Summary of the Decision of the Turkish Data Protection Authority dated 10/03/2022 and numbered 2022/229 on “Unlawful processing of personal data through cookies used on the website/mobile applications by the data controller company operating in the e-commerce sector”

While there will be no need for the explicit consent of the data subject regarding the mandatory cookies for the website’s functions properly; Authority stated that the use of #cookies positioned for advertising, marketing and performance purposes is subject to the explicit consent of the data subjects.

If there is no legal basis, other than explicit consent regarding the operation of functional cookies, performance-analytical cookies, advertising/marketing cookies, the cookies in question must be approved by the Freely Given Consent of the data subjects at the time of accessing the website/mobile application. Therefore, it has been emphasized that explicit consent should be obtained according to the “opt-in” mechanism, which stipulates those cookies do not work as a default setting.

Activities carried out by transferring personal data abroad through cookies must be carried out in accordance with Article 9 of the Law (Law no.6998, KVKK).

In this context, for the personal data transferred abroad from Turkey by using 3rd Party cookies, the explicit consent of the data subjects must be obtained in accordance with Article 9 of the Turkish Law No. 6698, titled Transfer of personal data abroad.

Detailed information on personal #dataprocessing activities and the purposes of each type of cookies should be explained in a way that can be understood by the data subjects.