INSIGHTS

In The Know.

July 2022 – On 20 June 2022, the Turkish Personal Data Protection Authority (the “Authority”) published guidelines (the “Guidelines”) on the use of cookies to collect personal data and the use of personal data on online environments such as websites, mobile applications, smartphones, and tablets (hereinafter referred as the “Website”).

Below we summarise the main issues covered in the Guidelines.

Types of cookies

Cookies are typically files that record information on users’ website visits generated by the Website during a user’s visit. The Guidelines classify cookies under three fundamental groups, as follows:

Rules for processing personal data through cookies

According to the Guidelines, data controllers need to consider the following rules when processing personal data using cookies:

1. Data controllers must have a legal basis for data processing. Accordingly:

1. If there is a legal basis to process personal data other than obtaining the explicit consent of data subjects, the implementation of cookies based on this legal basis is legally permissible.
2. If there is no legal basis other than obtaining the explicit consent of data subjects, cookies may only be implemented by obtaining the explicit consent of the data subject (i.e. Website user).

2. Data controllers need to consider Criterion A and Criterion B:

1. Criterion A: relates to the implementation of cookies solely for the purpose of providing communication over an electronic communication network.
2. Criterion B: relates to when the use of cookies is strictly necessary for information services (i.e. log-in, completing a form, ordering a product, etc.) that the user explicitly requests to receive.

Cookies that may be implemented without obtaining the explicit consent of data subjects

Data controllers need to classify cookies as Criterion A and B in order to implement cookies without obtaining the explicit consent of users. Accordingly, the Guidelines define such types of cookies as follows:

Cookies that may be implemented based on the explicit consent of data subjects 

Data controllers are required to obtain a user’s explicit consent for cookies (i) that may not be considered under the scope of Criterion A and B or (ii) will be implemented in a way that exceeds the scope of these criteria. In this context:

1. Social Plugin Tracking Cookies: Implemented for behavioural advertising, analytics, or market research purposes beyond the scope of Criterion B – explicit consent of the data subject is required.
2. Online Behavioural Advertising Cookies: Implemented for research and market analysis, advertising, financial record-keeping, fraud detection, product development, etc. – explicit consent of data subject

How do data controllers obtain valid explicit consent of data subjects?

According to the Guidelines, data controllers must comply with Turkish DP Law when implementing cookies based on the explicit consent of data subjects. Accordingly:

Data subjects’ explicit consent:

• must be obtained by taking their active affirmative will, not by using an opt-out mechanism;
• must be relevant to a specific issue, and the purpose of the cookie, its duration, and whether it is a first- or third-party cookie should be specified;
• needs to be periodically, but not constantly, requested, as frequent intervals may cause “consent fatigue” and may injure the free will of the data subject;
• must not be imposed as a condition to provide a service;
• must not be obtained by using cookie tools that prevent data subjects from accessing the Website’s contents.

User visits to a website do not constitute approval of explicit consent to run the cookies on the Website.

The cookie management tool needs to be located in a way that:

• data subjects may withdraw their explicit consent whenever they want, and
• preference options for the use of cookies are displayed to the user with equal font and size.

Cross-border data flows via cookies

The Guidelines also highlight cross-border data flows through the use of cookies. Accordingly, if a website operator transfers users’ personal data by implementing cookies abroad through companies or servers located outside of Turkey, such activity must comply with Turkish DP Law and the decisions of the Authority regulating cross-border data flows.

Obligation to inform in cookie Implementation

Data controllers must fulfil their obligation to inform data subjects about the processing of personal data via cookies regardless of whether the data processing activity is based on the explicit consent of the data subject or other legal bases. In this respect:

• in case of privacy notices on a Website that contain information on many subjects collectively, the obligation to inform shall not be considered fulfilled;
• failure to provide information (e.g., by showing pop-up messages) to a user at the first moment of the implementation of cookies constitutes a violation of the obligation to inform;
• the name, purpose, duration, and type of the cookie must be included in the information;
• in cases where third-party cookies are used, both the website owner and the third party are mutually responsible for providing information to the users or obtaining explicit consent in accordance with the law.

For more information please contact Ceren Ceyhan, Associate, at cceyhan@gentemizerozer.com, and Hatice Nur Arslan, Legal Intern, at narslan@gentemizerozer.com.