Turkish Data Protection Authority Warns On Advertising And Marketing: Use Of Contact Details Obtained From Third Parties

The use of telephone numbers, email addresses and other contact details obtained from third parties for advertising and marketing activities gives rise to significant legal risks that must be carefully assessed under the Personal Data Protection Law No. 6698 (the “Law”).

Following an increase in complaints and reports concerning such practices, the Turkish Data Protection Authority (the “Authority”) issued a public announcement reminding data controllers of the key principles and obligations applicable when processing personal data obtained from third parties.

1. Scope of the Complaints

Complaints and reports submitted to the Authority state that telephone numbers and email addresses obtained from third parties through referrals, recommendations, brand ambassador programmes, personal connections or customer referrals have been used for advertising and marketing through voice calls or short message service (SMS) without providing the required privacy notice or obtaining explicit consent.

The Personal Data Protection Board (the “Board”) emphasised that obtaining personal data from third parties does not, by itself, provide a legal basis for processing that data for advertising and marketing. The applicable personal data processing condition must therefore be assessed separately in light of the circumstances of each case.

2. The Concept of Explicit Consent

As a rule, personal data may not be processed without the data subject’s explicit consent. However, data may be processed without explicit consent where one of the personal data processing conditions listed in Article 5 of the Law applies.

Accordingly, the legal basis for each advertising and marketing activity must be identified on a case-by-case basis. Where a processing condition other than explicit consent is relied upon, the actual availability of that condition must also be assessed.

Explicit consent must relate to a specific matter, be informed and be freely given. Continuing to listen to a campaign, not ending a call, asking questions, requesting information or failing to submit an opt-out request by SMS cannot, by itself, be regarded as valid explicit consent.

3. Compliance with the Obligation to Inform

Under Article 10 of the Law, data controllers must inform data subjects of the identity of the data controller and, where applicable, its representative; the purposes of processing; the recipients and purposes of any transfer; the method and legal basis of collection; and the rights listed in Article 11 of the Law.

Where personal data is not obtained directly from the data subject, the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform (the “Communiqué”) requires the privacy notice to be provided within a reasonable period after collection, at the first communication if the data will be used to contact the data subject, or no later than the first transfer if the data will be transferred.

Under the Communiqué, fulfilling the obligation to inform and obtaining explicit consent are separate processes. The data controller must first provide the privacy notice and, where the processing relies on explicit consent, obtain that consent separately through a clear statement of intent.

4. Administrative Fines

Where a breach of the obligations under the Law is identified, administrative fines may be imposed under Article 18 depending on the nature of the violation. The relevant administrative fine ranges for 2026, stated in Turkish lira (TRY), are as follows:

• Failure to comply with the obligation to inform: TRY 85,437 – TRY 1,709,200

• Failure to comply with decisions issued by the Board: TRY 427,263 – TRY 17,092,242

5. Conclusion

This announcement clearly demonstrates that the use of contact information obtained from third parties for advertising and marketing purposes is not automatically lawful.

Data controllers should pay particular attention to the following matters:

• The source of the personal data, the method by which it was obtained, the purpose of processing and the applicable legal basis should be identified. Data subjects should be informed about the data processing activities in a clear, understandable and complete manner. Where the personal data has not been obtained directly from the data subject, the obligation to inform should be fulfilled within the time limits and in accordance with the procedures prescribed by the applicable legislation.

• In processing activities based on explicit consent, such consent should be obtained as a separate declaration relating to a specific matter, based on adequate information and given freely. Conduct such as continuing the conversation, requesting information or failing to submit an opt-out request should not be regarded as explicit consent.

• The processes for fulfilling the obligation to inform and obtaining explicit consent should be carried out separately, and all advertising and marketing activities should be conducted in compliance with the Law and the applicable legislation.

In this context, data controllers are advised to review their data processing activities relating to advertising and marketing and to implement the necessary compliance measures.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.