Unsolicited SMS and Marketing Calls (KVKK Decision 2026/1183)

Decision 2026/1183 of the Personal Data Protection Board and the public announcement dated 21.07.2026 on the use of third-party contact details for advertising and marketing purposes

If a customer or “brand ambassador” gives the company a friend’s phone number, this alone is no legal basis for calling that person or sending them marketing SMS. Nor does it count as valid explicit consent if the person listens to the campaign, asks questions or simply does not end the first call.

Unsolicited SMS and marketing calls are risky not only under the rules on commercial electronic messages. Obtaining and using the phone number itself can trigger sanctions under the Turkish Personal Data Protection Law No. 6698 (“KVKK”). In Decision No. 2026/1183 dated 10.06.2026, the Personal Data Protection Board (“Board”) examined the “brand ambassador” programme of a savings finance company. The company had obtained third parties’ phone numbers through its customers and used them for advertising and marketing. The Board made three findings: The phone number had been recorded without a valid processing condition. A marketing call was made, and an SMS was sent to this number. Continuing the conversation did not amount to valid explicit consent. As a result, the Board imposed an administrative fine of TRY 1,000,000.

The public announcement of 21.07.2026, published around six weeks later, did not limit this approach to brand ambassador programmes. It contains a general warning for all sectors: contact details obtained from third parties through references, recommendations, word-of-mouth referrals or customer suggestions must not simply be used.

In this article we cover:

the brand ambassador model underlying KVKK Decision 2026/1183,
the criteria for valid explicit consent in unsolicited SMS and marketing calls,
the timing of the duty to inform where contact data is obtained from third parties,
the difference between opt-in consent in the central message system İYS (İleti Yönetim Sistemi) and the processing condition under the KVKK, and
practicable compliance steps for customer referral programmes

What Were the Facts of KVKK Decision 2026/1183?

Customers of the savings finance company submitted, via a mobile app, the phone numbers of acquaintances who might be interested in the savings finance system. In return for these referrals, the “brand ambassadors” received a bonus. The complainant’s phone number entered the company’s system in this way. He was then called by the call centre and received an SMS with campaign content.

In its defence, the company argued: information had been provided during the first call, and the data subject had consented by wishing to receive further information. The person had asked questions about the campaign during the call. The SMS had contained an easy opt-out. Upon the person’s request, the data had been deleted and the messages stopped.

The Board assessed the call recording differently. According to the decision summary, the phone number had been entered into the system by a third party before any contact with the data subject. During the first call, the person was neither informed nor directed to an information channel; instead, the campaign presentation continued. That the person continued the conversation and showed interest was treated not as an explicit declaration of will regarding the processing of their data, but at most as implied interest in the campaign content. Nor had the person been told that the call was being recorded.

Defences the Board Rejected in Unsolicited SMS and Marketing Calls

Data controller’s defence	Board’s approach
“Our customer gave us the number; the person wanted information.”	A third party’s statement creates neither a valid processing condition nor explicit consent on behalf of the data subject.
“The person continued the call and asked questions.”	Showing interest in a campaign or not ending a call is not specific, informed explicit consent to the processing of personal data.
“The SMS contained an opt-out option.”	An opt-out does not replace the legal basis required at the outset. A subsequent right to object (opt-out) does not retroactively create the consent (opt-in) that was needed from the start.
“After the request, we deleted the record and stopped the messages.”	Subsequent deletion and blocking is a correct remedial step, but it does not undo past processing carried out without a legal basis.

How Does the Announcement on Data Obtained from Third Parties Complement the Decision?

The decision is dated 10.06.2026, the public announcement 21.07.2026. This chronology shows that the announcement generalises the approach taken in the individual case. The Personal Data Protection Authority made clear in the announcement: where phone numbers, e-mail addresses and similar contact details are obtained from third parties through references, recommendations, brand ambassadors, word-of-mouth referrals or customer suggestions, this gives the data controller no direct authority to process them for advertising and marketing purposes.

The Board does not say, however, that every processing of data for advertising and marketing purposes requires explicit consent without exception. Whether one of the other processing conditions under the KVKK applies must be assessed separately in each case. In some models, though, there is no prior relationship with the data subject; the person has not approached the company, and their contact details were entered into the system solely by a rewarded referrer. In such cold-acquisition models, relying on legal bases other than explicit consent – above all “legitimate interest” – carries significant risk. In the case at hand, the Board concluded that no valid processing condition existed.

Key distinction: The Communiqué on the duty to inform allows, for data obtained from third parties, “information at the time of first contact”. This does not automatically make the first contact lawful. The provision only determines the timing of the information; it does not create the legal basis required for recording the phone number and making contact.

Six Takeaways from the Decision on Unsolicited SMS and Calls

Personal data processing starts before the first call

The very act of the brand ambassador entering the phone number into the app and its storage in the company’s system is a processing activity in its own right. The approach of “call first, obtain consent during the call” therefore does not retroactively cure the missing legal basis for the earlier recording of the number and the first call.

Informing does not replace a processing condition

The duty to inform and the processing condition are two separate legal requirements. Even a complete privacy notice does not make processing lawful if no processing condition under the KVKK exists. Tellingly, the Board therefore took no separate action regarding the duty to inform: the core violation was that the data had been processed from the outset without a valid processing condition.

Explicit consent must be active, specific and informed

Listening to a campaign, asking questions, not ending the call or not using the opt-out does not amount to explicit consent to data processing. Valid explicit consent requires that the person knows in advance which data will be processed, for which purposes and with which consequences, and that they give an unambiguous affirmative statement specific to that processing. Informing and obtaining consent must also be carried out separately.

An opt-out does not cure the initial unlawfulness

An unsubscribe link or opt-out code in the SMS is important so that the person can easily stop the communication. But it only helps manage future messages. It does not legitimise a marketing call or SMS made without a lawful basis. In other words, an opt-out is no substitute for the required opt-in.

Call recording is a separate processing activity

Recording the marketing call must be assessed separately from using the phone number and sending the campaign message. The purpose, legal basis, retention period and access and transfer details must be clearly stated in the privacy notice, and a separate, appropriate processing condition must exist for the audio recording.

A single complaint can put the entire programme under scrutiny

The Board held that its assessment of the complainant’s data also applies to the data of all other individuals processed in the same way under the brand ambassador programme. What was examined was therefore not an isolated call-centre error but the programme design. Paying an incentive is not unlawful in itself. It does show, however, that the company systematically determined the purpose and method of data collection – which sharpens its role as data controller and the corporate risk.

Are Brand Ambassador and Customer Referral Programmes Banned Altogether?

No. Read in isolation, some wording in the decision summary might suggest that personal data must as a rule be collected directly from the data subject. Read together with the Communiqué and the announcement of 21.07.2026, however, obtaining data from third parties is not absolutely prohibited. What matters is that a valid processing condition exists at the moment the data is obtained, that the general principles of the KVKK are observed, and that the information is provided within the time limits and by the methods set out in the Communiqué.

Companies should not assume, however, that they can create the legal basis after the fact when using third-party data purely for marketing. Especially in reference and referral models where the person themselves has not requested anything, the safest design is this: the referrer receives a shareable link or code, and the data subject registers in the company’s system of their own accord.

Is İYS Consent Sufficient for KVKK Purposes?

The processing condition under the KVKK and consent to commercial electronic messages under e-commerce law are independent of each other. Consent recorded in the İYS does not, by itself, show that the phone number was obtained in line with the KVKK. Conversely, having a processing condition under the KVKK does not remove the need for commercial message consent.

Under the rules on commercial electronic messages, consent may not be requested by sending a commercial message to the recipient’s electronic address. Using a first marketing call solely as a tool to obtain consent is therefore an additional risk. Finally, the prior-consent exemption for merchant and tradesperson recipients does not change the fact that a natural person’s business e-mail address or phone number remains personal data under the KVKK.

