E-commerce website legal requirements: Required pages, distance sales, KVKK, ETBİS, and e-Archive checklist (2026)

Onur Ertem
October 31, 2026

Briefly: A store selling online to consumers in Turkey must present contact and transaction guide information, precontract information and the distance contract text, withdrawal and return conditions, and a privacy notice under KVKK (Turkey’s Personal Data Protection Law) on its website; consent management is also required for nonessential cookies. In addition, ETBİS (Turkey’s Electronic Commerce Information System) registration is completed before operations begin, consent for marketing messages is managed through İYS (Turkey’s commercial message registry), and invoices are issued electronically under GİB (Turkey’s Revenue Administration) rules.

The list of legal requirements for an e-commerce website does not come from a single law; electronic commerce, consumer, personal data, and tax legislation must be read together. The checklist below separates the legal side of what is needed to open an e-commerce website page by page and links each item to the official text underlying it. The texts were checked in their current versions on mevzuat.gov.tr, kvkk.gov.tr, etbis.ticaret.gov.tr, and ebelge.gib.gov.tr on 26.09.2026.

Note: This article is for general information and is not a legal opinion. Legislation changes frequently; before implementation, the current text in official sources should be checked, and circumstances specific to the business should be assessed with a lawyer and certified accountant.

Which regulations underpin e-commerce website legal requirements?

An online store is subject to electronic commerce, consumer law, personal data, and tax rules at the same time. Law No. 6563 on the Regulation of Electronic Commerce establishes rules on providing information, orders, and commercial electronic messages. Article 48 of Law No. 6502 on Consumer Protection defines sales concluded online as “distance contracts” and regulates the right of withdrawal.

The details are in secondary regulations: the Distance Contracts Regulation for precontract information and withdrawal, the e-commerce service provider regulation dated 29.12.2022 for contact information and order steps on the website, and the ETBİS Communiqué for registration. Law No. 6698 and KVKK guides apply to personal data, while GİB’s Tax Procedure Law General Communiqué No. 509 applies to invoices.

Pages and elements an e-commerce website must have

The pages an e-commerce website must have can be ordered according to the information customers see before, during, and after purchase. The list below shows how obligations explicitly stated in official texts translate into website elements:

Contact page (business identification): Business name, MERSİS (Turkey’s central business registry) or tax number, address, KEP (registered electronic mail), email, and phone.
Transaction guide: Order steps, contract storage, and error correction tools.
Precontract information form: Information displayed before payment and confirmed by the customer.
Distance sales contract: Providing contract terms to the customer in a form that can be stored.
Withdrawal, return, and delivery conditions: The 14-day withdrawal period, return shipping, exceptions, and delivery time.
KVKK privacy notice: Accessible text on order, membership, contact, and newsletter forms.
Cookie policy and cookie preference panel: Explicit consent management for nonessential cookies.
Commercial electronic message consent: An unselected checkbox and İYS registration for campaign emails and SMS.
ETBİS registration: Registration through e-Devlet (Turkey’s e-government portal) before sales begin.
e-Invoice / e-Archive invoice: Issuing the invoice electronically and delivering it electronically to the customer.

The table below shows the basis and website location of each item in simplified form for e-commerce website legal requirements; the full article texts are in the linked official sources.

Requirement	Basis	Where on the website
Contact information	Law No. 6563, Art. 3; E-Commerce Regulation, Art. 5	A “contact” heading directly accessible from the homepage
Transaction guide	E-Commerce Regulation, Art. 7	A “transaction guide” heading directly accessible from the homepage
Precontract information and confirmation	Law No. 6502, Art. 48; Distance Contracts Regulation, Arts. 5-8	Checkout step, together with a checkbox
Ability to store contract text	Law No. 6563, Art. 3/4; E-Commerce Regulation, Art. 8	Checkout step + order email or account page
Withdrawal and returns	Distance Contracts Regulation, Arts. 9-15	Returns page, precontract information, footer
Privacy notice	Law No. 6698, Art. 10; Communiqué on Information Obligations	Beside forms, checkout step, footer
Cookie preferences	Law No. 6698, Art. 5; KVKK cookie guide	Panel opening on the first visit + cookie policy page
Message consent	Law No. 6563, Arts. 6-8; Commercial Electronic Messages Regulation	A separate, initially empty box in membership and checkout forms
ETBİS registration	ETBİS Communiqué, Arts. 5-8	Outside the website, through e-Devlet
e-Invoice / e-Archive invoice	Tax Procedure Law General Communiqué No. 509	Post-order email and account page

Contact heading and transaction guide: What should business identification include?

A business selling through its own website must display its identifying information completely under a “contact” heading directly accessible from the homepage. Under Article 5 of the regulation on intermediary service providers and service providers in e-commerce (Official Gazette 29.12.2022, as amended), a merchant states its trade name, MERSİS number, and registered address, while tradespeople and craftspeople state their first and last name, tax identification number, and registered address. A KEP address, email, phone, any business name and registered trademark, and professional chamber information are added.

Article 7 of the same regulation requires a second heading: “transaction guide.” This page explains the technical steps from product selection to order confirmation, whether the contract is stored, and how long the customer can access it. The order summary form used to correct errors before ordering and any alternative dispute resolution methods also appear here.

Are precontract information forms and distance sales contracts mandatory?

Precontract information is explicitly mandatory; if the customer does not confirm receiving this information, the contract is deemed not concluded. Under Article 5 of the Distance Contracts Regulation, this information includes the product’s main characteristics, the seller’s name and MERSİS or tax number, the total price including taxes, delivery time, withdrawal conditions and return carrier, withdrawal exceptions, and consumer arbitration committees and mediation. Article 6 requires the text to be written in plain language and at least 12-point type.

The answer to “is a distance sales contract mandatory” has two layers. The regulation does not provide a separate contract template; its annex contains only a sample withdrawal form, but every consumer sale concluded online is already a distance contract by law. Article 3/4 of Law No. 6563 requires the buyer to be able to store contract terms, and Article 8 of the E-Commerce Regulation requires those terms to be provided to the buyer physically or electronically. In practice, the text approved at checkout is sent with the order email or stored in the customer’s account.

The checkout step itself is also regulated. Before confirming the order and entering payment information, the total amount including tax and delivery costs must be clearly visible and an order summary form provided. Under Article 8 of the Distance Contracts Regulation, the customer is informed immediately before confirmation that the order entails a payment obligation; under Article 19, options generating additional charges cannot be preselected. After receiving the order, the business confirms it without delay through the website and additionally through at least one means such as email, text message, or phone.

The right of withdrawal, returns, and delivery periods

The consumer may withdraw from the contract within 14 days without giving a reason or paying a penalty; for goods, this period starts on the day the product is received. The seller refunds all payments collected, including delivery costs, within 14 days from the date the returned product is handed to the carrier specified in the precontract information. Under Article 12, updated by the amendment dated 24.05.2025, the consumer cannot be held responsible for return costs when the product is sent through the seller’s specified carrier; if the seller specified no carrier, return costs cannot be requested either.

Not every product is subject to withdrawal rights; exceptions are listed in Article 15 and must also be stated in precontract information. Custom-made products, goods that may spoil quickly or pass their expiration date, and products unsuitable for return for hygiene reasons after opening their packaging are on this list. In stores selling food, such as the Mirzade Baklavaları e-commerce website, clearly displaying this exception matters. One subparagraph of the list was repealed in 2025, and three were annulled by the Tenth Chamber of the Council of State’s decision dated 6.5.2026; the current text should be checked when preparing the returns page.

There is also an upper limit for delivery. The seller must deliver within the promised period, and for sales of goods other than custom-made products, this period cannot exceed 30 days. The regulation requires documents relating to these transactions to be retained for three years, while Law No. 6563 requires records within its scope to be retained for ten years.

Let us build the store’s page and form structure together

Planning the location of required pages and checkboxes in the checkout flow during setup is easier than patching them in later. Let us assess the structure of your existing or planned store together.

WhatsApp 0532 690 9924

KVKK e-commerce compliance: Privacy notices, explicit consent, and VERBİS

The first step in KVKK e-commerce compliance is fulfilling the obligation to inform at every point where personal data is collected. Article 10 of Law No. 6698 requires disclosure of the data controller’s identity, processing purposes, to whom and for what purposes data may be transferred, the collection method and legal ground, and the data subject’s rights.

A frequently confused issue is the difference between providing information and explicit consent. The Communiqué on Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform requires information and consent procedures to be carried out separately when processing relies on explicit consent, and purposes to be stated specifically and clearly. Under Article 5 of the Law, data necessary to enter into or perform a contract, such as a delivery address, may be processed without seeking explicit consent. A single box requiring consent to everything to complete an order blurs this distinction.

