meta_id 3340907

On July 21, 2026, Turkey's Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) published a public notice addressing the misuse of personal data obtained from third parties for advertising and marketing purposes. The authority received numerous complaints and reports from data controllers across various sectors using contact information—including telephone numbers and email addresses—obtained from third parties through referrals, brand ambassador schemes, customer recommendations, or similar methods. In many cases, data controllers conducted marketing activities via voice calls or SMS without providing required transparency information or obtaining explicit consent from the individuals concerned. The authority's investigations confirmed that personal data obtained from third parties is being used in advertising and marketing activities without proper legal basis or compliance with data protection obligations. The authority clarified that merely obtaining personal data from third parties does not provide data controllers with direct legal justification to process that data for advertising and marketing purposes. Under Turkey's Personal Data Protection Act (Law No. 6698), all personal data processing must comply with established conditions and controller obligations. The authority emphasised that data controllers must fulfil transparency obligations within reasonable timeframes, particularly when data is not obtained directly from the individual. Explicit consent must be obtained separately from transparency provision and cannot be inferred from passive behaviours such as continuing to listen to marketing calls, failing to end conversations, or not responding negatively to SMS messages. The authority stressed that implicit conduct alone does not constitute valid explicit consent under the law. Data controllers failing to comply with these obligations face administrative sanctions under Article 18 of Law No. 6698.