Newsletter Consent Compliance: Subscriptions Set Up Right

A newsletter looks like the simplest marketing channel there is: a signup box, an email tool and a schedule. For anyone sending to readers in Turkey, though, it sits at the meeting point of three bodies of rules. Turkey's e-commerce law and its regulation on commercial electronic messages decide when a promotional email may be sent at all. The Personal Data Protection Law, known by its Turkish abbreviation KVKK, decides how the subscriber's address and signup records may be handled. And your own build decisions, such as the form, the log, the unsubscribe link and the vendor you pick, determine whether either set of rules is met in practice.

This guide is written for marketers, newsletter owners and agency staff, including foreign teams who send to Turkish audiences and need a plain-language map. It follows one subscriber from the signup screen to the unsubscribe request, citing the relevant Turkish article numbers along the way, and then looks briefly at the European and American frameworks that foreign teams often compare against. Where a point is a design suggestion rather than a legal requirement, the text says so. Examples are fictional, involve no real company and carry no figures.

Not legal advice: This guide is general information only. Laws and regulations change, and Turkish and foreign rules differ in ways that matter. Check the current legal text and the competent authority's guidance before you rely on anything here, and consult a lawyer or a data protection specialist for disputes, penalty exposure or complicated data flows.

What Counts as a Commercial Electronic Message in Turkey

Before anything about consent, you need to know whether your newsletter is the kind of message the rules target. The regulation answers this with a definition and a purpose test, and both are broader than many senders expect.

The regulation on commercial communication and commercial electronic messages defines a commercial electronic message as data, voice or image content sent for commercial purposes in an electronic environment, using tools such as telephone, call centres, fax, automatic dialling machines, email and text messages. Its fifth article then lists the purposes that trigger the prior-consent rule: promoting goods and services, marketing, promoting the business, and increasing recognition through content such as greetings and good wishes. You can read the primary texts in the Turkish e-commerce law, number 6563 (Opens in a new tab) and the Regulation on Commercial Communication and Commercial Electronic Messages (Opens in a new tab).

Two practical consequences follow. First, a newsletter that is "just content" can still count if its purpose includes promoting your business or raising your profile. Treat a newsletter with product links, campaign banners or sponsor slots as inside the rules unless a lawyer advises otherwise. Second, the rules cover the sender's own messages and messages sent on behalf of others, which matters if you run a publication that carries advertisers.

The same texts carve out a few situations that do not need separate consent. If a customer gives contact details so that you can reach them, notices about changes, use and maintenance of the goods or services they obtained fall outside the consent requirement. Messages about an ongoing subscription or membership, collections, debt reminders, information updates, purchase and delivery notices, and statutory information duties are also outside the consent requirement, but the regulation adds that such notices may not encourage or advertise any goods or services. In other words, a receipt with a discount banner stops being a neutral transactional message. Messages to tradespeople and merchants may be sent without prior consent, though the regulation says that once such a recipient exercises the right to refuse, messages may no longer be sent.

Consent Before Sending: The Core Turkish Rules

The central rule is short. Article 6 of the law states that commercial electronic messages may be sent to recipients only if their prior approval has been obtained, and that the approval can be obtained in writing or through any electronic communication means. Everything else in this section explains what that approval has to look like.

What a valid approval must contain

Article 7 of the regulation says that, outside the national message management system, the approval contains the recipient's positive statement of will, their first and last name and their electronic address. If the approval is collected through the system itself, the positive statement and the address are enough. A paper approval needs a signature. The article also draws three firm lines: the positive statement may not be pre-selected, the provider may not make consent a precondition for supplying its goods or services, and a message may not be sent to someone's address in order to ask for their approval.

Approval embedded in a contract

When consent is built into a subscription, sale or membership contract, Article 7 sets a presentation rule: the approval comes at the end of the contract, before the positive statement or signature, under the side heading "commercial electronic message", written in at least twelve-point type, with the option to refuse offered. A sentence tucked into general terms would not meet that description.

