Personal Data Protection Board's Guiding Principle Decision Regarding the Processing of Personal Data via SMS Verification Code Delivery Published.

The Personal Data Protection Board (the "Board"), published a guiding principle decision in the Official Gazette on June 26, 2025 (Decision No: 2025/1072, Meeting Sequence No: 2025/18). This decision addresses the processing of personal data through the delivery of SMS verification codes to data subjects during the provision of products and services. This decision establishes crucial principles concerning the conditions for processing personal data, the obligation to inform data subjects, and data security measures, all in accordance with the Personal Data Protection Law (the "Law"). Through this decision, the Board has identified unlawful practices prevalent in common applications and has set forth the obligations that data controllers must adhere to.

The guiding principle decision primarily addresses numerous complaints and notifications received by the Turkish Data Protection Authority. These communications indicated that during product and service provision processes—such as payment, account registration, membership creation, and offer generation—contact information was requested from data subjects, and SMS verification codes were subsequently sent. The complaints assert that these codes were necessary to finalize payments, generate invoices, or update information. However, allegations arose that following these transactions, commercial electronic messages related to the data controller's activities were sent to the data subjects. Upon its examinations, the Board determined that no disclosure (obligation to inform) was provided by the data controller or its authorized representatives, either within the content of these SMS verification codes or prior to their dispatch. Furthermore, despite the codes being requested under the pretext of necessity for payment or information updates, it was established that data subjects were misled into providing explicit consent for the transmission of commercial electronic messages through this mechanism.

In its assessment, the Board emphasized that, pursuant to Article 5 of the Law, as a general rule, personal data cannot be processed without the explicit consent of the data subject. However, it further clarified that the processing of personal data without explicit consent is permissible only in the limited circumstances specifically enumerated within the Law.

The Board articulated that, in accordance with Article 3 of the Law, explicit consent is defined as "consent related to a specific matter, based on information, and declared with free will." The Board further stated that explicit consent must encompass these aforementioned elements.

Ultimately, the Board's guiding principle decision stipulated that obtaining explicit consent for the processing of personal data for the purpose of sending commercial electronic messages should not be presented to data subjects as a mandatory element for the completion of product and service provision. To ensure this, data controllers must implement the necessary technical and administrative measures. The Board further assessed that, should non-compliance with these stipulated points be identified, administrative monetary penalties will be imposed on the relevant data controllers in accordance with the provisions of Article 18 of the Law.

In conclusion, the Board's guiding principle decision aligns with the approach it has previously articulated in its announcements. This decision formally establishes the principle that data subjects are not obligated to consent to the content of an SMS verification code if it is sent prior to the completion of a transaction, and that their preferences can always be modified. Within this framework, data controllers who provide products or services are required to act in accordance with this guiding principle decision and undertake necessary compliance efforts.