A compliant cookie policy explains the name, purpose, duration, and first-party or third-party status of every cookie used on the website; nonessential cookies are not activated until the visitor makes an active choice in the consent panel. In Turkey, the guiding document on this subject is the cookie guide issued under KVKK (Turkey’s Personal Data Protection Law); for websites receiving visitors from the European Economic Area and using Google advertising or measurement tools, Google additionally requires consent signals to be transmitted using the current version of consent mode.
This article covers which cookies the guide considers independent of consent, which require explicit consent, how the consent panel should be structured, what information the policy text should contain, and how Google consent mode connects to this structure. The explanations are general information; a separate legal assessment should be made according to the website’s own cookie inventory.
What is a cookie, and what types are there?
A cookie is a small text file that a website places in a visitor’s browser and reads back on subsequent requests; the same file can be used to remember a shopping cart or to track a visitor across websites. The Authority’s guide classifies cookies from three different perspectives:
- By duration: Session cookies deleted when the browser closes and persistent cookies remaining on the device until a specified date.
- By purpose: Strictly necessary (essential) cookies required for website operation, functional cookies remembering preferences, performance and analytics cookies producing visit statistics, and advertising and marketing cookies displaying ads based on interests.
- By party: First-party cookies placed by the domain in the address bar and third-party cookies placed by another domain.
These three dimensions are considered together. A short-lived session cookie staying on the same website and a third-party cookie from an advertising network retained for months are assessed very differently legally. The first step in a cookie policy is to create an inventory showing where each cookie on the website falls within these three dimensions.
What does the KVKK cookie guide cover?
The Guidelines on Cookie Practices offer good practice recommendations to website operators processing personal data through cookies; the current version published on the Authority’s website is dated July 2025. The guide is a guiding document explaining how the Law’s general provisions apply to cookies, rather than a binding regulation.
Two details matter regarding its scope. First, the guide excludes cookies that are not used to process personal data. Second, it explicitly states that it does not provide guidance on similar technologies such as pixels, device fingerprinting, local storage, and beacons; if these technologies are used, assessment must be based on the general provisions.
The guide uses two criteria to assess whether a cookie can be used without explicit consent. Criterion A is that the cookie is used solely to carry out communication over an electronic communications network. Criterion B is that the cookie is strictly necessary to provide a service explicitly requested by the user. Cookies meeting either criterion are addressed in the guide under processing conditions other than explicit consent.
Which cookies can be used without explicit consent?
According to the guide, cookies strictly necessary for a service requested by the user can rely on other processing conditions, such as legitimate interest or entering into a contract, instead of explicit consent; blocking essential cookies causes some parts of the website to stop working. The guide’s example scenarios are summarized in the table below.
| Cookie type | Criterion in the guide | Limitation |
|---|---|---|
| Form and shopping cart session cookie | Criterion B | Expected to expire no later than the end of the session |
| Login (authentication) cookie | Criterion B | Persistent login cookies spanning sessions fall outside Criterion B; the guide mentions a “remember me” checkbox as a common method |
| Load balancing cookie | Criterion A | Solely for server routing purposes |
| Language and interface preference cookie | Criterion B | Placed through the user’s explicit choice |
| Cookie remembering consent preferences | Criterion B | Its lifetime is determined according to the Law’s general principles |
| First-party analytics cookie | Criterion B | Anonymous statistics only; no cross-site tracking or transmission to third parties |
The final row should be read carefully. The guide makes assessment of first-party analytics cookies under Criterion B conditional on purpose-limited and proportionate data processing, techniques reducing identification risk such as IP masking, a reasonable cookie lifetime, and no transmission of data to third parties. Analytics setups in which data is shared with an advertising platform or used for advertising purposes may fall outside this framework.
Page contents
Which cookies require explicit consent?
Behavioral advertising cookies and tracking cookies from social network plugins cannot be considered strictly necessary for a service requested by the user and therefore require explicit consent under the guide. The guide states that cookies used for advertising remain within this scope even when used for secondary purposes such as impression frequency, click fraud detection, or market research.
There are also conditions for consent to be valid. According to the guide’s section on the elements of explicit consent, visitors must be told the cookie’s purpose, a retention period proportionate to that purpose, and whether it is first-party or third-party; consent must be given through an active action, such as clicking a button. Merely entering the website or continuing to use it does not count as consent. The guide also rejects embedding consent for advertising cookies within texts such as terms of use or privacy notices.
