Permission-Based Marketing in Turkey: IYS and KVKK Consent Rules

Permission-based marketing in Turkey means getting the recipient's consent before you send promotional email, SMS or calls, and registering that consent in IYS, the national Message Management System (İleti Yönetim Sistemi). Under Law No. 6563 on the Regulation of Electronic Commerce, commercial electronic messages may only be sent with the recipient's prior consent, and the implementing regulation treats consent that is not recorded in IYS as invalid. Separately, any personal data you collect must be processed under Law No. 6698 on the Protection of Personal Data (KVKK).

These are Turkish rules, so this guide matters if your campaigns reach recipients in Turkey. Below we summarize how consent is collected, how it is managed in IYS and what to watch on the KVKK side, based on the official texts. This is not legal advice; decide on your own forms and processes together with your legal counsel.

Which messages does permission-based marketing cover?

The law defines a "commercial electronic message" as data, voice or video content sent for commercial purposes through electronic channels such as phone, call centers, automated calls, email and SMS. A campaign announcement, a discount code, a new product newsletter or a sales call all fall within this scope.

Not every message needs consent. Under Article 6 of the law, if the recipient gave you their contact details so that you could reach them, messages about changes to, use of or maintenance of the goods or services they obtained do not require separate consent. An order confirmation, a shipping notice or an announcement about a change to a service they bought belongs to this group. Once you add a promotion to such a message, however, it becomes a commercial message.

The law also says commercial electronic messages may be sent to tradespeople and merchants without prior consent. Like any other recipient, they can still refuse further messages whenever they want.

How do you obtain valid consent for commercial messages?

According to the current text of the Regulation on Commercial Communication and Commercial Electronic Messages, consent can be obtained in writing, through any electronic communication tool or through IYS itself. The consent must include three elements:

• A positive declaration of will showing the recipient agrees to receive commercial electronic messages
• The recipient's first and last name
• The electronic address the messages will be sent to (email address or phone number)

In practice, a "positive declaration of will" means an active step by the recipient, such as ticking a consent box themselves. A pre-ticked box, or a sentence buried inside a membership agreement, will struggle to meet this requirement.

Watch two prohibitions. First, you cannot ask for consent by sending a commercial electronic message to the person's email address or phone; an SMS asking "would you like to join our newsletter?" falls under this ban. Second, according to the Ministry of Trade, intermediary service providers (bulk SMS or email sending companies) cannot collect consent on behalf of others. Your business has to collect it directly.

Collecting consent separately per channel (email, SMS, calls) follows the channel logic of the regulation and gives recipients a genuine choice. An example consent line: "I would like to hear about campaigns and new products by email." The content you send must also match the consent you obtained; using contact details given for shipping updates to send campaigns breaks this rule.

Why is IYS registration mandatory?

Under the regulation, you cannot send commercial electronic messages to recipients who have no consent on record in IYS, and consent not registered in IYS is considered invalid. So if you collected consent through a form on your website but never uploaded it to IYS, you cannot send messages based on that consent.

A typical workflow looks like this:

1. Consent is collected through a form, in store or by a call center; the date, time, source and version of the consent text are recorded.
2. The consent is transferred to IYS per channel. This is usually done through the IYS integration of your CRM or marketing automation tool, or through a connection provided by your sending provider.
3. Before every campaign, the send list is checked against the current status in IYS.
4. Opt-out requests, whether they arrive through IYS or directly to you, are updated in both systems at the same time.

Keep a single source of truth for permissions. A mistake we see often is a contact marked as "opted in" in the CRM while IYS shows them as having refused. Sending without syncing your list with IYS means messaging someone without valid consent.

How does the right to opt out work?

Under Article 8 of the law, recipients can refuse messages at any time without giving a reason. The sender must make it easy and free to submit an opt-out electronically, and must show how to do so in every message. Once the request arrives, sending must stop within three business days.

A one-click unsubscribe link in emails and a short opt-out route in SMS are the practical way to meet this obligation. Each message should also include information identifying your business and accessible contact details (Article 7).

According to the Ministry, recipients can file a complaint within three months of the date a message was sent. Keep your consent records, and records showing when you processed each opt-out, in good order for that reason.

What do you need to watch on the KVKK side?

IYS consent governs whether a message may be sent; the processing of personal data is a KVKK matter. One obligation does not replace the other. As soon as your form collects an email address or phone number, you need to provide a privacy notice explaining the purpose of processing, who the data will be shared with and the person's rights.

If you base marketing-related processing on explicit consent, the guidance of Turkey's Personal Data Protection Authority is useful:

• Explicit consent must relate to a specific subject, be based on information and be given freely.
• General, open-ended consent such as "for all kinds of commercial activity", which the Authority calls "blanket consent", is not considered valid.
• A person can withdraw consent at any time; withdrawal takes effect from the moment it reaches the data controller.
• The Authority has found that making a product or service conditional on giving explicit consent is contrary to the law and to the principle of good faith. A setup like "you cannot sign up without agreeing to the newsletter" is therefore problematic.

Which legal basis you rely on for which processing (explicit consent or another condition in the law) depends on your business and the data involved; make that call with your lawyer.

Permission-based marketing checklist

1. Do your forms have per-channel consent boxes that are not pre-ticked?
2. Does the consent capture a positive declaration, name and contact address?
3. Are the date, source and text version of each consent recorded?
4. Is consent transferred to IYS and synced with IYS before every send?
5. Does every message include an easy, free way to opt out and your business details?
6. Are opt-out requests processed within three business days?
7. Are your privacy notice and any explicit consent text separate, clear and up to date?

The next step in using an opted-in list well is good segmentation and automation; we cover both in our posts on email list segmentation and email automation flows. If you want to set up your email and SMS channels together with the consent infrastructure, see our email and SMS marketing service.