The message management system

Article 11 of the law lets the Ministry of Trade set up an electronic system for collecting approvals and for exercising the right to refuse. The Ministry's page on the message management system, known as IYS (Opens in a new tab), describes it as a single place where approvals are gathered and where citizens can see and control the approvals they have given and use their right to refuse. Under Article 5 of the regulation, anyone who wants to send commercial electronic messages registers with the system, and messages cannot be sent to recipients who have no approval recorded there. Article 7 adds that approvals taken outside the system must be recorded in it by the service provider within three business days, and that approvals not recorded are treated as invalid. The practical meaning is that a checkbox on your own form is the first half of the job. The second half is getting that record into the national system on time.

Burden of proof

For approvals not obtained through the system, the regulation places the burden of proving that approval was given on the service provider. Article 13 repeats the point for complaints: the provider and, where relevant, the intermediary provider carries the burden of proof. This is why the record you keep matters as much as the box people tick.

Where KVKK Fits: Notice, Explicit Consent and Your Subscriber Data

The messaging rules decide whether you may send. KVKK decides how you may collect and handle the data that makes sending possible. The two work side by side, and confusing them is the most common design error.

The notice duty

Article 10 of the Personal Data Protection Law, number 6698 (Opens in a new tab) requires the data controller, at the time data are collected, to tell the person who the controller is, for what purpose the data will be processed, to whom and why they may be transferred, the method and legal basis of collection, and the other rights listed in Article 11. The Authority's page on the duty to inform (Opens in a new tab) lists the same five items and adds that the duty continues even where processing rests on explicit consent. In a newsletter, that means a short notice near the form, linked to a fuller text.

Explicit consent as a separate concept

Article 3 of KVKK defines explicit consent as consent relating to a specific subject, based on information and expressed with free will. The Authority's page on points to consider when obtaining explicit consent (Opens in a new tab) says that general, blanket consent not tied to a particular matter is considered legally invalid, that the burden of proof lies with the controller, and that a person may withdraw consent at any time. The commercial message approval comes from the e-commerce law, whereas explicit consent is a KVKK concept; they overlap in practice but are not interchangeable. Whether your newsletter needs both, and on what legal ground each processing step rests, is a question for your lawyer.

Minimisation and retention

Article 4 lists the principles of processing, including that data must be relevant, limited and proportionate to the purposes for which they are processed and kept only as long as the law requires or the purpose demands. For a newsletter, the working summary is this: ask for the address, add a name only if your approval route needs it, and avoid optional fields without a stated purpose. Article 7 requires deletion, destruction or anonymisation when the reasons for processing disappear, either on the controller's own motion or on the data subject's request, while preserving provisions of other laws.

Rights requests

Article 11 gives people the right to learn whether their data are processed, to ask for correction and deletion, and to know to whom data were transferred. Article 13 requires the controller to conclude requests as soon as possible and at the latest within thirty days, free of charge, subject to a possible fee where the Authority's tariff applies. Build a simple inbox or form for these requests before you need it.

Building the Signup Journey, Screen by Screen

With the rules in view, the signup flow becomes a series of small decisions. The sequence below is a design suggestion that reflects those rules; it is not a prescribed form.

Screen one: the form

Offer an email field, an unticked checkbox, a short sentence naming the channel and the kind of content, and a link to the privacy notice. A fictional example of acceptable wording is "I agree to receive campaign and new-article announcements from this publication by email." A sentence that covers "all our group companies and partners" is not specific and invites trouble. Do not tie the checkbox to a download, an account or a purchase.

Screen two: the confirmation step

Double opt-in, meaning a verification link sent to the address after the form is filled in, is not mentioned as a requirement in the Turkish law or regulation. It is nonetheless a sound control, because it shows the address belongs to the person who signed up and it separates two timestamps in your record. The tension is Article 7's ban on sending a commercial message to ask for approval. A verification email that the user triggered themselves and that contains only the verification link and nothing promotional is the safer design. Whether it escapes the commercial label is an interpretation; show your flow to a specialist rather than assuming.