Article 16 of the Law obliges natural and legal persons processing data to register with the Data Controllers Registry (VERBİS), but the Board may grant exemptions based on objective criteria. Whether the business falls within an exemption should be checked through VERBİS and Board decisions. Article 12 requires appropriate technical and administrative security measures; SSL, updated plugins, and permission restrictions are the website side of this.

What should a cookie policy and cookie consent panel look like?

In most cases, cookies not strictly necessary for website operation should not run without explicit consent. The cookie guide published by the Personal Data Protection Authority (July 2025 edition) recommends first assessing processing conditions other than explicit consent and obtaining consent if none can be relied on. The guide is advisory and offers examples of good practice:

The panel opening on the first website visit presents “accept,” “reject,” and “preferences” buttons equally in color, size, and font size.
Cookies requiring explicit consent are initially inactive in the panel.
The panel contains an explanation of data processing through cookies or a link to the cookie policy.
A small icon or strip remains in the corner of the page so consent can be withdrawn easily later.
Consent for advertising cookies is not obtained by inserting it into documents such as terms of use.

The cookie policy page explains which cookies are used, for what purpose, for how long, and by whom; it is updated together with the panel when a new analytics or advertising tag is added.

Commercial electronic message consent and İYS

Prior consumer consent is required for campaign emails, SMS, or promotional calls. Under the regulation dated 15.07.2015 on commercial electronic messages, businesses sending messages register with the Message Management System (İYS), and messages cannot be sent to a person without consent in İYS. Consent received through a website form loses its validity if it is not entered into İYS within three business days.

The form’s design is also regulated. The consent box cannot be preselected, and newsletter consent cannot be a precondition for selling a product; if consent is obtained within a sales or membership contract, it is written under a separate heading, with an option to reject, in at least 12-point type. Consent is not required for informational messages such as orders, delivery, and payment collection, but these messages cannot contain product promotions. Under Article 8 of Law No. 6563, message sending is stopped within three business days after receiving an opt-out request.

What is ETBİS registration, and when and how is it completed?

ETBİS is the information system through which the Ministry of Trade registers businesses conducting e-commerce; businesses selling through their own websites register before starting operations. Under the Communiqué on the Electronic Commerce Information System and Notification Obligations, merchants enter their MERSİS and tax identification numbers, tradespeople and craftspeople their Turkish identity and tax identification numbers, and additionally the selling domain and any mobile application. Registration with ETBİS is completed through the e-Devlet portal by the person themselves or an authorized representative.

A series of notifications is completed within 30 days after registration. Under Article 6 of the communiqué, these include a KEP address suitable for official notifications, product types offered, payment methods, shipping and e-commerce infrastructure providers, and the country and address of databases storing personal data. Changes to the payment institution, shipping company, domain, or location of servers storing data are also reported within 30 days. The developer handling setup providing server location and infrastructure information to the business in writing makes notification easier.

e-Invoice and e-Archive: Invoicing obligations for online sales

Taxpayers selling online must switch to e-Invoice and e-Archive Invoice applications when they exceed a certain revenue threshold. According to the current footnoted text of Tax Procedure Law General Communiqué No. 509 published by GİB, taxpayers selling through their own website or an intermediary service provider with gross sales revenue of 500 thousand TL or more in the 2022 and subsequent accounting periods switch to these applications by the start of the seventh month following the accounting period in which they exceeded the threshold. Under the communiqué, taxpayers not yet included in this system have also issued invoices as e-Archive without an amount limit since the beginning of 2026; for taxpayers under simplified taxation and the operating account basis, the start is 2027, subject to the communiqué’s exceptions.

An e-Archive invoice for an online sale includes a statement that the sale was made online, the website address, payment method and date, carrier information, and dispatch date, and is delivered electronically to the customer. Which rule applies to the business, the choice of integrator, and the transition date should be clarified with a certified accountant.

Common mistakes, implementation in WooCommerce, and 2026 penalties

The first mistake to avoid when meeting e-commerce website legal requirements is contract texts copied from another website; these texts may retain another company’s name or an incorrect returns address. Other typical gaps include missing MERSİS and KEP information on the contact page, a preselected newsletter box, only an “accept” button in the cookie panel, and failure to update server or payment information reported to ETBİS.

