The Personal Data Protection Authority (“Authority”) issued its Principle Decision dated June 10, 2025, numbered 2025/1072 (the “Decision”), which was published in the Official Gazette on June 26, 2025.
In the Decision, the Authority evaluated the practice—commonly used in practice—of processing personal data through the use of SMS verification codes, following various complaints submitted to the Authority.
The Authority determined that presenting the SMS verification code as a mandatory element of a transaction (such as for the completion of payment, invoice issuance, delivery of an invoice to a communication address, or updating of user information) may mislead data subjects. Accordingly, the Authority concluded that:
• Data subjects must be clearly informed about the purpose of the SMS verification code and the consequences of providing it;
• Practices whereby a single SMS verification code is used to obtain consent for multiple, distinct processing activities—such as approving a membership agreement, granting consent for the processing of personal data, and consenting to commercial electronic communications—must be discontinued. Where processing activities require explicit consent, data subjects must be presented with options and their explicit consent must be obtained separately for each category of data and each specific processing purpose;
• Any explicit consent obtained for data processing must meet the legal criteria set forth under Law No. 6698 on the Protection of Personal Data;
• Data controllers must avoid creating the impression that the provision of explicit consent for the processing of personal data for the purpose of sending commercial electronic messages is a prerequisite for receiving products or services. To this end, data controllers are required to implement the necessary administrative and technical safeguards, including regular personnel training and awareness programs.
Related persons
You can contact us for detailed information.
