Municipal SMS and Email Messages: Public Service or a KVKK Breach?

⏱️ Reading time: 14 min · 📁 Category: KVKK, Electronic Communications & Public Institutions

Municipal SMS and Email Messages: Public Service or a KVKK Breach?

Metropolitan and district municipalities send SMS and emails for many purposes: announcements, disaster alerts, water outages, payment reminders,
event invitations, satisfaction surveys and campaign announcements.
However, the most common problem encountered in practice is:
promotional or marketing communication presented as information.

In municipal KVKK compliance, common mistakes in communication include
choosing the wrong legal basis and poorly designed consent management.
This article explains the boundary between public service communication and promotional communication
in detail.

Short rule:
Information necessary to deliver a service ≠ promotional or marketing communication
When this distinction is not made, even "good-faith" SMS can become a violation of the KVKK. 1) First, a definition: what does municipal information mean?

Municipal information is communication that is
necessary for citizens’ safety, service continuity and administrative procedures. Its purpose is not to encourage users to buy or participate;
it fulfils a public service requirement.

Examples of information (often evaluated under public service)

• Water outages, roadworks, changes to public transport routes
• Disaster, emergency, meteorological warnings, evacuation announcements
• Tax, levy and fee payment reminders (mandatory transaction-related notices)
• Appointment confirmations, application status updates, notices of missing documents
• Complaint or request updates: received and resolved

Practical test:
If the citizen does not receive this message, will public service be disrupted?
If so, this supports classification as information. 2) What does municipal promotion mean?

Promotion means communication intended to increase participation in municipal events, shape perceptions, raise visibility or
generate engagement around the municipal brand.
Such communications are often packaged like "service announcement" but the content structure is promotional.

Examples of promotional or marketing communication

• Festival/concert/event invitations (SMS/email to the general audience)
• Presenting municipal services as success stories
• Regular content distribution through newsletters or subscriptions
• PR and persuasive messages presented as satisfaction surveys
• Municipal subsidiary campaigns (discounts and social facility promotions)

Clear boundary:
If communication is not a necessary part of the service, it risks being classified as promotion. 3) Legal basis map: which basis applies to each message?

The most common municipal electronic communication mistake is
relying on explicit consent for everything, or conversely treating consent-based promotion as a public duty.
The correct approach is to determine the type of message and choose the legal reason accordingly.

A) Information messages (usually without a consent requirement)

• Statutory obligations or performance of a public duty : mandatory notices linked to the relevant procedures
• Establishment, exercise or protection of a right : application procedures, objections and formal notices
• Practical impossibility and protection of life or physical integrity : related emergency information

B) Promotion messages (the area requiring consent in most scenarios)

• Event/organization invitations
• Municipal subsidiary and social facility campaigns
• Continuous newsletter/subscription content
• General PR/perception communications

Golden rule:
Showing promotional content as "public service information" is the most risky illusion in terms of KVKK. 4) Distinguishing information from promotion: a practical decision test

A 5-question test is recommended for a safe classification in municipalities:

• Necessity: Is the message necessary to deliver the service?
• Target audience: Only the people concerned, or a broad audience?
• Content language: Neutral information, or persuasive/PR language?
• Frequency: Triggered by an event, or regular/repeated sending?
• Who benefits? The citizen’s rights or transaction, or the institution’s visibility?

Test result:
Broad audience + persuasive language + repeated sending → strongly suggests a promotional purpose. 5) Common mistakes: the path to municipal breaches 1) One shared contact list for different purposes

The key mistake is pooling citizens’ contact details in one list and
allowing every department to use it for different purposes.
This leads to use beyond the original purpose, such as sending an event invitation
to a number collected for a social assistance application.

2) Mandatory promotional consent checkboxes on application forms

A service application may require contact details; however, this
does not justify making promotional consent mandatory.
Such consent no longer meets the requirement of freely given consent.

3) Using satisfaction surveys as a cover

Satisfaction surveys may in some cases be legitimate for quality of service;
but if the accompanying message contains PR or promotion, or data is transferred to third parties,
the risk increases. Surveys must also be limited by purpose, scope and frequency.

4) Sending municipal subsidiary campaigns from municipal contact lists

Sending discount or campaign messages from municipal subsidiaries using the municipality’s own lists
creates both purpose limitation issues and confusion over data controller roles.
Municipal and subsidiary communications must be considered on separate legal grounds.

5) No consent withdrawal or opt-out mechanism

If promotional communications offer no easy way for citizens to opt out,
breach risk increases. Practices that make withdrawal difficult, such as requiring a visit to the municipality,
become indefensible from a consent management perspective.

Risk-enhancing element:
Stating that consent exists is not enough; the right to withdraw it must work in practice. 6) How compliant municipalities organise communication: an operational model A) Message type catalogue (messaging taxonomy)

• Information (required) - transaction based
• Emergency (high priority)
• Service announcement (limited to the person concerned)
• Promotion / event / newsletter (opt-in)

B) Purpose-Based List Management

• Purpose-based lists instead of single pools
• Separate lists for social assistance, payments, applications and newsletters
• Role-based access permissions

C) Demonstrability: records, logs and audit trails

• Message templates are versioned
• The reason for sending and the legal basis are recorded
• Opt-out records are stored

Inspection standard:
To whom was this message sent, on what legal basis, for what purpose and on what date? You should be able to answer this question in a single file. 7) Frequently asked questions: internal clarification Does an event invitation count as a public service?

If the event is not necessary to deliver the service and the invitation reaches a broad audience,
its promotional character becomes stronger. Consent management is critical here.

Does a payment reminder require consent?

If it is a necessary notice for the relevant transaction (debt, levy or fee),
it falls into the information category. Promotional wording, however, increases risk.

Is a citizen’s earlier provision of contact details to the municipality enough for promotion?

No. Providing information does not authorise its use for every purpose.
Principles of purpose limitation and transparency apply.

Conclusion

Municipal SMS and email communication is one of the areas with the most KVKK breaches,
because the boundary between information and promotion is repeatedly crossed in practice.
The correct compliance approach is to clarify message types, organise lists by purpose
and make consent management demonstrable for promotional communication.

Communication (SMS/E-mail) KVKK Compliance Analysis