Is a KVKK Consent Checkbox Required on a Contact Form? Notice vs. Explicit Consent

On a contact form that collects a name, phone number and email only to answer the enquiry, an explicit consent checkbox is generally not required under KVKK (Türkiye's data protection law). What is required is a privacy notice next to the form telling visitors why and how their data will be processed. Explicit consent is needed only when no other legal basis applies: sending marketing messages, collecting special categories of data such as health information, or certain cross-border transfers. Merging notice and consent into a single 'I have read and agree' box is the most common mistake.

This article is general information, not legal advice. If you work in health, finance or services aimed at children, show your form to a KVKK specialist or a lawyer.

Two separate obligations: notice and explicit consent

The confusion comes from thinking these are the same thing.

Notice is information. Whoever collects the data tells the visitor who they are, why they'll process it, who they may share it with, which legal basis applies and what the visitor's rights are. This is the obligation in Article 10 of KVKK and it always applies when data is collected. The visitor doesn't have to agree; being informed is enough.

Explicit consent is an approval. Permission about a specific matter, based on information and given freely. Under KVKK, explicit consent is just one of the conditions for processing data. If another condition applies, such as forming a contract, a legal obligation or legitimate interest, consent isn't needed.

Which legal basis applies to a contact form?

If a visitor fills in the form to ask you for a quote or information, you use their data to answer that request. In most cases that rests on the condition of being directly related to forming a contract, or on legitimate interest. The visitor is giving you this information precisely because they want to reach you.

So on a form that only serves to answer enquiries, a consent checkbox is unnecessary. What's more, the Authority's guidance points out that asking for consent when another legal basis exists can mislead people. The visitor assumes their request won't be handled without consent, when in fact withdrawing it would change nothing.

The most common mistake: two jobs in one box

This wording appears on thousands of sites: 'I have read the privacy notice and give explicit consent to the processing of my personal data.' The problems:

• Notice and consent are merged into one box. The Authority's rules require them to be handled separately.
• The form can't be sent without ticking the box. Consent has become a precondition for service, which makes it questionable whether it was given freely.
• The consent rests on a general statement that doesn't say which processing it covers.

A simpler, correct structure:

• A short sentence right above or below the submit button: 'Your details are used only to answer your request. See the privacy notice for details.' The link in the sentence goes to the notice.
• If explicit consent really is needed (see below), a separate box for it that isn't pre-ticked and isn't required to submit the form.

Some businesses add a separate 'I have read the privacy notice' box to prove they gave notice. That isn't consent and causes no problem on its own, but it isn't required either. What matters is that the link is clearly visible.

When explicit consent really is needed

The box comes into play in these cases:

• Marketing and newsletters. If you want to send the visitor campaigns, newsletters or promotional messages, you need a separate approval. That approval is also commercial electronic message consent under Law No. 6563 and may need to be registered in the Message Management System (İYS). The box must not be pre-ticked or made a condition of submitting the form.
• Special categories of data. Health information (for example symptoms or conditions on a clinic form), religion, ethnic origin and similar data are subject to stricter rules. If you ask for such information on a form, get expert advice; often it's best not to ask for it on the form at all.
• Transfers abroad. If your form data is processed on a form service or server outside Türkiye, the cross-border transfer rules amended in 2024 come into play. Since the amendment, explicit consent has become an exceptional route here, and tools like standard contracts have taken the lead. List the services you use and consult a specialist.

What should the privacy notice contain?

You don't have to write a separate text for the form; your site's general privacy notice can cover it. What matters is that the notice answers these questions for the data collected by the form:

• Who is the data controller? The business's legal name and contact details.
• Which data is collected? Name, email, phone, message.
• For what purpose? Answering the request, preparing a quote.
• On what legal basis?
• Who may receive it? Service providers such as the email service and hosting company.
• How long is it kept? For example, a set period after the request.
• The visitor's rights and how to exercise them.

Cookies and analytics tools have their own rules; we cover them in cookie notices and KVKK, and texts specific to online stores in KVKK for e-commerce sites. If you'd like to see an example, have a look at our own privacy notice.

What to watch on the form itself

One of KVKK's core principles is data minimisation: collect only as much as the purpose needs. In practice:

• Don't ask for a national ID number, date of birth or full address just to answer an enquiry.
• Limit required fields to what is genuinely required. A name and one contact channel are usually enough.
• Don't keep form messages forever. Set up a routine that deletes them after a defined period.
• The tools you use against spam also process data. reCAPTCHA, for example, sends visitor data to Google and must be mentioned in the privacy notice; we weigh up alternatives in stopping contact form spam.

A form with fewer fields is safer under KVKK and brings in more enquiries too; we show examples in contact form design. If you'd like to check together that your form and legal texts are in the right place on your site, write to us.