KVKK and E-Commerce in 2025: Cookies, Marketing, Data Transfers and Customer Data

KVKK compliance in e-commerce is not limited to registration forms or privacy notices. Checkout, SMS verification, marketing consent, cookies, CRM, customer service, marketplaces and SaaS services abroad are different parts of the same data flow.

The Board decisions and updated guidance published in 2025 called for renewed checks of consent design and cookie operations in particular.

1. SMS Verification and Marketing Consent

The Turkish Personal Data Protection Board’s principle decision of 10 June 2025, numbered 2025/1072 set out important rules for using SMS verification codes when providing products or services.

Combining a verification code sent for payment, registration or a similar service transaction with consent to marketing messages or other processing requiring explicit consent in a single action is risky.

2. Keep Service Transactions Separate from Marketing Consent

Marketing activity that requires explicit consent should not be cited as a mandatory requirement for receiving products or services.

The user should be able to clearly understand what processing he consents to.

3. Providing Privacy Information Is a Separate Obligation

The duty to inform applies independently of explicit consent.

Users must receive appropriate information about:

the data controller,
the purpose of processing,
transfer,
method of collection and legal cause,
data subject rights

Appropriate information must be provided on these matters.

4. Cookie and Tracking Technologies

The Turkish Personal Data Protection Authority’s 2025 guidance on cookies emphasises active opt-in and meaningful user choice for cookies that require consent.

It should also be technically tested whether Analytics or ad scripts work prior to consent.

5. E-Commerce Data Inventory

Inventory must cover the following systems:

website and mobile application,
payment infrastructure,
CRM,
e-mail/SMS systems,
marketplace integrations,
delivery services,
analytics and advertising technologies,
customer service.

6. Data Minimization at Checkout

Personal data that is not genuinely needed for an order should not be requested in mandatory fields.

7. Mandatory Account Registration

Depending on the business model, the option to check out as a guest and the additional data collected for registration can also be reviewed for data minimisation.

8. SaaS and Cloud Providers Abroad

The presence of a CRM, analytics or marketing automation provider abroad should also be evaluated in terms of personal data transfer.

Transfer mechanisms in Article 9 of the KVKK must be paired with the actual data stream.

9. Marketplace Integrations

Roles and purposes must be identified in data flows between the marketplace, seller, delivery service and integration provider.

10. Data Retention

Keeping order data to meet accounting or legal obligations does not provide the same justification for retaining a marketing profile indefinitely.

E-Commerce KVKK Checklist

Are SMS verification and marketing consent kept separate?
Are privacy information and explicit consent kept separate?
Does Cookie opt-in technically work?
Have checkout fields been reduced to the necessary data?
Are CRM data flows included in the inventory?
Have overseas SaaS providers been evaluated?
Are marketplace integrations documented?
Is the retention period defined?

The B10 Approach

B10 Digital Agency goes beyond checking forms and documents to assess e-commerce KVKK compliance technically across checkout, CMP, CRM, API and SaaS data flows.

Official Sources

Conclusion

Data protection compliance in e-commerce requires understanding how the full data flow actually works, from checkout to CRM and from marketing to integrations.

This content is for general information only.