Cookie Notices and KVKK: What Your Website Needs

The moment you add Google Analytics, a Meta Pixel or a live chat tool to your site, you're writing cookies to visitors' browsers. In Turkey, the core approach to how this should be done is set out in the cookie practices guide published by the Personal Data Protection Authority (KVKK).

What follows is a practical starting point based on that guide's general framework. It isn't legal advice. Since guidance and legislation can be updated, confirm the setup on your own site with a KVKK expert; if you work in sensitive areas such as health, finance or services for children, prepare your texts together with an expert.

What are cookies and what types exist?

A cookie is a small text file a site saves in the visitor's browser. Products staying in your cart as you change pages, staying logged into your account, an ad following you to other sites: all thanks to cookies.

From a KVKK perspective, the key distinction is what the cookie is for:

• Essential cookies: needed for the site's basic function. Cart, login, security and the cookie that remembers the user's cookie choice fall into this group.
• Functional cookies: personalize the experience, like language or region preferences.
• Analytics cookies: measure how visitors use the site. Google Analytics is the most common example.
• Advertising and targeting cookies: recognize and track visitors for ads, such as the Meta Pixel or a Google Ads tag.

There's also the first-party versus third-party distinction. A cookie set by your own domain is first-party; one set by another company like Google or Meta is third-party. Third-party cookies often mean data is transferred abroad, so they need extra attention.

The general framework under KVKK

The guide's core approach can be summarized like this: explicit consent is generally not required for essential cookies, but visitors must be informed about them. For non-essential cookies like analytics and advertising, the visitor's explicit consent is sought, and those cookies are expected not to run before consent is given.

This is a common problem we see in practice. A banner appears, but Google Analytics and the Meta Pixel load before the visitor clicks anything. In that case the banner is just decoration. In a technically correct setup, non-essential tags wait until the visitor consents.

Transferring data abroad is a separate topic. Most analytics and ad tools send data to servers outside Turkey. KVKK's rules on cross-border transfers have been amended; we recommend asking an expert what this means for your site and how to handle it in your privacy notice. We covered the general structure of a privacy notice for online stores in a separate post.

What to watch for in a consent banner

A well-built cookie banner gives visitors a real choice. In line with the guide's approach, pay attention to these points:

“Accept” and “Reject” should be on the same screen with equal visibility. If the accept button is big and colorful while rejecting is hidden as a small gray link, whether consent was freely given becomes questionable.

Checkboxes shouldn't be pre-ticked. The visitor should choose analytics or advertising cookies themselves.

Scrolling or continuing to browse shouldn't count as consent. The line “by continuing to use the site you accept cookies” was everywhere for years, but it doesn't fit the logic of explicit consent.

Visitors should be able to change their choice later. A “Cookie settings” link in the footer is the simplest way.

The banner should link to the detailed cookie policy. The banner itself doesn't need long text; two or three sentences and a link are enough.

You don't have to code all of this from scratch. There are ready-made consent management platforms (CMPs); some free, some paid. When choosing, check for Turkish interface support and whether it can block your tags based on consent.

Analytics and advertising cookies

The explicit consent approach has a practical consequence: some visitors will reject, and you won't be able to measure them. Numbers in your analytics reports will be lower than your real visitor count, and your ad platforms will miss some conversions.

You have to accept that. Trying to quietly measure visitors who declined creates legal risk and erodes trust in your site. Instead, tools like Google's Consent Mode can model missing data using cookieless signals for users who decline; test that it works correctly with your banner tool, and confirm its use with your adviser too. We covered GA4 setup and the effect of cookie consent on measurement in a separate post.

The cookie policy text

The cookie policy is a separate page explaining which cookies your site uses and why. It usually covers: who the data controller is and how to contact them, the types of cookies used and the purpose of each, how long cookies are stored, which companies third-party cookies belong to, how visitors can change their preferences and how they can exercise their rights under KVKK.

The biggest mistake is using a text copied from another site. A copied text describes cookies you don't have and skips the ones you do; copying someone else's text can also raise copyright issues. The right text starts from the list of cookies actually running on your site. You can get that from your browser's developer tools or with a cookie scanning tool.

When you add a new tool to your site, like a live chat plugin or a new ad pixel, update the cookie policy too. The policy should describe today's site, not the site on the day it was written.

For professions handling sensitive data, like psychologists or health consultants, it's even more delicate; even which page a visitor views can hint at their health. We covered site structure for these professions in a separate post.

This article is for general information only and is not a substitute for legal, financial or tax advice. For your own situation, consult a lawyer or a certified accountant.