Screen three: the acknowledgement

When approval is taken electronically outside the national system, Article 7 requires that the fact of approval be communicated to the recipient's address within twenty-four hours, with the opportunity to refuse. Build this acknowledgement into the same automation that creates the consent record. It also gives the subscriber a first look at the unsubscribe mechanism.

Behind the screens: what to log

A record that can answer a complaint typically shows the address, the date and time, the version and URL of the form, the exact wording displayed and the channel consented to. This list is a practice suggestion, not a legal template. The European Data Protection Board's consent guidelines, discussed below, make a related point: keeping a record of the consent statements and the workflow in use matters, but the controller should not collect more data than necessary just to prove consent.

Forms that are not newsletters

Checkout and registration forms need extra care. A pre-ticked "send me offers" box on a checkout page fails the pre-selection rule, and refusing to complete a purchase unless the box is ticked fails the precondition rule. Tracking pixels and link parameters in the newsletter itself can generate personal data too; website-side tracking and cookie banners are a separate topic, covered with their measurement effects in cookie consent, privacy and measurement loss.

Writing Every Message: Identity, Labels and the Opt-Out Link

Once a subscriber is on the list, each issue carries its own checklist. Article 8 of the regulation covers identification and labelling, and Article 9 covers the right to refuse.

Who is writing

The header or body of the message names the sender: for merchants, the registry number from the central registry system known as MERSS and the trade name; for tradespeople, first and last name with the national ID or tax number. A brand or business name may be added. In addition, at least one reachable contact detail appropriate to the medium, such as an email address or phone number, appears in the message. A permanent footer block handles all of this.

What kind of message it is

If the commercial nature of the message is not clear from its content, a label such as promotion, campaign or information must be included, and for email it goes in the subject line. Promotions such as discounts or gifts, and prize draws or games run for promotional purposes, must be identified as such, and their validity period and conditions must be presented clearly through an easily reachable method, such as a dedicated web address or a customer service number.

The opt-out link

The right to refuse must be offered in every commercial message. The provider includes an accessible contact route for refusal, such as a customer service number, a text message number or a web address dedicated solely to refusal notices, and the refusal must be possible through the same channel as the message, easily and free of charge. For email the natural reading is a single-click, no-login, no-fee link. Hiding it in tiny text or sending people through extra forms moves away from "easy" in the regulation's sense.

Handling Opt-Outs, Records and Deletion

Handing out unsubscribe links is easy. Acting on them every time, across every tool and list, is what separates a compliant programme from a risky one.

Time limits for refusals

Article 8 of the law says recipients may refuse at any time without giving a reason, and that after the request reaches the provider, the provider stops sending within three business days. Article 10 of the regulation repeats the three-day rule, and Article 4 defines a business day as every day other than national holidays, public holidays and weekends. Article 9 of the regulation adds that the provider must report refusal notices it receives to the national system within three business days and that recipients can also refuse through the system itself.

What a refusal cancels

A refusal makes the approval invalid for the channel through which it was made, and Article 5 provides that approval lasts until the right to refuse is exercised. If someone unsubscribes by email and you later re-import an old list that still contains them, you have sent without approval. Use suppression lists that survive imports and tool changes.

Design targets

The three-day period is a ceiling. Most email tools can remove an address the moment the link is clicked, so aim for that and process unsubscribe requests received by other routes the same day. This is an operating rule of thumb, not a legal requirement.

Retention periods

Article 13 of the regulation requires the provider to keep approval records for three years from the date the approval's validity ended, and other records relating to commercial messages for three years from the record date, and to hand them to the Ministry on request. KVKK Article 7 separately requires deletion of personal data when the reason for processing ends. The two can sit together if you delete marketing data on unsubscribe but retain a restricted proof record for the period in the regulation. How to separate those stores is a design question for a specialist.

