Turkish Data Protection Board Published Principle Decision On Loyalty Card Memberships Used In Various Sectors

"Principle Decision on the Use of a Loyalty Card Member's Mobile Phone Number or Loyalty Card Number by a Third Party During a Purchase" ("Decision"), adopted by the Personal Data Protection Board ("Board") on 11 February 2026 with decision number 2026/266, was published in the Official Gazette dated 28 February 2026 and numbered 33182. The full Turkish text of the Decision is available here.

The Decision addresses a practice frequently encountered in loyalty card programs that are widely used across various sectors, particularly in the retail sector. Within the scope of loyalty card programs operated by data controllers, it has been determined that purchases made by a third party sharing the mobile phone number of the relevant data subject, who is the loyalty card holder, with the cashier during the purchase, and that such purchases conducted through loyalty cards are completed without any transaction approval code, verification step, or identity authentication.