The Personal Data Protection Board's ("Board") Principle Decision No. 2025/1072, titled "Principle Decision Regarding the Processing of Personal Data by Sending a Verification Code via SMS to Data Subjects During the Provision of Products and Services" ("Principle Decision"), was published in the Official Gazette dated 26 June 2025 and numbered 32938.
In its Principle Decision, the Board carried out an assessment under the Law on the Protection of Personal Data No. 6698 ("DP Law") regarding the practice of sending verification codes via SMS to data subjects by data controllers or authorized persons during processes related to the provision of products and services, including payment transactions, registration, quotation requests and membership creation.
The Board identified that, while providing products and services, the obligation to inform data subjects was not fulfilled, and that explicit consent for the sending of commercial electronic messages ("e-messages") was obtained in a misleading manner through SMS messages containing verification codes.
Accordingly, in its Principle Decision, the Board made the following evaluations by taking into consideration specific practices that appear to be widely implemented:
- The purpose of the verification code sent via SMS during transactions related to the provision of products and services must be clearly stated before sending; the consequences of providing the code received via SMS must be conveyed to data subjects in a clear and understandable manner as part of a layered information approach, and the SMS content must include the necessary information for fulfilling the obligation to inform.
- Verification codes must not be used in conjunction with other transactions, including membership approval, consent to personal data processing, or consent to receive e-messages. Each purpose must be supported by separate, explicit, and freely given consent.
- The processes of obtaining explicit consent and fulfilling the obligation to inform must be carried out separately.
- If explicit consent for the sending of e-messages is obtained via an SMS verification code, such consent must be obtained in accordance with the DP Law.
- Obtaining explicit consent for the sending of e-messages must not be a mandatory requirement for completing the provision of products or services.
- In order to prevent any perception that entering a verification code constitutes an essential condition for receiving the product or service, explicit consent should be requested after the delivery of the product or service. Alternatively, a clear explanation must be provided within the SMS content or through physical or digital communication channels.
- Data controllers must provide regular awareness and training programs to their employees in order to ensure lawful execution of the relevant processes.
Finally, in the Principle Decision, the Board reiterated that, pursuant to Article 12 the DP Law, data controllers are under the obligation to ensure the lawful processing of personal data and, to that end, must implement appropriate technical and administrative measures. It was further noted that any non-compliance with these obligations may result in the imposition of sanctions within the scope of Article 18 of the DP Law.
The full text of the Principle Decision is available here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
