KVKK Explicit Consent vs İYS Approval: Consent and Withdrawal Compared

When someone says "we got marketing permission," two separate obligations are often confused: explicit consent under KVKK and the İYS approval required to send commercial electronic messages. They arise from different laws, serve different purposes, and do not substitute for each other. This article compares the two, including the withdrawal/opt-out side.

This content is for general information only and does not constitute legal advice.

Which law, which authority?

• KVKK explicit consent: Falls under Law No. 6698 on the Protection of Personal Data; the competent authority is the Personal Data Protection Authority.
• İYS approval: Commercial electronic messages fall under Law No. 6563 on the Regulation of Electronic Commerce and its regulation; approval and opt-out records are kept in the Message Management System (İYS), regulated under the Ministry of Trade.

What does each cover?

• KVKK explicit consent makes a personal-data processing activity lawful (when there is no other legal basis). It is not marketing-specific; not every processing needs it.
• İYS approval is needed to send a commercial electronic message (email, SMS, call) to a recipient. Some cases (e.g. similar products/services for an existing customer, or the recipient's request) may be exceptions.

The nature of the consent

• KVKK explicit consent: An approval relating to a specific subject, based on information and declared with free will. See what explicit consent is and how to obtain it.
• İYS approval: Approval obtained to send commercial messages and recorded in İYS; kept per recipient and per channel (call/message/email).

Withdrawal / opt-out

The data subject can exercise this right on both sides; but the channels and process differ.

Withdrawing explicit consent under KVKK. The data subject can withdraw consent at any time; if consent was the only basis, processing stops. There is no central system — the data controller must provide an easy withdrawal channel. Channels used in practice:

• Preference center / account settings: A permission-management panel offered by the controller.
• Cookie / consent panel: Withdrawing consents given on web and mobile from the panel.
• The "unsubscribe" / withdraw link in emails.
• Application to the data controller (per the Application Communiqué): Written application, registered electronic mail (KEP), secure electronic signature, mobile signature, or an email address registered in the system.
• Call center / contact channels.

Rejecting commercial messages under İYS (opt-out). The recipient can refuse commercial messages at any time. After the opt-out, sending is stopped within the period set in the regulation (generally three business days). The opt-out can be exercised via:

• The opt-out option in the message: An "unsubscribe" link in email, an opt-out code or short number in SMS, a verbal opt-out on calls. (Every commercial message must offer an easy opt-out method.)
• The İYS website: Manage all your approvals/opt-outs from one place via iys.org.tr.
• The İYS mobile app.
• e-Government (e-Devlet): The İYS service is accessible via e-Devlet.
• The İYS call center.

Common principle: both withdrawing consent and rejecting commercial messages must be easy, free and unobstructed.

Do you need both?

Often yes. If you process personal data for marketing and also send commercial electronic messages, KVKK explicit consent and İYS approval must be obtained separately and recorded. One does not replace the other; if one is missing, that obligation is breached.

Managing the process

Managing the approval/opt-out records of both regimes separately and provably is hard to do manually. Kivuz KVKK is a KVKK compliance software that records explicit consent and notice processes; for cookie/permission consent on web and mobile, see our cookie consent management product. To design the dual-permission setup that combines KVKK explicit consent and İYS approval correctly, you can use our KVKK Compliance Advisory service. To design the right setup for your organization together, request a demo.