Principle Decision of The Personal Data Protection Board Regarding The Sending Of Verification Codes Via SMS

The Personal Data Protection Board (“Board”) addressed the issue of processing personal data through the transmission of verification codes via SMS to data subjects during the provision of goods and services in its Principle Decision dated 10/06/2025 and numbered 2025/1072 (“Decision”), published in the Official Gazette on 26/06/2025.

Following complaints and notices submitted to the Board, it was determined that during processes related to the provision of goods and services (such as making payments, account registration, membership creation, offer preparation, and similar transactions), data subjects’ contact information was requested and verification codes were sent to them via SMS. These codes were then requested to be conveyed to company representatives on the grounds that they were necessary for completing payments, generating invoices or delivering invoices to communication addresses. However, it was identified that following these transactions, commercial electronic messages were sent to data subjects within the scope of the data controller’s activities.

It was also established that, although verification code-containing SMS messages were sent to data subjects during these processes, no information notice was provided either within the SMS content or prior to its transmission by the data controller or the persons authorized by the controller. Moreover, it was determined that data subjects were misled by obtaining their explicit consent for the sending of electronic messages under the pretext of completing payment transactions or updating information.

The Decision emphasized that the data controller must clearly specify the subject matter for which explicit consent is requested. It also stated that if obtaining such consent is made a prerequisite for the provision or benefit of a product or service, the element of free will is compromised, rendering the consent invalid.

Based on its assessment, the Board concluded that:

• The purpose of the SMS to be sent to the data subject and the potential consequences of providing the verification code must be clearly and understandably explained to the data subject, and such information must also be accessible through appropriate communication channels within the SMS content.

• Separate explicit consent must be obtained for each data processing activity requiring explicit consent, and data subjects must be provided with clear options to give or withhold such consent.

• The processes of fulfilling the obligation to inform and obtaining explicit consent must be carried out separately.

• Any explicit consent obtained for the sending of commercial electronic messages must meet all the legal requirements set forth under the Law.

• The processing of personal data for the purpose of sending commercial electronic messages must not be presented to the data subject as a mandatory element for the completion of the product or service delivery, and all such activities must be conducted in compliance with the Law.

• In this respect, explicit consent for processing personal data for commercial electronic communication purposes should be obtained after the product or service delivery is completed. Additionally, the SMS content and other information provided (physically or digitally) must clearly state that the provision of the verification code is not a prerequisite for the delivery of goods or services, the services may still be provided even if the code is not shared, and any permission or preference granted through the code may be changed at any time. This approach aims to prevent explicit consent for commercial communication from being perceived as a mandatory condition for the provision of goods or services.

• Data controllers must conduct regular training and awareness programs for personnel involved in these processes.

In this context, the Board has stated that the aforementioned principles constitute administrative and technical measures that must be taken by data controllers to ensure the lawful processing of personal data under the Law. Failure to comply with these principles may result in the imposition of administrative fines pursuant to Article 18 of the Law.

The full text of the Principle Decision is available here.