On 20 June 2022, Turkish Data Protection Authority (DPA) published a guide on the use of cookies (the Guide). Prior to publication of the Guide, there was no specific guidance on cookies, other than two decisions  of the DPA that included an analysis of the data processing activities conducted through cookies. The Guide provides comprehensive explanations about cookies and cookie use in a manner parallel to EU guidelines, and it mainly focuses on cookie types, the relationship between the Law on Electronic Communications numbered 5809 and Data Protection Law numbered 6698 (DPL), as well as on the lawful use of cookies in terms of the criteria for deciding which cookie use requires explicit consent, the elements of obtaining lawful consent and fulfilling the obligation to inform data subjects. In addition, the Guide provides a checklist for data controllers in terms of cookie use, examples pertaining to appropriate and inappropriate practices for cookie banners and consent management platforms, as well as a sample information text for cookies. Please find the overview of key highlights stipulated under the Guide below.

In order to determine the scenarios where cookie use may not require explicit consent of data subjects, the Guide sets forth the following criteria:

1. Criterion A: of the cookie is used for the sole purpose of facilitating the transmission of communications over an electronic communication network.
2. Criterion B: the cookie is strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.

In addition to the explanations for these criteria, the Guide exemplifies several types of cookies that may be used by relying on legal bases other than the explicit consent of data subjects stipulated under the DPL, along with the conditions under which the use of such cookies falls outside the scope of Criterion A and Criterion B. The Guide provides the following cookie-use case scenarios that principally do not require explicit consent of data subjects, with brief explanations on how they operate:

• User-input cookies: These cookies are used for keeping track of the user’s input in circumstances including when filling out online forms or adding items to the shopping cart and transferring outcomes to the service providers. They are set directly by the visited website, which is the URL displayed in the browser’s address bar (first-party cookies); they rely on a Session-ID and expire when the session ends. 
• Authentication cookies: These cookies identify users when they log in and allow users to authenticate themselves on successive visits to the website and gain access to authorized content.
• User-centric security cookies: These cookies may be set for the specific task of increasing the security of the service that has been explicitly requested by the user.
• Multimedia player session cookies: These cookies are used to store technical data needed for re-playing video or audio content.
• Load balancing session cookies: These cookies distribute the processing of web server requests over a pool of machines, and they direct web requests of users to a load-balancing gateway, which forwards the request to one of the available internal servers in the pool.
• User interface customization cookies:  These cookies are used to store a user’s preference regarding a service across web pages, such as maintaining language preferences or online search results. Customization cookies are set upon explicit requests of users (i.e. clicking a button or ticking a box), and they are not linked to other persistent identifiers, such as a username.
• Social plug-in content sharing (like, share, comment) cookies: These cookies allow members of social media platforms that are logged in to social media networks to share content they like with their “friends.”
• Cookies used for explicit consent management platforms: The Guide considers that cookies used for managing consent records of users fall under the scope of Criterion B.
• First-party analytic cookies: These cookies are placed for measuring target audience for the purpose of the proper functioning and daily management of a website or application, such as performance measurement, detection of navigation problems, optimization of technical performance or ergonomics or to estimate the power of servers.
• Cookies used for the security of the website: Use of these cookies allows for operating a secure website for users, and they may be placed for various reasons including to prevent the disabling of service provision on the website or to prevent the website from being disabled due to security weaknesses.

On the other hand, the Guide also sets out which cookies cannot be considered to fall within the conditions stipulated under Criterion A and Criterion B and thus require explicit consent of data subjects. They are as follows:

• Social plug-in tracing cookies: These cookies can track individuals (members and non-members of social media platforms) for additional purposes such as behavioral advertising, analytics or market research. 
• Online behavioral advertising cookies: These cookies can be used for behavioral advertising purposes, and the consent requirement for these cookies extends to all related cookies used in advertising (e.g. cookies used for the purpose of frequency capping, financial logging, ad affiliation, click fraud detection, research and market analysis, product improvement and debugging).

As with any data processing activity, data controllers are required to comply with the Communique on Principles and Procedures to be Followed in Fulfilment of the Obligation to Inform (Communique) when informing data subjects about the use of cookies. Accordingly, data controllers should provide an informational text drafted specifically for cookie use in an easily accessible and noncomplex form. It is also recommended to clearly state the name of the cookies, their purposes, duration of use and whether they are first-party or third-party cookies in information notices. In addition, data subjects should be informed (e.g. via pop-up messages) at the stage of visiting the website, since merely visiting a website does not indicate the free will of data subjects in terms of consenting to processing. Under the Guide the DPA indicated that data controllers should comply with the cross-border data transfer rules when the personal data is transferred outside Turkey through cookies.

1. Turkish DPA decision dated February 27, 2020 and numbered 2020/173 and the decision dated September 3, 2021 and numbered 2021/891.