Turkish Personal Data Protection Board: Principle Decision on the Separate Preparation of Explicit Consent Texts and Privacy Notices by Data Controllers

The Principle Decision dated 18 February 2026 and numbered 2026/347 (“Principle Decision”), adopted by the Turkish Personal Data Protection Board (“Board”), was published in the Official Gazette dated 24 March 2026 and numbered 33203.

The Principle Decision sets forth, in summary, the following determinations and evaluations:

• It is stated that explicit consent texts and privacy notices (information notices) have different legal natures; therefore, presenting these texts with identical content, in an intertwined manner, or through a single consent mechanism is unlawful.
• It is emphasized that the obligation to inform, pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (“Law”) is aimed at informing data subjects; accordingly, the identity of the data controller, the purposes of data processing, the recipients of data transfers, the method and legal basis of data collection, and the rights of the data subject must be clearly provided.
• It is stated that the purpose of the privacy notice is not to obtain consent; therefore, expressions such as “I have read and accept,” “I have read and approve,” or “I give explicit consent” should not be included at the end of such notices, and instead, statements such as “I have read and understood” should be preferred.
• It is underlined that explicit consent, as defined under Article 3 of the Law, must be specific, informed, and freely given, and therefore constitutes a legal basis for processing that should only be relied upon where necessary.
• It is stated that explicit consent texts must be prepared as separate documents in cases where data processing activities rely on explicit consent; data subjects must clearly understand for which processing activities they provide consent and must be able to withdraw such consent at any time.
• It is indicated that the burden of proof regarding the fulfilment of the obligation to inform and the proper obtaining of explicit consent lies with the data controller.
• Where personal data processing is based on explicit consent, it is required that privacy notices and explicit consent texts be prepared separately; even if presented on the same page, they must be provided under separate headings and with separate declarations for each. 
• Where personal data processing is based on legal grounds other than explicit consent, it is stated that data subjects should not be presented with an explicit consent text; only the obligation to inform should be fulfilled.
• Among the frequently encountered unlawful practices are: presenting explicit consent and privacy notices within a single text, requesting approval or consent for the provision of information, using texts prepared by other data controllers without adaptation, employing ambiguous or misleading language, and preferring unnecessarily long and complex texts.
• It is emphasized that privacy notices must clearly, plainly, and explicitly specify the categories of personal data processed, the purposes of processing, and the legal grounds relied upon.
• Pursuant to Article 12 of the Law, data controllers are obliged to take all necessary technical and administrative measures to ensure lawful processing of personal data; it is further stated that non-compliance with these obligations may result in administrative sanctions under Article 18 of the Law.

It is noted that the intertwined presentation of explicit consent texts and privacy notices is among the most common unlawful practices identified in complaints and notifications submitted to the Turkish Personal Data Protection Authority.

You can access the full text of the Principle Decision here.