Fictional example: an online course provider

A fictional online course provider adds a weekly digest signup. The form asks for an email address and shows an empty checkbox beside a sentence naming the channel and the content. A verification email carries only a link. After the click, the system writes a consent record with the timestamp, form version and wording, queues the transfer to the national system, and sends an acknowledgement with an opt-out option. Each issue has a subject-line label, a footer with identity and contact details, and a one-click unsubscribe. When someone unsubscribes, the address is suppressed immediately and the refusal is reported onward. Nobody is added from a purchased list, no box is pre-ticked and no extra personal details are requested. Whether this setup is sufficient in a particular case depends on the facts.

Vendors, Servers Abroad and Foreign Audiences

The email service that sends your issues is usually a separate company, often hosted abroad. It is also where foreign rules start to matter.

Working with an email platform

Under KVKK Article 12, the controller must take all technical and administrative measures needed to prevent unlawful processing and unlawful access and to protect the data, and where data are processed on its behalf by another person, the controller is jointly responsible with that person for those measures. Article 12 of the regulation adds that providers and intermediary providers are responsible for protecting the data obtained, and that personal data may be shared with third parties, processed or used for other purposes only with the person's prior approval. Ask a platform what it does with your list, who its sub-processors are, how deletion works and where data sit. Never lend or sell the list to another sender for convenience.

The regulation also says an intermediary provider cannot obtain approval to send commercial messages on behalf of others to promote their goods and services. If your newsletter reaches an audience through another publisher's list, work out in advance whether the consent given to that publisher covers your message. For the wider picture of how newsletters work as a distribution channel, see newsletters for content distribution and brand visibility, and for how publishers, advertisers and orders fit together on the platform, what Akua Adforce is and how it works.

Servers outside Turkey

KVKK Article 9, as amended in 2024, allows transfer abroad where one of the processing conditions exists and either an adequacy decision applies or one of the listed appropriate safeguards is in place, with narrow incidental exceptions otherwise. If your email tool stores subscriber data abroad, that article is directly relevant, and the route you rely on should be written down.

European readers: the GDPR lens

Foreign teams often start from GDPR. The Board's Guidelines 05/2020 on consent (Opens in a new tab) quote the Article 4(11) definition of consent as a freely given, specific, informed and unambiguous indication of wishes by a statement or clear affirmative action. They say pre-ticked boxes are invalid, that consent bundled as a non-negotiable part of terms is presumed not to be freely given, that withdrawal must be as easy as giving consent, and that the controller must be able to demonstrate consent. Several of these ideas echo the Turkish rules, but the legal texts differ, and a mailing to people in the European Union brings its own national requirements that fall outside the scope of this guide.

American readers: the CAN-SPAM lens

The Federal Trade Commission's CAN-SPAM compliance guide (Opens in a new tab) lists eight requirements for commercial email: accurate header information, non-misleading subject lines, a clear disclosure that the message is an advertisement, a valid physical postal address, a way to opt out, prompt honouring of opt-outs within ten business days, an opt-out mechanism that keeps working for at least thirty days after sending, and continued responsibility for email others send on your behalf. The guide centres on honouring opt-outs, whereas the Turkish regime asks for prior approval; a sender who follows only the American checklist will not meet the Turkish consent rule for Turkish recipients.

Enforcement in Brief

Understanding how problems surface helps you decide what to keep on file.

How complaints work

Article 14 of the regulation lets recipients complain through the e-Government portal, the national message system or the Ministry's website, or in writing to the provincial trade directorate where they live. A complaint about a commercial message must be filed within three months of the sending date, and in the case of email a visual copy of the message is attached. A complainant may only complain about messages sent to their own addresses. When the directorate asks for information and documents, they must be delivered within fifteen days of notification, with a single extension of up to fifteen more days available on request.

Administrative fines

Article 12 of the law provides administrative fines by category of breach. Sending without prior approval or sending content that does not match the approval falls under one category, the information duties of Article 7 under another, and the refusal duties of Article 8 under a third. If a message in breach of the approval rule is sent to several recipients at once, the fine may be raised up to tenfold. The law leaves the amounts applicable in 2026 to the table at the end of its text, so consult the current text and Ministry announcements for amounts. On the data protection side, Article 18 of KVKK provides separate administrative fines for failing the notice duty and the data security duties; check the current text for the ranges.

