Explicit Consent

The KVKK defines explicit consent as “consent relating to a specific matter, based on information and expressed with free will” (Art. 3). It is one of the conditions for processing personal data, but in practice it is the one most often misused.

The Three Elements of Valid Explicit Consent

1. Relating to a specific matter: Consent must relate to a specific processing activity. Catch-all statements such as “I consent to the processing of my personal data” are invalid.
2. Based on information: The individual must know what they are consenting to. The purpose, scope and consequences of the processing must be explained clearly before consent is obtained.
3. Expressed with free will: Consent cannot be made a precondition for a product or service. If an individual who refuses consent cannot use the service, their will is not free.

Explicit consent can be withdrawn at any time. Withdrawal has effect for the future: processing carried out until then remains lawful, but processing based on consent must stop.

When Should Explicit Consent Be Used?

Explicit consent is only one of the processing conditions under the KVKK and does not take priority. If the processing can be based on another condition, such as the conclusion or performance of a contract, the controller’s legal obligation or its legitimate interest, consent should not be requested. Asking for consent when another condition applies misleads the individual into thinking that the processing depends on their will, and is treated as an abuse of rights in the Board’s practice.

Explicit consent is mainly relevant for marketing and profiling activities that cannot rely on another condition, certain processing of special categories of personal data not provided for by law, and occasional cross-border transfers. Since the 2024 amendment, regular cross-border data transfers can no longer be based on explicit consent.

Common Mistakes

• Combining notice and consent in one text: The duty to inform and explicit consent are separate obligations and should be fulfilled separately.
• Pre-ticked boxes: Consent is not obtained without an active statement by the individual.
• Confusing it with approval for commercial messages: Approval obtained under Law No. 6563 for marketing e-mails and text messages and explicit consent under the KVKK are different regimes.
• Being unable to prove it: The burden of proving consent lies with the controller; when, through which text and through which channel consent was obtained should be recorded.