New Resolution From The Turkish Data Protection Authority: Is The "Single Code, Multiple Consents" Practice At Checkout Coming To An End?

In recent years, it has become a controversial practice in Türkiye to obtain consents—particularly for marketing communications—by confirming contact information through a single SMS code during the delivery of products or services. The Turkish Personal Data Protection Authority ("the Authority") addressed this issue for the third time in its Resolution No. 2025/1072, published in the Official Gazette on 26 June 2025. This resolution clarified the conditions under which explicit consent obtained at store checkouts may be considered valid.

Background

The Authority had first addressed the issue of verifying contact information in its Resolution dated 22 December 2020 and numbered 2020/966. This decision highlighted that individuals may provide contact details that belong to someone else—either mistakenly or intentionally—which can result in the unauthorized disclosure of personal data. In light of this, the Authority emphasized that data controllers must take