A Working Checklist and Record Sheet

The lists below turn the sections above into questions your team can answer. They are working aids, not a legal opinion.

Before launch

• Does the form open with an unticked box on its own line?
• Does the wording name the channel, the content type and the sender?
• Is the privacy notice linked beside the form?
• Is any product, account or download made conditional on ticking the box?
• Is each consent logged with time, form version and wording?
• Is the transfer to the national system automated within three business days?
• Does the verification email contain only the verification link?

With every issue

• Is the message label present in the subject line when needed?
• Do the footer and contact block carry the identity details?
• Does the unsubscribe link work in one click, free of charge?
• Does the content stay inside what subscribers agreed to?

On a schedule

• Are refusals applied and reported within three business days?
• Are suppression lists synchronised with the national system and every sending tool?
• Are retention and deletion rules followed?
• Is the vendor list, hosting location and transfer route current?

Mistakes to avoid

• Buying or renting an email list: Approval is taken by the sender or through the national system, and the sender must be able to prove it. A list assembled by a third party rarely supports that chain.
• Pre-ticked boxes: The regulation forbids them.
• Making the signup a precondition: Consent cannot be a condition of getting a product or service.
• Vague wording: Blanket consent is treated as invalid under the KVKK guidance.
• Hidden unsubscribe links: Refusal must be easy and free.
• Re-importing old lists: A refusal ends approval for the channel until fresh consent is given.
• Promotional verification emails: They collide with the ban on sending a message to request approval.

Frequently Asked Questions

Do I need consent for every newsletter in Turkey?

If the newsletter promotes goods, services or the business, or builds recognition, the law requires prior approval. Notices about an ongoing contract or purchase are treated differently, but they may not carry promotion. Tradespeople and merchants have their own rule. This is general information, not legal advice; check the current text and consult a specialist for your case.

Is double opt-in legally required?

The Turkish law and regulation do not use that term or require it. It is a widely used practice for address verification and proof. Keep the verification email free of promotion, because the regulation bans sending a commercial message to ask for approval. Confirm with a specialist and the current text.

How fast must I process an unsubscribe request?

The law and the regulation say sending must stop within three business days after the request reaches you, and refusals must be reported to the national system within three business days. Verify the current wording and take advice if a dispute arises.

How long should consent records be kept?

The regulation says approval records are kept for three years from the date the approval's validity ended, and other records for three years from the record date. KVKK also requires deletion when the purpose ends. How to reconcile them needs current text and expert advice.

Can I email a purchased list if I add an unsubscribe link?

We do not recommend it. An unsubscribe link does not replace prior approval, and proving approval for a third-party list is very hard. Consult a lawyer and check the current legal text before using any such list.

Does following CAN-SPAM or GDPR cover Turkish recipients?

Not by itself. The frameworks overlap in places but are different legal texts. For Turkish recipients, the Turkish rules apply, and you should verify current texts and consult a specialist. This guide is not legal advice.

Conclusion

Compliant newsletter signup in Turkey is not a single checkbox. Prior approval under the e-commerce law lets you send, the notice duty under KVKK explains how the data are used, and explicit consent follows its own definition. Build the form with an empty box, specific wording and no preconditions, log every approval with its time, version and text, record it in the national message system within three business days, give every issue an identity block, a label and a free one-click opt-out, honour refusals within three business days and write down your retention, vendor and transfer decisions. Avoid shortcuts such as purchased lists, pre-ticked boxes and tying consent to service.

This is general information and not legal advice. Laws change, so verify the current legal text and the competent authority's guidance, and consult a lawyer or data protection specialist if a dispute or penalty risk arises.

If you want your brand to appear on editorial publisher sites and newsletters, you can explore the guest post options at Akua Adforce; the scope and terms are listed on the product page.