For more detail on the processing conditions under the KVKK, data controller obligations, the VERBİS registry and international data transfers, see our guide to personal data protection law in Turkey (KVKK).

How to Make Brand Ambassador Programmes KVKK-Compliant

Redesign the referral model: Instead of customers entering third parties’ phone numbers or e-mail addresses into the system, use links, invitation codes or application forms that the data subject uses of their own accord.
Do not tie the incentive to raw contact data: Tie the bonus not to the sharing of a third party’s contact details, but to the referred person’s own registration or to a lawfully defined later stage.
Determine the legal basis before obtaining the data: Document the KVKK processing condition separately for each processing step – including the customer relationship management (CRM) entry, first call, SMS, e-mail, profiling and call recording.
Separate informing from consent: Provide the information in advance, clearly and comprehensibly. If you rely on explicit consent, additionally obtain an active and demonstrable affirmative statement. Do not build a system on silence, on the call continuing or on the absence of an objection.
Review call-centre scripts and recordings: Create standard scripts for the first contact, marketing content, recording notice, opt-out requests and information references; audit actual practice through sampling.
Manage KVKK and İYS records together: For each channel, keep the commercial-message consent and opt-out status and the KVKK records on legal basis and information separate, but manage them in a coordinated way.
Review existing lists retrospectively: Remove from marketing use any third-party lists whose source, date of collection, legal basis or information and consent record cannot be established; apply retention and deletion processes.
Respond to data subject requests on time: Because the decision found that the company had answered the request within 30 days, no sanction was imposed on this point. Request management is a compliance area of its own, independent of the underlying processing violation.

Frequently Asked Questions on Unsolicited SMS and Brand Ambassador Programmes

Is it lawful for a customer to give the company a friend’s phone number?

A customer passing on the number does not entitle the company to call that person or send them SMS for advertising and marketing purposes. Before recording and using the number, the company must be able to rely on a valid processing condition under the KVKK.

Can explicit consent be obtained during the first phone call?

Explicit consent obtained after proper information can only take effect for subsequent processing. It does not retroactively legalise the earlier recording of the number or the first call. Moreover, commercial message consent may not be requested by sending a commercial electronic message.

Does continuing the call or asking questions count as consent?

No. In the Board’s view, listening to the campaign, asking questions, not ending the call or not using the opt-out is not specific, informed explicit consent given of one’s own free will.

Is commercial message consent recorded in the İYS sufficient under the KVKK?

No. İYS commercial message consent and the processing condition under the KVKK are different legal requirements. Compliance must be ensured separately under both sets of rules.

How high is the KVKK fine for unsolicited SMS?

The administrative fine is determined according to the circumstances of each case; there is no fixed amount. In Decision 2026/1183, the Board imposed a fine of TRY 1,000,000 on the data controller.

When must the data subject be informed if the data comes from a third party?

The information must be provided within a reasonable period after the data is obtained; where the data is used to make contact, at the time of first communication; where the data is transferred, at the latest at the first transfer. These time limits do not, however, replace the legal basis required for obtaining the data and for the first contact.

Conclusion

Read together, Decision 2026/1183 and the announcement of 21.07.2026 send a clear message from the Board: reference, referral and brand ambassador models are not a free zone for using personal data in advertising. The statement of the person sharing a third party’s contact details does not replace the data subject’s consent, and interest or silence during the first call does not legalise the earlier processing.

The right approach for companies is not to try to “complete” consent at first contact, but to design the data flow from the outset so that it remains in the data subject’s hands. There is no inherent conflict between a commercially effective referral programme and KVKK compliance. It does require, however, that data source, legal basis, information, commercial message consent, call recording and deletion processes are brought together in a single end-to-end compliance model.

Author: Müge Şengönül