Principle Decision on Sending Verification Code via SMS was published by the Personal Data Protection Board

What Are the Principles Have Been Introduced Under the Scope of the Principle Decision?

In response to numerous complaints and notices submitted to the Board, allegations were evaluated regarding the practice in which SMS verification codes are sent to individuals during checkout in physical stores, creating the impression that such codes are mandatory for completing the purchase. However, in practice, these codes were allegedly entered into the system by the data controller to obtain consent for commercial electronic messages.

Following its assessment, the Board identified that, in relation to the SMS messages containing verification codes sent to data subjects:

• either the data controller or its authorized representatives failed to provide proper information as required, and/or
• although the code was obtained for the purpose of securing explicit consent for the delivery of commercial electronic messages, it was presented as a prerequisite for completing the purchase, thereby misleading the data subjects.

Within this context, the Board set out the principles to be followed in the processing of personal data during the process of obtaining consent for commercial electronic communications through SMS verification codes, in line with its previous decisions and the Authority’s prior public statements. Accordingly, in summary:

(i) data subjects must be clearly informed about the purpose and consequences of the SMS verification code, and appropriate information channels must be provided within the SMS content;
(ii) the processes of providing information and obtaining explicit consent must be clearly separated, and explicit consent must be obtained individually for each data processing activity that requires such consent, in compliance with the conditions set forth in the Law;
(iii) in order to avoid giving the impression that consent is a prerequisite, explicit consent should be obtained after the completion of the purchase transaction, or if collected during the SMS process, data subjects must be informed that providing consent is not mandatory and that they retain the right to change or withdraw it at any time.

Conclusion

The principles required to be followed during the SMS verification code process, as set forth under the Principle Decision, had already been clearly articulated in the Board’s previous decisions and in the public announcement made by the Authority in 2023. Nevertheless, the continued application of these practices in the field appears to have been a determining factor in the Board’s decision to issue a Principle Decision on the matter.

Moreover, in addition to its earlier statements, the Principle Decision includes a new and significant provision from a practical standpoint: where the approval code is sent via SMS before the completion of the purchase, the SMS content must explicitly state that the data subject is not obligated to give consent and that their preferences can be changed at any time.

In conclusion, failure to comply with the requirements set forth in the Principle Decision may result in administrative sanctions due to the data controller’s failure to take the necessary technical and administrative measures, as stipulated under Article 12 of the Law.

The Principle Decision published by the Board can be accessed here.

Işılay Işık, Associate
Cemile Tekdemir, Trainee Lawyer