How to Obtain Explicit Consent: Conditions for Validity

Explicit consent is one of the legal bases for processing personal data under KVKK; but it is valid only when certain conditions are met. We previously covered what explicit consent is; in this article we explain how to obtain valid explicit consent.

This content is for general information only and does not constitute legal advice.

The three conditions of valid explicit consent

Under KVKK, explicit consent must be:

1. Related to a specific subject. A general, "covers everything" consent is not valid.
2. Based on information. The person must understand what they consent to, which is why it is presented together with the privacy notice.
3. Declared with free will. Consent made a precondition of a service does not carry free will.

Notice and consent must be presented separately

The privacy notice is an obligation to inform; explicit consent is a separate approval. Combining the two into a single checkbox is wrong. The correct approach is to present the notice first, then obtain a separate, optional consent for the operations that require it.

Consent is not always required

An important point: explicit consent is not the only legal basis for processing. If other conditions in the law apply (performance of a contract, legal obligation, legitimate interest, etc.), consent may not be needed. Asking for consent unnecessarily both harms the user experience and weakens the legal ground.

The burden of proof is on the data controller

Proving that consent was obtained is the data controller's obligation. Therefore a record must be kept of which person consented, with which text version, and when. It must also be remembered that consent can be withdrawn.

Common mistakes

• Pre-ticked boxes. Consent requires an active approval.
• Making consent mandatory. Consent required for a service is not free.
• Not keeping records. Unprovable consent is void in an audit.

Managing the process

Versioning consent texts and recording which version was presented to whom is hard to do manually. Kivuz KVKK is a KVKK compliance software that records notice and consent processes. For cookie consent on your website, see our cookie consent management product. To see the whole, request a demo.