The Principle Decision dated 18 February 2026 and numbered 2026/347, adopted by the Personal Data Protection Board (“Board”), has been published in the Official Gazette dated 24 March 2026 and numbered 33203.
With the said Principle Decision, it has been clearly established that explicit consent texts and privacy notices must be prepared separately by data controllers.
The Board has assessed that practices frequently encountered in practice—such as presenting explicit consent and privacy notices within a single text, making the provision of privacy notices conditional upon obtaining explicit consent, or using general and vague expressions—constitute violations of the law.
In this context:
