What Is a Cookie Policy? Your Store’s Cookie Information Notice and Consent Banner Under the KVKK Guide

A site’s cookie information page tells visitors which cookies are placed on their device, for what purpose and for how long, and shows them how to change their cookie choices. In Türkiye this page is usually called a cookie policy (çerez politikası), while the Personal Data Protection Authority (KVKK), the country’s data protection regulator, calls the same document a “cookie information notice” (çerez aydınlatma metni) in its guide. To prepare it, you list the cookies on your site and note each one’s purpose, its lifetime and who places it. Under the Authority’s approach, you also need the visitor’s explicit consent for most cookies that are not strictly necessary, and visitors must be able to withdraw that consent whenever they wish.

By the end, you will know how to sort your store’s cookies into those that need explicit consent and those that do not, how to set up your consent banner along the lines of the Authority’s good-practice examples, and how to spot what information is missing from your current cookie policy. The advice draws on the Authority’s Guide on Cookie Practices (Çerez Uygulamaları Hakkında Rehber, July 2025 edition) and the text of Law No. 6698 on the Protection of Personal Data. The guide offers direction in the form of recommendations, so it is wise to consult a lawyer about anything specific to your site.

What is a cookie, and which rules apply to your store?

The Authority defines a cookie as a type of text file that site owners place on the visitor’s device and that is sent along with HTTP(S) requests. In an online store, the cart does not empty when the visitor moves to another page, a customer who has logged in does not have to type their password again on every page, and you can see in your ad dashboard which campaign a sale came from. Cookies are usually what make all three possible. A ready-made template may look like a quick answer to the question “What is a cookie policy?” To write your own text, though, you first need to know what these files do in your store.

Cookies that do not process personal data fall outside the guide’s scope, and it gives no separate guidance on similar technologies such as pixels, local storage, beacons and user fingerprinting. Desktop and mobile websites and web applications, however, are within scope. If an ad pixel drops a cookie in the browser and that cookie processes personal data, it is covered, so add it to your cookie inventory. Personal data processed by methods the guide is silent on does not escape the rules either, because Law No. 6698 applies to natural and legal persons who process personal data wholly or partially by automated means. Record non-cookie methods on a separate line of your inventory and agree with your agency on which preference category each one will be linked to.

Law No. 6698 does not regulate cookies explicitly. The relevant provision of Electronic Communications Law No. 5809, according to the guide, covers only electronic communications operators, while Law No. 6698 can apply to the personal data that other sites, such as online stores, process through cookies. Prepare your store’s cookie policy and consent banner on the basis of that Law.

Some sites bury their cookie information inside a general privacy page. Under Decision No. 2020/173 of the Personal Data Protection Board (the Authority’s decision-making body), as summarized in the guide, simply having a complex privacy notice on your site that also covers many other subjects does not mean you have fulfilled the obligation to inform. Publish the cookie policy on a page of its own, where readers can find what they need more easily. Instead of repeating the cookie details in your privacy notice, you can link from there to the cookie policy page; that link, however, does not take the place of the information you have to give through a banner or pop-up when a visitor enters the site.

Classify the cookies on your site in three ways

Both the consent banner and the cookie policy depend on a complete list of the cookies on your site. The guide classifies cookies in three ways: by lifetime, by party and by purpose. Write down all three for every cookie on the list.

Lifetime: session or persistent?

A session cookie, also known as a temporary cookie, is deleted when the user closes the browser. A persistent cookie is not deleted when the browser closes; it deletes itself on a set date or after a set period. Persistent cookies are sometimes also called tracking cookies; advertisers can use them to record a user’s browsing habits over a long period.

Party: who places the cookie?

A first-party cookie is placed by the site being visited, that is, the domain shown in the browser’s address bar. A third-party cookie is placed by a company or service on a different domain. If your store is at examplestore.com, a cart cookie written to that domain is first-party; if the tag of an ad network you added to your site drops a cookie under the network’s own domain, that cookie is third-party.

Purpose: strictly necessary, functional, analytics or advertising

By purpose, cookies fall into four groups. Strictly necessary (essential) cookies are used to make the site work and to deliver the service the visitor requested; logging in, filling in forms and remembering privacy choices are examples. The guide also asks that these cookies not be used for marketing. Functional cookies are used for personalization and for remembering preferences. Performance and analytics cookies measure visitor behavior statistically: estimating the number of unique visitors, identifying the search terms that bring people to the site and measuring the effect of ads all belong in this group. Advertising and marketing cookies track users’ online activity in order to identify their interests and show them ads based on those interests.

On a typical e-commerce site, the inventory looks roughly like this:

• The cookie that carries the products added to the cart from page to page is usually first-party and belongs in the strictly necessary group; check how long it lives in your scan results or in your e-commerce platform’s cookie list. The guide expects user-input cookies like this one to expire at the end of the session at the latest, so if your cart cookie keeps the cart for days, state its lifetime clearly in your notice.
• The cookie that keeps a member logged in is also first-party and is usually a session cookie; it becomes persistent when “remember me” is selected.
• The cookie that remembers the visitor’s cookie choices is persistent; the guide’s sample notice lists it among the strictly necessary cookies.
• A cookie that remembers a language or display choice across later visits belongs in the functional group.
• The cookie set by the measurement tool that keeps visit statistics is first-party or third-party depending on whether it is written to your domain or to the tool’s domain, and it belongs in the analytics group.
• Conversion and retargeting cookies from ad platforms are mostly persistent and belong in the advertising group. Some of them are written through your own domain and may therefore look first-party; as long as their purpose is advertising, that does not move them into the strictly necessary group.

On a site where different agencies and plug-ins have been at work over the years, compiling the list by hand can be difficult. Pushouse’s cookie management app helps you review your site’s cookie use with a cookie scan and prepare the descriptions shown to visitors based on that information. Compare the scan results with the list of tools your marketing team and your agency use; that way it becomes clear which cookie was added for which tool.

Ask your e-commerce platform provider for the names and lifetimes of the cart, account and security cookies as well. For every pop-up, spin-to-win wheel or chat tool you add to your store, ask its provider which cookies it uses and add the answer to your inventory.

Which cookies need explicit consent, and which do not?

Two criteria in the guide determine whether consent is needed. Criterion A applies when a cookie is used solely to carry out communication over an electronic communications network. Criterion B applies when a cookie is strictly necessary for a service the user has explicitly requested. Put simply, Criterion A covers cookies that are technically required for communication over the network to take place, such as load-balancing cookies. Criterion B covers cookies that enable a service the visitor has explicitly asked for, such as adding a product to the cart or logging in.

For cookies that meet one of these criteria, you can rely on the other processing conditions in Article 5 of the Law rather than on explicit consent. The Authority suggests this order: first check whether the processing rests on one of the conditions other than explicit consent, and if none of them applies, obtain explicit consent.

When cookies process data as a visitor adds products to the cart, the guide’s e-commerce example indicates that you may be able to rely on Article 5(2)(c) of the Law, the condition concerning the establishment or performance of a sales contract. If you intend to rely on legitimate interest, the Authority recommends first carrying out a balancing test, weighing the visitor’s fundamental rights and freedoms against your own interest. Load-balancing and site security cookies are the examples the guide gives for this condition.

Cookies that do not need explicit consent under the guide

• Session cookies that keep track of a user’s input while they fill in a form or add items to their shopping cart.
• Authentication cookies that identify the user once they log in, as long as they are limited to the session.
• Security cookies that detect repeated failed login attempts, and cookies used for site security.
• Media player session cookies that store the technical data needed to play video or audio.
• Load-balancing cookies that distribute requests across servers.
• Cookies that personalize the interface for the duration of the session, such as remembering the language a user picked by clicking a button.
• The consent management platform’s own cookie, which remembers the visitor’s cookie choices for a set period.

In this list, the load-balancing cookie falls under Criterion A and all the others under Criterion B. According to the guide’s annex of bad examples, asking for explicit consent for cookies that are used for the site’s basic functions and fall under Criterion A or B is incompatible with the principle of “lawfulness and fairness.” Do not tie the cart or security cookie to the “Accept” button; show this group as always on in the preference panel and explain in one sentence why it is needed.

Cookies that need explicit consent

Under the guide, cookies used for behavioral advertising need explicit consent. So do advertising cookies used for frequency capping, ad affiliation, click-fraud detection, market research and product development. Tracking cookies that social network plug-ins use to follow both members and non-members also fall outside Criterion B. Where it is not obvious that the visitor explicitly asked for a feature, the functional cookie used for that feature needs explicit consent too.

Persistent cookies that keep a visitor logged in even after the browser is closed do not fall under Criterion B, according to the guide, because visitors may not realize that they are still logged in after closing the browser. A common solution is to add a checkbox such as “remember me (uses cookies)” to the sign-up or login screen; the box makes clear whether the visitor explicitly wants this service. If your platform’s login screen has no such option, ask your platform provider.

Conditions for first-party analytics cookies

First-party analytics cookies can be considered to fall under Criterion B when their purpose is limited to measuring the site’s audience and managing its day-to-day running. Two conditions apply: the data must be used only to produce anonymous statistics, and it must not serve to track people across different sites. Masking IP addresses, keeping the cookie’s lifetime reasonable and not passing the collected data on to third parties are also listed among the measures you can take. If your measurement tool recognizes the visitor on other sites as well, or uses the data it collects for anything other than anonymous statistics, the guide’s conditions are not met; move that tool into the group that requires explicit consent. If it passes the data on to an ad network or another third party, putting it in that group as well is the more cautious starting point.

Set up your consent banner following the Authority’s examples

The guide’s annexes present a banner and a preference panel as examples of good practice, together with four bad examples. The setups in the bad examples can turn up in ready-made banner templates too, so compare your own banner against each point below.

• Show the cookie management panel as a pop-up or banner as soon as the visitor enters the site. The Authority regards it as good practice to present the “accept,” “reject” and “preferences” buttons equally in terms of color, size and font size.
• In the preference panel, set the categories that require explicit consent to off by default. Toggles that are already switched on appear among the bad examples, described as a system that starts processing without obtaining the person’s consent.
• In the banner text, briefly state the purposes of the cookies (such as personalization, analytics or advertising) and the parties that place them.
• Do not use the sentence “By using our site, you consent to the use of cookies”; continuing to use the site does not amount to explicit consent to cookies.
• Keep the link to the information notice separate from the link that opens the preference panel. One of the bad examples is criticized for a single “more information” link that does not make clear what it opens.
• Let visitors give separate consent for each purpose. According to the guide, social media features and personalized advertising are different purposes.
• Do not bundle consent to advertising cookies into your terms of use or privacy notice, and do not make it a precondition for shopping.

Cookie walls, which keep content hidden until every cookie has been accepted, get a section of their own in the guide. If you make consent a precondition for entering the site, the visitor may be regarded as not having decided of their own free will, and the consent you obtain may be invalid; the Authority adds that fair alternatives may be offered, provided each case is assessed on its own merits. For a store, the simplest approach is to make sure that a visitor who clicks “Reject all” can carry on shopping without interruption.

Visitors must be able to withdraw the consent they have given, which means the preference panel has to be within their reach at all times. A preference panel that sits in a corner of the page as a small icon, or as a thin banner that does not cover the content, is cited in the guide as a good example. The guide also warns against “consent fatigue”: do not ask visitors again every time they arrive; instead, remind them of their choice at intervals proportionate to the cookie’s lifetime. Put separate “Cookie Information Notice” and “Cookie Preferences” links in your site’s footer, so that visitors can find their way whether they want to read the notice or change their mind.

The text the banner shows first (the “first layer,” in the guide’s terms) could read like this:

We use strictly necessary cookies for your cart, your account login and your cookie choices. If you accept, we will also use our own cookies and those of our partners to personalize the site, measure visits and show you relevant ads. You will find the details in our Cookie Information Notice, and you can change your choice at any time using the icon in the corner.

[Accept all] [Reject all] [Manage preferences]

Whichever tool you use to build the banner, open it on a phone and on a desktop separately before it goes live. Check with your own eyes that the accept, reject and preference options look equal and that, on a small screen, the banner does not cover the product image or the “Add to cart” button. In the Pushouse cookie management app, you edit the customizable banner and publish it from the admin panel; the preference controls are prepared together with you during setup, based on the cookies your site uses.

When the cookie banner, a newsletter invitation and campaign pop-ups all open at the same time, the product page can disappear from view on a phone. Do not open any other pop-up until the visitor has responded to the cookie banner. An exit-intent pop-up, which shows a brief survey to visitors getting ready to leave the site, is another window that appears on screen; check on a phone whether it opens at the same time as the banner.

What to include in your cookie policy

The structure of a cookie information notice is set by Article 10 of the Law and by the Communiqué on Principles and Procedures to be Followed in Fulfilment of the Obligation to Inform, which the guide also refers to. Under the Law, when you obtain the data you must tell the visitor who your company is as data controller, and who your representative is if you have one; why the data will be processed; who it may be passed on to and for what purpose; how and on which legal basis it is collected; and what rights Article 11 gives them. The Authority’s cookie-specific recommendation is that the notice should also clearly state each cookie’s name, purpose, lifetime and whether it is first-party or third-party.

For an online store, this information fits into the following sections of the cookie policy:

1. The identity of the data controller, meaning the legal name and address of the company publishing the notice in its capacity as data controller, followed by the purpose of the notice.
2. A short explanation of cookie types by lifetime, party and purpose.
3. The name, purpose, retention period and party of every cookie you use.
4. The legal basis for each group of cookies. For cookies that fall under Criterion A or B, such as strictly necessary cookies and first-party analytics cookies that meet the guide’s conditions, state which of the conditions in Article 5(2) of the Law you rely on; the Authority’s sample notice cites subparagraph (c) or (f) for these cookies. For functional, analytics and advertising cookies outside Criteria A and B, the legal basis is explicit consent.
5. The parties the data is transferred to, and information on transfers abroad.
6. How to manage preferences through the panel or icon on the site and through browser settings.
7. The rights under Article 11 of the Law and the channel through which requests can be submitted.
8. The date the notice was last updated.

