SMS Verification Codes and the Personal Data Protection Board's Guideline Decision No. 2025/1072 18 August 2025

1. The Current State of the SMS Verification System and Legal Issues
 

Complaints received by the Authority reveal a core issue: during the provision of products and services, data controllers request SMS verification codes on the stated grounds of finalizing payment or for the issuance of an invoice, yet use those codes to obtain explicit consent to send commercial electronic messages. This practice violates the fundamental principles of the Law on the Protection of Personal Data No. 6698.

The principle of explicit consent, as described in Article 3 of the Law, has three key elements:
 

• Relating to a specific subject matter
• Be based on prior information
• and be expressed through free will
   

Under current practices, data subjects are misled as to the object of their consent; consequently, the consent cannot be regarded as "informed." Moreover, when access to a product or service is conditioned on agreeing to receive commercial electronic messages, the requirement that consent be "freely given" is not satisfied.
 

As emphasized by the Personal Data Protection Board (Decision No. 2020/173, dated 27 February 2020), when explicit consent is made a precondition for the supply of a product or service, the element of free will is compromised and valid explicit consent cannot be said to exist. This jurisprudence likewise serves as one of the principal foundations of the Board's Guideline Decision.
 

2. Regulations Introduced by the Guideline Decision
 

The Board's Guideline Decision imposes clear, actionable obligations on data controllers. First, pursuant to the principle of layered information, the purpose of the SMS verification code and the legal consequences of providing it must be clearly and intelligibly communicated to the data subject. This information must be delivered both orally by the controller's personnel and in writing within the content of the SMS.
 

Second, the use of a single verification code to perform more than one legal act is prohibited. Separate mechanisms must be implemented for transactions that entail distinct legal consequences-such as approval of a membership agreement, procurement of explicit consent for the processing of personal data, and authorization for the transmission of commercial electronic messages-and explicit consent must be obtained separately for each.
 

Third, obtaining explicit consent for the sending of commercial electronic messages cannot be presented as a mandatory condition for the provision of products or services. As expressly stated in the Decision, data subjects must be clearly informed that permission for commercial communications is not a precondition for completing the transaction, and that the transaction can still be finalized even if no SMS verification code is provided for that purpose.
 

Fourth and final provision: data controllers are required to conduct periodic training and awareness-raising activities for the personnel involved in these processes. This requirement is regarded as part of the administrative measures on data security set out in Article 12 of the Law.

3. The Relationship Between the Obligation to Inform and Explicit Consent
 

Under Article 10 of the Law, the obligation to inform must be fulfilled at the time personal data are obtained by the data controller or a person authorized by it. This obligation must be discharged independently of the collection of explicit consent. As expressly emphasized in the Guideline Decision, the obligation to inform and the act of obtaining explicit consent must be carried out separately.

As set out in the Communiqué on the Procedures and Principles to be Complied with in Fulfilling the Obligation to Inform, information notices must be clear, intelligible, and accessible. Because it is not technically feasible to include the entire notice within SMS content, layered information method should be adopted. The first layer should provide the essential information, and data subjects should be directed to online platforms for the full notice.
 

4. Legal Penalties and the Liability Regime
 

Upon non-compliance with the Guideline Decision, administrative fines shall be imposed pursuant to Article 18 of the Law. For 2025, the ranges are TRY 68,083-1,362,021 for violations of the obligation to inform, and TRY 204,285-13,620,402 for processing personal data without the data subject's explicit consent (3).
 

The unlawful processing of personal data may also constitute a violation of personal rights. Under Article 58 of the Turkish Code of Obligations, individuals whose personality rights have been violated may seek compensation for intangible damages.
 

This approach is clearly reflected in the Court of Cassation's case law. For example, in one judgment, a mobile line was established in the plaintiff's name by using the plaintiff's identification details without the plaintiff's knowledge or consent, and by forging the plaintiff's signature. When the bills went unpaid, execution proceedings were started against the plaintiff, who was compelled to file a negative declaratory action. The Court of Cassation established that the telecommunications company had failed to exercise due diligence in selecting and effectively supervising its branch/vendor, and that this lapse of diligence violated the plaintiff's personality rights; on that basis, it upheld the claim for non-pecuniary damages (4th Civil Chamber of the Court of Cassation, E. 2019/979, K. 2019/2679). (4)
 

Furthermore, the Board has the authority to order the suspension of data processing activities. In cases of repeated or systematic violations, that authority may be exercised to suspend in full specific processing operations undertaken by the data controller. Such measures entail significant operational risks, particularly for business models reliant on customer data.
 

5. Measures Required for Compliance

Data controllers should undertake a comprehensive transformation process to achieve compliance with the Guideline Decision. At the technical infrastructure level, separate authorization mechanisms should be established for distinct purposes. SMS delivery systems should be reconfigured to generate customized content for each type of transaction. In particular, messages seeking consent for the sending of commercial electronic messages must clearly state that such consent is optional.
 

From an operational standpoint, all procedures across customer touchpoints should be reassessed. Detailed operating procedures should be prepared for sales personnel, call-center agents, and digital channel managers. These operating procedures must set out what information must be provided in each scenario, the exact wording to be used, and which behaviors are to be avoided.
 

From a legal compliance perspective, the status of existing customer databases must be reviewed. Consents obtained through defective methods lack legal validity; processing predicated upon them must be discontinued immediately. Where necessary, fresh explicit consent should be obtained from customers using procedures compliant with the Law's requirements.
 

At the corporate governance level, data-protection compliance programs must be developed. These programs should include periodic internal audits, risk assessments, and remediation plans. Active involvement by senior management and the allocation of necessary resources are essential to ensuring effectiveness.
 

6. Conclusion and Assessment
 

The Personal Data Protection Board's Guideline Decision No. 2025/1072 emphasizes the principles of transparency and fairness of data-processing activities conducted via SMS verification codes. This decision marks a significant step in Turkey's alignment with the European Union acquis on personal data protection.

For data controllers, while this decision may entail short-term operational challenges and additional costs, it offers significant long-term opportunities to build customer trust and to develop sustainable business models. Businesses that adopt a proactive approach to personal data protection will gain a competitive advantage and position themselves as trusted actors in the digital economy.

Upon its publication in the Official Gazette on 26 June 2025, the Guideline Decision entered into force and the compliance process for data controllers began. The Board's omission of any transitional period is predicated on the view that these practices were already contrary to law. Therefore, data controllers must immediately take the necessary measures and complete their compliance efforts.
 

In conclusion, the Guideline Decision constitutes a turning point for promoting data responsibility and institutionalizing an ethical culture of data processing. Recognizing that the future of the data economy rests on trust, compliance with this framework constitutes not only a legal obligation but also an essential condition for sustainable growth.

References

(1) Personal Data Protection Board (KVKK), Decision No. 2020/173, dated 27 February 2020.
(2) Communiqué on the Principles and Procedures to be Followed in Fulfilling the Obligation to Inform, Official Gazette No. 30356, 10 March 2018.
(3) Personal Data Protection Board, Principle Decision dated 10 June 2025, No. 2025/1072, Official Gazette No. 32938, 26 June 2025.
(4) Court of Cassation (Yargıtay), 4th Civil Chamber, E. 2019/979, K. 2019/2679.