Is Email Marketing Lawful Under KVKK?

⏱️ Reading time: 10 min · 📁 Category: KVKK & Digital Compliance

KVKK-compliant unsubscribe and logging guide: Practical email marketing examples

Two of the most frequently penalized topics in email marketing under the KVKK are:
(1) a missing unsubscribe mechanism and
(2) inability to prove consent and activity records (logs).

The Board’s approach, in brief: “Obtaining consent is not enough; you must prove it.” 1️⃣ What is unsubscribing and why is it required?

Unsubscribing allows a person to stop marketing emails easily, quickly and free of charge.
This matters under KVKK because explicit consent must be withdrawable, fundamental rights must be protected, and
marketing communications must be proportionate.

❌ Without an unsubscribe mechanism, marketing communications are very likely to be unlawfully configured. 2️⃣ What is a KVKK-compliant Unsubscribe?

Minimum criteria for a KVKK compliant unsubscribe mechanism:

• Must be included in every email
• One click must suffice
• Should not request login/password
• Must not be paid
• It should not be delayed (the "immediate" logic for marketing)

3️⃣ Correct Unsubscribe Examples (Accepted in Practice) ✅ Example 1: One-click link (safest)

Example email footer text:

"If you don't want to receive these emails, click to unsubscribe."

When clicking on the link, the user is shown the message "Your request has been received" and the user is instantly disabled.
This method is in practice the safest and most easily defensible method in auditing.

✅ Example 2: Preference Center (Advanced System)

The user can choose which type of messages they do not want to receive:

• Campaign emails ❌
• Newsletter ❌
• System notifications ✔️ (required/operational)

The preference center is the ideal solution for KVKK + user experience; it also reinforces the principle of "limitation to purpose" and "control".

❌ Incorrect Unsubscribe Examples (Risk of Penalties)

• “Email us and we will unsubscribe you”
• "Call the Call Center"
• “You cannot unsubscribe without logging in”
• Link exists but does not work / gives error

4️⃣ What should happen after an unsubscribe request?

In marketing communication, the "We have 30 days" approach leads to incorrect interpretations.
When an unsubscribe request arrives, marketing lists must be updated to ensure an immediate stop.

Practical rule: Unsubscribe request → immediate deactivation + log entry + synchronisation across other systems. 5️⃣ What is logging? (KVKK definition)

Logging means recording steps such as obtaining consent, sending emails and unsubscribing
in a way that can be used as evidence.
The goal is not to say "done" in audit, but to show.

6️⃣ How should KVKK-compliant logging work?

The minimum log set is mandatory for a defensible structure in the audit:

🔹 1) Explicit consent log

• Email address
• Date & time of consent
• Consent channel (web form, app, in-store tablet, call centre, etc.)
• IP address (if possible)
• Consent wording version (v1/v2, with date)

🔹 2) Email sending log

• Email type (campaign/newsletter/announcement)
• Sending date and time
• Sending system (CRM, ESP, mail server, etc.)
• Message/template ID (template ID)

🔹 3) Unsubscribe log (critical)

• Unsubscribe request date & time
• Request method (one click link / preference center / support request etc.)
• System/user (system actor) that performs the operation
• Date and time the request was implemented
• Status (active/inactive) and category preferences, if any

⚠️ Critical: If there is no unsubscribe log, the defense that "we have removed from the subscription" remains weak in control. 7️⃣ Sample Log Table (Simple and Auditable)

Field	Example
Email	[email protected]
Consent date	12.03.2025 – 14:22
Consent channel	Web Form
IP	78.xxx.xxx
Consent wording version	Consent-v2 (01.01.2026)
Last sending date	01.02.2026
Unsubscribe date	05.02.2026 – 10:11
Status	Passive

📌 Audit advantage: Because this table shows the consent, sending and unsubscribe chain on one screen,
it serves as strong evidence on its own in most audits. 8️⃣ Why is Unsubscribe + Logging Important Together?

The basic questions asked in the board audit are usually:

• Any consent?
• When was consent taken and what channel?
• Has consent been withdrawn?
• When did the request for unsubscribe arrive and when was it implemented?

Statements such as “it was in the system” or “we do not remember” weaken the defence because they provide no evidence.

9️⃣ The Most Common Critical Mistakes

• Unsubscribe exists but no log
• Log exists but no date/time
• Consent wording version is not retained
• E-mail continues to go to user who unsubscribes (sync error)<