Let us build the website’s cookie inventory together
During the free initial assessment, the cookies and third-party tags loaded by the website are listed individually through the browser; those running before consent are shown. Panel and consent mode setup is carried out on the website, and obtaining a lawyer’s opinion on the legal content of the policy text is recommended.
How should a consent banner be structured according to the guide?
The guide presents opening a cookie management panel upon entry to the website and offering “accept,” “reject,” and “preferences” buttons with equal weight in color, size, and font size as an example of good practice. Making the rejection option gray, small, or hidden on a second screen undermines this equality. Converting the guide’s recommendations into a checklist produces the following items:
- Cookie categories subject to explicit consent are switched off by default on the preferences screen.
- The panel contains a brief explanation that personal data is processed through cookies and a link to the cookie privacy notice.
- No cookie requiring consent is loaded before a choice is made.
- Consent can be withdrawn easily afterward; the guide gives the example of a small icon or strip in a corner of the page that does not cover the content.
- The panel does not reopen on every visit; the guide highlights the risk of “consent fatigue” and considers reminders at intervals proportionate to the cookie lifetime appropriate.
- Access to the website is not made conditional on accepting all cookies; the guide states that such cookie walls may impair free will.
The panel needs to display with the same equality on phones too. Buttons appearing side by side on desktop but stacking vertically on mobile and pushing the “reject” option off-screen are a common design flaw.
The panel’s language also matters. Instead of vague expressions such as “to provide better service,” state why each category is used in a single sentence: advertising cookies to show interest-based ads, analytics cookies to measure visits, and functional cookies to remember preferences. Using category names identical to those in the policy table allows visitors to find their panel choice easily in the text. Differences in names between the policy text and panel are also among the first inconsistencies noticed in an audit.
What information appears in a cookie policy?
A cookie policy is the privacy notice prepared for personal data processing through cookies on the website and should clearly show each cookie’s name, purpose, duration, and party. The guide recommends explicitly including this information in the privacy notice; its attached sample cookie privacy notice also presents it in a table. The text’s structure generally follows this order:
- The data controller’s business name and the law and communiqué under which the text was prepared
- The definition of a cookie and the cookie categories used on the website
- The processing purpose and legal ground relied on for each category
- Cookie table: the cookie’s name, purpose, whether it is first-party or third-party, and retention period
- How preferences can be changed through the panel and browser settings
- The address to which data subject requests should be sent
The table must reflect the website’s actual situation. When a new plugin or advertising tag is added, a row is added to the table too; otherwise, the policy does not describe some of the cookies running on the website at all. Since plugins on WordPress websites commonly add their own cookies silently, inventory updates should be planned as part of regular maintenance.
What is Google consent mode v2, and who needs it?
Google consent mode is a technical structure that transmits a visitor’s choice in the consent panel to Google tags and makes the tags behave according to that choice; it carries the decision made in the banner to the tags rather than replacing the banner. The consent mode overview documentation explains consent types such as advertising storage (ad_storage) and analytics storage (analytics_storage), as well as two implementation methods: in basic setup, Google tags do not activate until the visitor specifies a preference in the panel; in advanced setup, tags run with the page and, when consent is denied, transmit limited measurement signals without writing cookies.
In its consent mode updates for EEA traffic documentation, Google announces that the ad_user_data parameter for sending user data for advertising purposes and the ad_personalization parameter for personalized advertising have been added to the consent mode API. Advertisers receiving data from users in the European Economic Area and wanting to continue using personalized advertising and measurement features must transmit consent signals to Google; for websites using their own banner, the documentation instructs them to implement consent mode v2. The same document also states that when a Google-certified consent management platform is used, the update is handled by that platform.
Is consent mode necessary for a website serving only Turkey?
The EEA-specific consent signal requirement does not directly apply to a website serving only visitors in Turkey; however, when a panel compliant with the KVKK guide is set up, consent mode is a practical tool to ensure that Google tags also avoid using cookies the visitor has rejected. If advertising tags continue writing cookies even though the panel says “reject,” the cookie policy remains only on paper.
For businesses collecting data from users in the EEA through Google tags, SDKs, or Google Analytics data linked to Google Ads and wanting to continue using personalized advertising and measurement features, consent mode v2 effectively becomes mandatory. How conversion measurement in Google Ads and Meta accounts is configured together with consent preferences is explained on the Google Ads account management and Instagram and Facebook advertising pages.
