Scraping is the raw-material industry of AI, and in Türkiye it operates without the safe harbour EU teams lean on. There is no Turkish equivalent of the DSM Directive’s text-and-data-mining exception. What fills the space is a stack of general rules, each with its own plaintiff.
Layer 1. Copyright and database rights (FSEK)
Individual works scraped from the web (articles, photos, code) keep full FSEK protection; reproducing them into a training corpus is prima facie reproduction. FSEK also protects databases twice over: original selection/arrangement as a work (Art. 6), and a sui generis right (Ek m. 8) against extraction or reuse of a substantial part of a database whose making required material investment. Systematically harvesting a marketplace’s listings or a portal’s classifieds sits squarely inside that right. For the training-output side of this (whether model outputs infringe and who owns them) see our FSEK training-data analysis.
Layer 2. Contract (TBK) and platform terms
Terms of service prohibiting automated access are generally enforceable between the platform and registered users; scraping behind a login after accepting ToS is a contract breach with damages exposure. For non-registered access the analysis shifts to tort and unfair competition, which is where Turkish litigation actually happens.
Layer 3. Unfair competition (TTK)
TTK Article 55 catches free-riding on another’s work product: wholesale extraction of a competitor’s structured data to build a competing product is the classic fact pattern, and Yargıtay has treated systematic data appropriation between competitors as unfair competition. This is the most likely Turkish cause of action against an AI company scraping locally.
Layer 4. KVKK
Names, handles, photos, reviews are personal data; scraping them is processing without notice; the aydınlatma problem is structural. “They posted it publicly” fails for the reasons covered in our training-data guide: Article 5(2)(d) is purpose-bound. The Kurul has sanctioned scraping-adjacent operations, and complaint-driven enforcement makes consumer-visible products the exposed ones.
Layer 5. Criminal law (TCK)
TCK Articles 243–245 (unauthorised access to information systems) become relevant when scraping defeats technical barriers: credential sharing, CAPTCHA circumvention at scale, IP-ban evasion. Prosecutions are rare but the provisions give platforms leverage, and make “how we scraped” a question your engineers should be able to answer in writing.
The hygiene that holds up
- Robots.txt and ToS review per source, recorded in the dataset’s source register; the same register your training content summary and investor due diligence will draw on;
- No circumvention of technical barriers; rate-limit; identify your crawler;
- EU-grade opt-out compliance globally; it is cheaper than jurisdiction-splitting your pipeline;
- Prefer licensed corpora and official APIs where the economics allow; document the make-or-buy decision;
- KVKK plan before ingestion: filtering, pseudonymization, retention, and a defensible Art. 5 basis.
Where scraping feeds an EU-facing product, add the AI Act layer via the Readiness Checklist and the AI Compliance Hub.
This article is for general information only and does not constitute legal advice. For advice on your specific situation, contact us.
Author
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call