If your site has a contact form, Google Analytics, or a WhatsApp button, you are processing personal data, and Turkey's Personal Data Protection Law No. 6698 (KVKK) applies to you. Many small businesses put this off with the excuse "we're just a brochure site," but in 2026 the administrative fines issued by the Personal Data Protection Board start in the hundreds of thousands of liras.
This guide explains what is actually required for a website to comply with KVKK, what is overkill, and how you can become compliant in 1 day.
Does Your Website Process Personal Data? (Quick Test)
If you have even one of the following, the answer is yes:
- A contact, quote, appointment, or registration form
- A newsletter (email) subscription
- Tracking codes such as Google Analytics, Meta Pixel, or Hotjar
- Live support / chatbot
- A membership or login system
- A comments section
- Any server log that records IP addresses (in other words, every site)
5 Requirements for Your Website in 2026
1. Privacy Notice (Aydınlatma Metni)
Article 10 of the law requires you to inform the data subject before collecting data. The notice must be published as a separate page on your site and linked beneath every form. It must include:
- The identity of the data controller (company name, address, contact details)
- Which data is processed and for what purpose
- Who the data is transferred to and why (for example, your email provider or analytics tools)
- The collection method and legal basis
- The data subject's rights under Article 11 and how to apply
Common mistake: Publishing a generic template downloaded from the internet as-is. Your notice must match the tools your site actually uses (forms, analytics, chatbot); otherwise it will be considered invalid in an audit.
2. Cookie Policy and Cookie Banner
According to the Cookie Practices Guide published by the Board in 2022:
- Strictly necessary cookies (session, security, cart) do not require consent; providing information is enough.
- Analytics, marketing, and personalization cookies (Google Analytics, Meta Pixel, YouTube embeds) require explicit consent; these cookies must not run until the user clicks "Accept."
That means a banner with only an "We use cookies, OK" button is not enough. Users must be able to choose by category, rejecting must be as easy as accepting (buttons of the same size), and consents must be recorded. Loading Analytics without consent is one of the main grounds for recent fines in Turkey.
3. Explicit Consent on Forms
A contact form generally does not require explicit consent; the legal basis of "establishing a contract" or "legitimate interest" is sufficient, and a link to the privacy notice is enough. However:
- To send marketing emails / SMS, a separate, unchecked-by-default consent checkbox is mandatory (and registration with İYS, the Commercial Electronic Message Management System, is also required).
- Health data (such as a complaint field on a clinic appointment form) is special-category data; an explicit consent checkbox is required.
- Using a single "I have read and accept KVKK" checkbox to obtain both notice acknowledgment and consent is a mistake; a notice is not "accepted," it is read. Consent is obtained separately.
4. Privacy Policy
It is often confused with the privacy notice, but it is different: a privacy policy is a broader document that explains the site's general approach to data processing, its security measures, and its third-party services. The privacy notice is the legal requirement; the privacy policy is expected for trust and transparency.
5. VERBİS Registration (Not for Everyone)
Registration with the Data Controllers' Registry is mandatory for businesses with more than 50 employees or an annual financial balance sheet total above ₺100 million, as well as businesses whose main activity is processing special-category data (for example, healthcare providers). A small café or real estate office does not need to register with VERBİS, but the notice and cookie obligations still apply.
KVKK Fines in 2026
The administrative fines under Article 18 of KVKK are raised every year by the revaluation rate. As of 2026, violations of the notice obligation can be fined from hundreds of thousands of liras, while violations of data security obligations can be fined up to tens of millions of liras. Looking at the Board's decision summaries, the most common grounds related to websites are:
- Running analytics/marketing cookies without consent
- Collecting data through a form without a privacy notice
- Sending marketing emails/SMS without consent
- Failing to report a data breach to the Board within 72 hours
Verify current amounts on the Authority's official website; the figures in this article are meant to give a sense of scale.
A KVKK-Compliant Website in 1 Day: Checklist
- List all the tools used on your site (forms, analytics, pixels, chatbot, embedded videos, maps)
- Write your privacy notice based on that list and publish it at a permanent URL such as
/kvkk-aydinlatma-metni - Add a link to the privacy notice beneath every form
- Add a separate, unchecked consent checkbox for marketing permission
- Create a cookie policy page; list in a table which cookie is used for what
- Set up a cookie banner with category selection that makes rejecting easy; do not load analytics and marketing code before consent is given
- Keep consent records (date, choice)
- Add a privacy policy page
- Make sure SSL (https) is active; personal data cannot be collected over http
- Put "KVKK Privacy Notice," "Cookie Policy," and "Privacy Policy" links in the footer
- Designate an email address for receiving data subject requests and define a process for responding within 30 days
- Get a written confidentiality commitment from everyone on your team who has access to data
What Do You Need for a WhatsApp Button, Google Maps, and YouTube Embed?
- WhatsApp button: A click redirects the visitor to WhatsApp; no data is collected on the website side. However, because you process the personal data you receive in the conversation (name, phone number), you should list WhatsApp as a channel in your privacy notice.
- Google Maps embed: It transfers IP data to Google; it should be disclosed in your cookie policy and ideally loaded only after consent.
- YouTube embed: It sets marketing cookies; use "privacy-enhanced mode" (youtube-nocookie) or load it only after consent.
- Google Analytics 4: An analytics cookie; it must not run without consent. With Consent Mode, limited measurement is possible before consent without setting cookies.
KVKK Compliance with ComSuite
On sites built with ComSuite, SSL is included automatically, and privacy notice and cookie policy pages are created from a ready-made template. Every site also comes with a category-based cookie consent banner: the “Accept all,” “Reject,” and “Manage preferences” options are presented at equal prominence, no cookies are set without consent thanks to Google Analytics/Ads Consent Mode v2, Meta Pixel doesn't load until consent is given, and every choice is logged. To see where your current site stands, you can run the free KVKK compliance test, and for details, see our KVKK compliance guide.
This article is for general information only and does not replace legal advice. Businesses that process special categories of data (health, legal, finance) are advised to work with a KVKK consultant or attorney.
