If your website uses Google Analytics, an advertising pixel or a similar tool, cookie consent under KVKK concerns you too. This guide explains the KVKK cookie rules and how to make your site compliant, without drowning in legal jargon. Note: this content is informational and is not a substitute for legal advice.
What does KVKK say about cookies?
Some cookies process personal data (identity, behavior, device information). Non-essential cookies must obtain the visitor's explicit consent before they run. Explicit consent must be freely given, informed and unambiguous. The visitor must know what they are consenting to and actively choose it.
Cookie categories
- Strictly necessary: required for the site to work (session, security, cart). No separate consent, always on.
- Analytics: measure visitor behavior (like Google Analytics). Requires consent.
- Marketing/advertising: ad targeting and remarketing (Meta Pixel, Google Ads). Requires consent.
The visitor must be able to select categories separately; an "all or nothing" demand is not appropriate.
What should a KVKK-compliant cookie consent look like?
The core rules of a proper consent layer:
- No prior consent: non-essential cookies do not run until the visitor accepts.
- Reject as easy as accept: "Reject all" and "Accept all" are equally visible and one-tap.
- No pre-ticked boxes: the visitor makes an active choice.
- Ability to change: the visitor can withdraw consent later, usually via a corner "cookie settings" link.
- Clear information: which cookies are used and why must be explained in a cookie policy.
Cookie policy and disclosure
A banner alone is not enough; there must also be a cookie policy the visitor can reach. It explains which cookies you use, for what purpose, for how long, and which third-party tools. For a quick start, use our cookie policy generator.
Consent logging: burden of proof
Under KVKK the burden of proof is on the data controller. Saying "we obtained consent" is not enough; you are expected to keep a record of who consented, when and to which categories. Consent logs protect you during an audit or complaint.
KVKK versus GDPR
The core logic is similar: prior explicit consent for non-essential cookies. Terminology and some details differ. For sites serving Turkey, KVKK applies; if you sell or serve in Europe, GDPR applies as well. If you address both markets, your banner should satisfy both frameworks.
The risk of non-compliance
Processing personal data without explicit consent carries the risk of administrative fines and reputational damage. The most common gaps seen in complaints and audits are: no banner, making rejection harder, pre-ticked boxes and not keeping consent logs.
Step-by-step compliance checklist
- Identify the cookies and third-party tools on your site (Analytics, Ads, Pixel).
- Make sure these tools do not run before consent.
- Add a category-based consent layer where rejection is easy.
- Publish a cookie policy and link to it from the banner.
- Log consents with the date and preferences.
- Let visitors change their preference later.
For a KVKK and GDPR-compliant solution that sets all of this up with one line of code, see our UC Consent page and start now with a free account.