- within Privacy topic(s)
- in Turkey
- within Privacy, Insolvency/Bankruptcy/Re-Structuring and Intellectual Property topic(s)
The Personal Data Protection Authority ("Authority") has issued a Public Announcement dated 14 January 2026 ("Announcement").
The Authority has published a public announcement addressing the compliance of push notifications sent to users via mobile applications with the Turkish Personal Data Protection Law No. 6698 ("Law"). The announcement was issued following investigations conducted in relation to similar complaints submitted to the Authority and aims to inform the public of the findings and legal assessments reached in this context.
The Authority states that, with respect to push notifications sent by mobile application providers acting as data controllers, although such notifications are technically based on permissions obtained from users, it must be separately assessed whether these permissions constitute legally valid explicit consent.
In the public announcement, particular emphasis is placed on the principle of "granular explicit consent," which is recognized in both the Board's practice and legal doctrine. Pursuant to this principle, a single consent declaration serving multiple purposes is not regarded as a legally valid explicit consent.
Accordingly, the Authority explicitly states that the consent obtained from users for push notifications should not be collected as a single consent declaration covering multiple purposes. In this context, operational notifications that constitute a natural part of the service, such as "real-time order status tracking," must not be obtained under the same consent as "campaign and marketing notifications."
Within this scope, it is stated that users must be granted the opportunity, through in-app settings or operating system settings, to separately choose which types of notifications they wish to receive (for example, only operational notifications or only marketing notifications).
The absence of such customization options may, pursuant to the Announcement, result in a breach of the obligation to take the necessary technical and administrative measures to prevent the unlawful processing of personal data, potentially giving rise to administrative sanctions.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
