue we discuss below.
- Step 5 — Set a retention period. If there is no reason to keep form entries from two years ago that never turned into a deal indefinitely, delete or anonymise them periodically.
You should also offer a way for people to exercise their rights under Article 11 of KVKK. Requests must be answered within 30 days at the latest; an application form or a clear email address on the site makes this process easier.
The 2024 amendments: cross-border transfers and foreign services
The amendments made by Law No. 7499, which came into force on 1 June 2024, are especially important for websites when it comes to transferring data abroad. If you use hosting, an email service, an analytics tool, a form service or a CRM hosted abroad, your data may be transferred abroad.
Under the new regime, a transfer can be made if a processing condition exists and the data goes to a country with an adequacy decision, or one of the appropriate safeguards is in place, such as the standard contract published by the Authority. A standard contract must be notified to the Authority within five business days of signing. The old option of transferring on the basis of explicit consent ceased to be a stand-alone basis after the transition period ended on 1 September 2024; explicit consent remains only as a narrow exception for occasional transfers.
The same amendment also broadened the conditions for processing special categories of data. Sites that ask for health information in a job application form, or that design an appointment form for a clinic, should assess this separately, because additional security measures set by the Board also apply to special category data.
Technical and administrative security measures for KVKK
Article 12 of KVKK obliges the data controller to take appropriate technical and administrative measures to protect data against unlawful access. For a website, this translates into concrete, measurable steps:
- HTTPS on every page: A valid SSL certificate and a permanent redirect from HTTP to HTTPS. For details, see our website security and SSL guide.
- Up-to-date software: Regularly updating your CMS, plugins and libraries; removing unused plugins.
- Access management: Strong passwords and two-factor authentication for the admin panel; only the people who need it can access form entries.
- Backups and logging: Regular, encrypted backups and logging of panel access.
- Data breach plan: When a breach is detected, the Board must be notified as soon as possible and within 72 hours at the latest. Writing down in advance who does what saves time in a crisis.
These measures matter not only for KVKK but also for your site’s reputation and search visibility. A compromised site can lose both customer trust and its Google rankings.
Is VERBİS registration required, and how large are the fines?
VERBİS (the Data Controllers’ Registry Information System) is not mandatory for every business. According to Board decisions, data controllers whose main activity is not processing special category data, with fewer than 50 employees per year and an annual balance sheet total below 100 million TL, are exempt from registration. With the Authority’s announcement of 1 October 2025, those with fewer than 10 employees and a balance sheet below 10 million TL are also exempt, even if their main activity is processing special category data.
Administrative fines are updated every year by the revaluation rate, and the Authority publishes the current table on its website. For 2026, the lower limit for breaching the obligation to inform is around 85,000 TL and the upper limit around 1.7 million TL; for data security and VERBİS violations the upper limit exceeds 17 million TL. We recommend checking the Authority’s official table for the exact figures.
- Have all data collection points on the site been listed?
- Is there a privacy notice link below every form?
- Is marketing consent a separate, optional, unticked box?
- Do Accept / Reject / Preferences look equal in the cookie panel?
- Are advertising and tracking codes blocked until consent is given?
- Have services abroad and the transfer basis been identified?
- Are a request channel and a data breach response plan ready?
Frequently asked questions
Is KVKK mandatory for a small business’s website?
Yes. KVKK applies to all individuals and legal entities that process personal data. Small businesses may be exempt from VERBİS registration, but the obligations to inform, keep data secure and respond to data subject requests still apply.
Do I need explicit consent for a contact form?
Usually not. Processing data to respond to a request is generally considered preparation for entering into a contract or a legitimate interest; a privacy notice is enough. For marketing communications, however, separate and optional consent is required.
Do I need cookie consent to use Google Analytics?
KVKK’s cookie guidelines may treat first-party analytics that only measures how the site works, with minimised data and no cross-site tracking, as falling under conditions other than explicit consent. Setups involving advertising features, remarketing or third-party tracking, however, require explicit consent.
Does a cookie banner have to have a Reject button?
The Authority’s 2025 guidelines cite presenting the Accept, Reject and Preferences buttons in equal size, colour and font as good practice. Making rejecting as easy as accepting is the safest way to show that consent is based on free will.
Can a KVKK privacy notice be copied from a template?
Not recommended. A privacy notice must describe what data you actually process, for what purpose and with which services. Copying another company’s text can lead to inaccurate and misleading information.
Final word
A KVKK-compliant website is not a site full of long legal texts; it is a site that knows what it collects, doesn’t collect what it doesn’t need, offers users a real choice and stores data securely. This approach also increases visitors’ trust. We recommend working with an expert on the content of legal texts; on the technical side, such as the cookie panel, form flows, loading tags based on consent and server security, we are by your side with our web solutions. If you are planning a new site, you can also read our corporate website guide, and for a technical KVKK check of your current site, get in touch with us.