The Personal Data Protection Board's ("Board") Principal Decision dated 11 February 2026 and numbered 2026/266, titled "Principal Decision on the Use of the Mobile Phone Number or Loyalty Card Number of a Loyalty Card Member by a Third-Party During Shopping" ("Principal Decision"), has been published in the Official Gazette dated 28 February 2026 and numbered 33182.
The Principal Decision evaluated practices in loyalty card programs widely used across various sectors primarily food, cosmetics, technology, clothing and DIY/building materials retail whereby the mobile phone number or loyalty card number belonging to a loyalty card holder is provided to the cashier by a third-party during shopping, and a transaction is completed without any verification.
In the examinations carried out by the Board, it was determined that within the scope of such practices:
- Third parties can carry out purchase transactions without the knowledge and consent of the loyalty card holder,
- Invoices or similar documents issued because of these transactions can in many cases be issued in the name of the loyalty card holder,
- Customer transaction information relating to the purchase (such as the product or service purchased and the date of purchase) can be recorded to the loyalty card holder's membership account.
The Board assessed that this practice may give rise to unlawful data processing activities and personal data breaches under Law No. 6698 on the Protection of Personal Data ("
Law"). In this context, it was noted that recording customer transaction information relating to a purchase not carried out by the data subject themselves to that person's account may constitute a violation of the principle of "accuracy and being up to date when necessary" as regulated under Article 4 of the Law, and that such data processing activity does not rely on any of the data processing conditions set out under Article 5 of the Law.
Furthermore, the Board stated that the inclusion of provisions in loyalty card membership agreements prohibiting the use of the card by third parties does not eliminate the data controller's obligation to ensure personal data security under Article 12 of the Law.
In this context, the Principal Decision sets out that data controllers are required to:
- Discontinue practices that allow the mobile phone number or loyalty card number of the loyalty card holder to be used by third parties without any verification,
- Establish appropriate technical and administrative mechanisms to verify that purchase transactions carried out through the loyalty card are conducted with the knowledge and consent of the data subject.
The Board also stated that data controllers may make use of various verification methods when establishing such mechanisms, including:
- Sending a one-time verification code (OTP) via SMS,
- Scanning a barcode or QR code via a mobile application or website,
- Physical card presentation,
- Using a loyalty card password (PIN).
It was further noted that different verification mechanisms may be preferred depending on the type of transaction and the level of risk.
Under the Principal Decision, data controllers have been granted a 6-month compliance period from the date of publication of the Principal Decision in the Official Gazette to bring their loyalty card practices into compliance with the Law by taking the necessary technical and administrative measures. Data controllers who continue such practice without taking the necessary measures within this period may be subject to administrative sanctions under Article 18 of the Law.
You can access the Principal Decision published in the Official Gazette
here