On WooCommerce, the basic structure is ready. According to the WooCommerce documentation, the store’s privacy policy and terms and conditions page can be selected in checkout settings; account and privacy settings manage guest purchases and personal data retention periods. On WooCommerce websites built by Onur Freelance, page structure, checkboxes, and forms are prepared during setup; the legal content of texts is clarified with the business’s lawyer and certified accountant. For setup scope, see the e-commerce website development page; for infrastructure options, the e-commerce script selection article; and for budgeting, the 2026 setup cost guide.

The penalties for shortcomings are concrete too. According to the 2026 table appended to the text of Law No. 6563 on mevzuat.gov.tr (Official Gazette 25.12.2025/33118), penalties for violations of information provision, displaying order conditions, and unapproved messages are 2,859 – 14,309 TL; for order confirmation and missing identifying information in messages, 2,859 – 28,620 TL; and for promotional conditions and failure to honor opt-outs, 5,723 – 42,930 TL; in bulk unapproved sending, the first penalty may be increased up to tenfold. Under Article 77 of Law No. 6502, the 2026 amount for violations of distance contract obligations is 3,973 TL per transaction or contract (Official Gazette 23.12.2025/33116). Amounts in Article 18 of KVKK are revalued annually under the Misdemeanors Law.

E-commerce website legal requirements are not a one-time form-filling task; they are updated as the product range, shipping company, hosting, or marketing tools change. When page structure is prepared correctly during setup and texts are clarified with specialists, the store both inspires customer trust and leaves a defensible record for an inspection.

Let us go through the checklist together for a store ready to sell

If a new WooCommerce store is planned or missing pages are suspected on an existing website, let us start with a free initial assessment of page structure and checkout flow.

WhatsApp 0532 690 9924

The list ordering legal steps together with company formation, payment, and shipping steps appears in the requirements for building an e-commerce website guide.

Related guides

How do you get a virtual POS?

Frequently asked questions

What is legally required to open an online store?

On the website, contact and transaction guide pages, precontract information and distance contract text, withdrawal and return conditions, and a KVKK privacy notice are required; consent for nonessential cookies is generally managed through a cookie panel. Outside the website, ETBİS registration is completed before operations begin, İYS registration is opened if marketing messages will be sent, and invoices are issued according to GİB rules.

Is a distance sales contract mandatory?

Every online sale to a consumer is a distance contract by law, and precontract information and confirmation are mandatory beforehand. The regulation does not provide a ready-made contract template, but contract terms must be provided to the customer in a form that can be stored; this is generally achieved through text approved at checkout and sent by email.

What is ETBİS registration, and is it mandatory?

ETBİS is the information system through which the Ministry of Trade registers businesses conducting e-commerce. Businesses selling through their own websites register through e-Devlet before operations begin and report their KEP address, payment methods, shipping, and infrastructure information within 30 days after registration.

Are precontract information and the contract text the same thing?

They are different but connected. Precontract information contains information that must be provided before the contract is concluded and, under the Distance Contracts Regulation, forms an integral part of the contract; the contract text governs the parties’ rights and obligations.

Does KVKK require explicit consent for everything on an e-commerce website?

No; data necessary to enter into or perform a contract, such as a delivery address, may be processed without explicit consent under Article 5 of KVKK, but information must still be provided. For activities relying on no other processing condition, such as marketing and nonessential cookies, explicit consent is obtained separately from the information notice.

Is a cookie consent panel mandatory?

If nonessential cookies do not rely on another processing condition, explicit consent is required, and a cookie preference panel is the practical way to obtain it. The KVKK cookie guide presents equally visible “accept,” “reject,” and “preferences” options and initially inactive consent-based cookies as good practice.

How many days is the e-commerce withdrawal period, and who pays return shipping?

The withdrawal period is 14 days, and the consumer can exercise this right without giving a reason; for goods, the period starts on the day the product is received. If the product is returned through the carrier specified by the seller in precontract information, the consumer cannot be held responsible for return costs, and if the seller specified no carrier, return costs cannot be requested either.

Is e-Invoice mandatory for an e-commerce website?

Under Tax Procedure Law General Communiqué No. 509, taxpayers selling online with gross sales revenue of 500 thousand TL or more in 2022 and subsequent periods switch to e-Invoice and e-Archive. For those outside this system, invoices are also issued as e-Archive without an amount limit from the beginning of 2026; the start is 2027 for simplified taxation and operating accounts, and the situation applicable to the business should be clarified with a certified accountant.