Cookie Policy

A cookie policy is a text explaining the cookies and similar tracking technologies used on a website or mobile app. It is the cookie-related part of the duty to inform under the KVKK and a precondition for users to give informed consent.

What the Policy Should Include

• The controller’s identity and contact details,
• The types of cookies used and the purpose of each,
• Each cookie’s name, provider (first or third party) and retention period,
• Categories of personal data processed through cookies and the legal bases,
• Parties to whom data is transferred and information on cross-border transfer,
• How users can change their preferences and withdraw consent,
• Data subject rights and how to apply.

Common Mistakes

• The list in the policy not matching the cookies actually used,
• Presenting analytics and advertising cookies as “strictly necessary”,
• Not stating third-party providers and cross-border transfers,
• The policy being reachable only via a footer link and not from the cookie banner,
• Not updating the policy when new tools are added to the site.

Keeping It Current

Marketing teams adding new pixels and tags quickly makes cookie policies outdated. Regular cookie scans and legal review of new tools before launch keep the policy current. For sites targeting EU visitors, the GDPR and EU electronic communications rules should also be considered.