Targeted Advertising Beyond Performance Marketing: What KVKK and the Advertising Board Require

Updated: 3 September 2026 · Category: KVKK and Digital Compliance

Targeted Advertising Beyond Performance Marketing: What KVKK and the Advertising Board Require

Targeted advertising is now more than media optimization. The 1 August 2026 rules require clear, understandable and accessible information on the criteria used to show an ad and how to change them; the personal data layer is separately governed by KVKK.

Contents

Short answer
Why does it matter?
What should companies do?
How to measure it?
Sources
Frequently asked questions

Short Answer

Why Does It Matter?

Targeted advertising has two distinct legal layers. Since 1 August 2026, advertising law requires direct, easily accessible information on the criteria used to show ads to consumers and how to change them. Targeting children through profiling based on personal data is prohibited.

KVKK separately requires assessment of the source, purpose, legal basis, sharing and retention of personal data used to create a segment. Explaining why a user sees an ad does not, by itself, establish that the data processing is lawful. Both checks must be combined for the same campaign.

What Should Companies Do? Review the Targeting Chain End to End

Identify the data source and responsible owner for every segment.
Distinguish CRM, web behavior, lookalike and third-party segments.
Test the explanation shown to users about why they see the ad.
Make the route for changing targeting criteria visible to users.
Technically block targeting of children based on profiling.
Watch if automated optimization of the platform produces new and out of control segments.
Link segment version, campaign ID and the basis for the data in the audit record.

Proposed Measurement Model for B10

Layer	KPI	Risk
Source	Segment provenance coverage	Unknown data source
Transparency	Targeting explanation coverage	Undisclosed criterion
Control	User-control path availability	Preference the user cannot change
Child	Detection of prohibited child profiling	Every hit is critical
Automation	Auto-expansion monitoring	Audience outside defined controls
KVKK	Legal-basis mapping coverage	Data use that does not match its purpose

Recheck automatic audience expansion and algorithmic optimization periodically: they can reach audiences not defined in the original campaign brief.

Expert Assessment

A common blind spot is mistaking a platform segment name for a data source. “High intent audience” and “lookalike 3%” are segment names, not explanations of the data signals used to create those audiences. Trace actual data lineage from the CRM to the platform.

How Should Audience Lineage Be Recorded?

An audience record needs its creation chain as well as its name. For “people who viewed products in the last 30 days”, record the originating web analytics event, the cookie or user identifier, the transfer mechanism to the platform and retention in days. For CRM-based segments, also identify the customer list’s source and purpose of use in the campaign.

The initial seed audience matters for lookalike and similar model-based audiences. Even if the platform uses its own model to reach new users, the source of the seed audience feeding that model must remain visible in company data governance. Enabling automatic expansion later may also be treated as creating a new audience version for the campaign.

Test the Transparency Screen

A platform’s theoretical ability to explain ad targeting is insufficient operational control on its own. Brand teams can use test users to verify periodically that journeys such as “Why am I seeing this ad?” are genuinely accessible. Sample checks should also compare the displayed criteria with the campaign configuration.

Check Data Flows When Disabling a Segment

Disabling an audience on an ad platform may not end the source data flow. Web events, CRM synchronization and server-side integrations may continue. Distinguish creation, active use, suspension and deletion in the segment life cycle, and include integration status in closure checks.

Exclusion Rules Must Also Be Documented

Suppression and exclusion lists are part of audience governance. If a user must be excluded from certain campaigns, measure how long that preference takes to propagate across the CRM, CDP and ad platforms. Verifying that people who should no longer be targeted are actually removed is as important as creating audiences.

Audience records can therefore include exclusion criteria, update frequency and last synchronization time as well as inclusion criteria. This helps detect source changes that have not reached the ad platform and prevents teams from relying solely on its displayed user count.

Digital Risk and Compliance Analysis

B10 can link ad-platform audiences to CRM and web data sources, showing segment provenance, targeting transparency and child-profiling risks in one matrix.