Who is responsible for third-party cookies?
According to the guide, when third-party cookies are used on a website, both the website owner and the third party placing the cookie have obligations regarding informing the visitor and obtaining consent. In practice, visitors direct complaints straight to the website owner; that is why the guide recommends including provisions on information and consent in contracts with advertising and analytics providers.
When cookies send data to a company abroad, the guide reminds readers that this transfer must comply with Article 9 of the Law and the regulation governing the procedures and principles of international transfers (brought into force on July 10, 2024). Since most common advertising and analytics tools are based abroad, it is useful for the cookie inventory to include a column showing where each tool sends data.
Testing the setup and common mistakes
Cookie compliance is complete when browser testing shows the panel really works, rather than when the policy text is published. To test, open the website in a private window and monitor loaded cookies and network requests in the browser’s developer tools; then select “reject,” refresh the page, and check the behavior of advertising and analytics tags. The most common errors revealed in these tests are:
- Advertising and analytics tags running before the panel appears
- The absence of a “Reject” button or its being hidden on a second screen
- The marketing category being switched on in the preferences screen
- Cookies in the policy table that are no longer used on the website, or cookies never listed there
- The absence of an icon or link allowing consent to be changed later
- The caching plugin showing the panel preference to all visitors through the same page version
Cache and plugin conflicts can produce unexpected results even when the panel is configured correctly; these technical issues are addressed through WordPress troubleshooting. For new websites, planning the panel and policy structure from the start can be considered a step in the corporate web design process.
Let us set up the cookie panel with equal buttons
For those wanting to learn which cookies run on their website, correct their current panel according to the guide, or set up consent mode together with advertising accounts, the first step is a browser-based cookie and tag test of the website. The gaps found are listed in priority order, and the test is repeated together after setup.
Related guides
Frequently asked questions
Should every website have a cookie policy?
If the website processes personal data through cookies, information about that processing must be provided, and the cookie policy is the means of providing it. The text should show each cookie’s name, purpose, duration, and first-party or third-party status.
Is consent required for essential cookies?
According to the KVKK cookie guide, cookies strictly necessary for a service requested by the user may rely on other processing conditions instead of explicit consent. Information about these cookies must still be provided.
Is cookie consent required for Google Analytics?
The guide may assess first-party analytics cookies producing only anonymous statistics, performing no cross-site tracking, and not transmitting data to third parties independently of consent. Since setups sharing data for advertising purposes may fall outside this framework, assessment should be based on the website’s settings.
Is a reject button mandatory in a cookie banner?
The guide considers presenting accept, reject, and preferences buttons indistinguishably in color, size, and font size to be good practice. Hiding the rejection option weakens the assessment that consent was freely given.
What is Google consent mode v2?
Consent mode is the technical structure transmitting the choice in the consent panel to Google tags; v2 added the ad_user_data and ad_personalization parameters. Google requires this version from advertisers collecting data from users in the European Economic Area through Google tags, SDKs, or Analytics data linked to Google Ads.
What is the difference between basic and advanced consent mode?
In basic setup, Google tags do not run before the visitor specifies a preference. In advanced setup, tags load with the page and send limited measurement signals without writing cookies when consent is denied.
When should the cookie policy be updated?
The table should be updated when a new plugin, advertising tag, or analytics tool is introduced on the website or when a tool is removed. Regular browser testing shows whether the table matches the cookies actually running on the website.
Call us
Call us for detailed information.
Let us call you!
Share your number and let us call you!
Our other services
- › Corporate web design
- › E-commerce website development
- › SEO optimization
- › WordPress website development
- › Google advertising management
- › WordPress speed optimization
Service areas
- › Web design in Sakarya
- › Web design in Tekirdağ
- › Web design in Bursa
- › Web design in Beşiktaş
- › Web design in Şişli
- › Web design in Tuzla
- › Web design in Ümraniye
- › Web design in Kadıköy
- › Web design in Istanbul
- › Web design in Ankara
- › Web design in Ataşehir
- › Web design in Üsküdar
- › Web design in Kartal
- › Web design in Maltepe
- › Web design in Pendik
- › Web design in Kocaeli
- › Web design in İzmir
- › Web design in Antalya