The Authority has also published a sample cookie information notice in Annex 4 of the guide; its table gives each cookie’s name, purpose, party and retention period in separate columns. Rather than writing from scratch, you can follow the order of sections in that notice, but the cookie names, lifetimes and company details in the sample are illustrative, so replace all of them with the information in your own inventory. In the cart cookie example below as well, fill in the lifetime and party with the real values from your own platform:

Cookie name: {{cookie name}}. Purpose: To remember the products you add to your cart as you move between pages. Party: First-party cookie placed by our site. Lifetime: {{retention period}}. Legal basis: Establishment or performance of the sales contract (Article 5(2)(c) of Law No. 6698); it does not rely on your explicit consent. If you block it, your cart may not work.

In the browser settings section, add this warning for visitors: “If you block strictly necessary cookies in your browser, parts of the site such as the cart and account login may not work.” Link to the cookie help pages of commonly used browsers as well; the Authority’s sample notice gives these links for Chrome, Firefox, Safari and Opera.

Do not leave the section on transfers abroad empty. If a site operating in Türkiye transfers data through the cookies of companies based abroad, that transfer must comply with Article 9 of the Law, according to the guide. The same transfer must also comply with the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad, published in the Official Gazette (Resmî Gazete) No. 32598 on July 10, 2024. When you list the providers of your advertising and measurement tools, note where each one is based as well.

In the guide’s words, the information must be provided at the latest when the data is obtained, that is, as the visitor enters the site, and the burden of proving that you did so rests with you. The Board’s Decision No. 2020/173 and the Communiqué make one more point clear: where processing relies on explicit consent, informing the visitor and obtaining their explicit consent must be done separately. Do not put an “I have read and accept” checkbox under the notice; such a box merges information and consent into a single step and is at odds with the Board’s approach. The visitor reads the notice and gives consent separately, through the banner or the preference panel.

Do not mix up cookie consent and consent to commercial messages

Law No. 6698 defines explicit consent as freely given, specific and informed consent. Consent given on a cookie banner is limited to the cookie purposes described on that banner. When a visitor clicks “Accept all,” that does not mean you can send them campaigns by WhatsApp or email. Under Law No. 6563 on the Regulation of Electronic Commerce, commercial electronic messages such as campaign messages may be sent to recipients only if their prior consent has been obtained.

Ask for consent to commercial messages in a separate step, stating what you will send; if you will later use that consent in WhatsApp marketing campaigns, keep a record of the exact wording the visitor agreed to and the date of their consent. Lead capture pop-ups are separate windows that invite visitors to join your customer list; they explain why visitors should join and let them share their contact details of their own accord. In the invitation, state clearly which channel you will use to contact visitors and what kind of messages they will receive. We explain how consent to commercial messages relates to İYS (İleti Yönetim Sistemi, Türkiye’s Message Management System for commercial electronic messages) and how to remove customers without consent from your campaign list in our article on splitting customers into groups for campaign messages.

Keep the cookie policy and banner up to date after launch

A cookie inventory is not static. A new ad platform, a different measurement tool, a theme change or a move to another e-commerce platform can add new cookies to your site. The Authority’s checklist also covers removing the cookies you do not need, documenting everything you do, setting an appropriate review period and keeping records of cookie consent for an appropriate length of time. Remove the tags of ad accounts you have closed and of former agencies from your theme. Find out whether the cookie tool you use records visitors’ choices along with the date and the option selected.

For most stores, a sensible routine is to update the inventory whenever a new tool is added and to review the entire list from scratch at least once a year. Have it written into your workflow that your agency notifies you before adding a new tag to your site. According to the guide, informing visitors about third-party cookies and obtaining their consent is the obligation of both you and the company that places the cookie; you can also add a clause on this to your contract with the provider.

Test your consent setup in three steps in a private (incognito) window. Before you start, close any incognito windows that are already open: in Chrome, a new incognito window opened while another one is still open shares the same session and the same cookies. First, open the site and, without clicking any button, look at the cookie list in the browser’s developer tools; since the guide asks for explicit consent to be obtained before cookies are placed, no cookie that needs explicit consent should appear at this stage. Next, click “Reject all,” reload the page, browse a few pages and look at the list again; if a new advertising or third-party measurement cookie has been added, the visitor’s choice is not being applied in the background. Finally, close all incognito windows, open the site in a new incognito window and use “Manage preferences” to turn on analytics only; the only cookies added alongside the strictly necessary ones should be analytics cookies. If at any step you see a cookie you did not expect, check with your agency or tool provider whether the tags load only after consent.

If you would like to plan the banner and preference panel around your own site, you can tell us about your site and your needs through our contact form; the Pushouse team will work out with you which banner and preference experience to use.