A mobile game with no login screen still processes personal data on every launch. The advertising identifier, the device model and language, the IP address, the session and level telemetry, the purchase history, the crash logs and, if the game has a friends list or a chat, the messages, all attach to an identifiable person under the Personal Data Protection Law No. 6698 (KVKK), and most of them leave Türkiye within milliseconds through the analytics, attribution and advertising SDKs that a free-to-play business cannot run without. Turkish studios have historically treated this as the SDK vendor’s problem. It is not: the studio is the data controller, the vendors are its processors or, for advertising networks, independent controllers, and the cross-border transfer regime rewritten by Law No. 7499 in 2024 makes the studio responsible for putting a lawful mechanism under each flow. This article maps the data a game collects, assigns a legal basis to each purpose, explains the Article 9 transfer mechanics and the standard-contract filing, addresses minors and the security and breach duties, and ends with the documents a studio needs before its next investor asks for them. It draws on our articles on the five-day standard-contract filing, data processing agreements and retention and destruction.
The data map of a free-to-play game
Article 3 of the KVKK defines personal data as any information relating to an identified or identifiable natural person; in the Board’s practice and in doctrine, identifiability is tested with the means reasonably available to the controller and its recipients. On that test the advertising identifier (IDFA or GAID), the vendor identifier, the IP address, the push token and the persistent player ID are personal data even though the studio never learns a name; so are the behavioural traces linked to them: install source, sessions, progression, purchases, ad impressions and clicks, in-game chat and support tickets. Special categories under Article 6 are rare in games but not absent: a face-filter feature processes biometric data, a health-and-fitness tie-in processes health data, and a chat log may contain whatever players type about themselves. The map should be built per SDK: for each library in the build, what it collects, for which purpose, whether it acts for the studio (analytics, crash reporting, customer support) or for itself (ad networks, attribution partners that use data across their customer base), and where its servers are. That map is the processing inventory the Board expects under Article 16 and the Registry Regulation, and it is also the truth behind the store’s privacy labels; an App Store or Play privacy declaration that contradicts the SDK list is evidence against the studio in both fora.
A legal basis for each purpose
Article 5 of the KVKK permits processing without consent where, among other grounds, it is necessary for the performance of a contract with the data subject (Article 5(2)(c)), necessary for the controller to fulfil a legal obligation (5(2)(ç)) or necessary for the controller’s legitimate interests provided the data subject’s fundamental rights are not harmed (5(2)(f)); otherwise explicit consent under Article 5(1) is needed. Applied to a game: running the game, saving progress, delivering purchases and preventing cheating are contract performance; crash reporting, security logging and aggregate product analytics are legitimate interests, documented in a balancing note; tax records of purchases are a legal obligation. Personalised advertising and cross-app tracking through advertising identifiers are the contested category. The Authority’s guidance on cookies and similar technologies treats identifiers used for advertising and cross-site or cross-app tracking as requiring explicit consent, and the platforms’ own frameworks (Apple’s App Tracking Transparency prompt, Google’s advertising-ID controls) have made a consent moment technically available; a studio that runs personalised ads on legitimate interest alone is exposed both to the Board and to the store. Explicit consent under the KVKK must be informed, specific to the purpose and freely given, and the Board’s practice rejects consent bundled into the terms of service. The design answer is a consent layer at first launch that separates analytics from personalised advertising, records the choice with a timestamp, and lets the player change it in settings; the Article 10 privacy notice must be reachable from the same screen and must name the recipient categories and the transfer abroad.
Article 9: every SDK is a transfer
Article 9 of the KVKK, as amended by Law No. 7499 in 2024, allows personal data to be transferred abroad on three tiers. Where the Board has issued an adequacy decision for the destination country, sector or international organisation, the transfer needs only a lawful basis under Articles 5 and 6 (Article 9(1)); studios should check the Board’s published decisions before relying on this tier, and should assume it is unavailable for a vendor’s jurisdiction until a decision covering it appears in the Official Gazette. Absent adequacy, Article 9(4) allows transfers where the data subject can exercise rights and seek remedies in the destination and one of four appropriate safeguards is in place: an agreement between public bodies that is not an international treaty, with Board permission, Board-approved binding corporate rules within a group, a standard contract in the form announced by the Board, or a written undertaking with Board permission. For a studio sending data to an analytics or advertising vendor abroad, the standard contract is the tool: Article 14 of the 2024 Regulation on Cross-Border Transfers requires it to be used without any change, signed by authorised representatives of both parties, and notified to the Authority within five business days of signature (Article 9(5) of the Law), by the transferor unless the contract allocates the duty otherwise. Article 9(6) allows occasional transfers without safeguards on explicit consent after information about risks, or where the transfer is necessary for a contract with the data subject, but “occasional” excludes the continuous stream an SDK generates. Two practical consequences follow. First, the studio needs a signed standard contract with each foreign vendor that receives personal data, filed on time; vendors that will not sign the Turkish form should be replaced or configured to receive only anonymised data. Second, onward transfers by the vendor to its own sub-processors must be covered in the contract and, for controller-to-controller flows to ad networks, the studio needs the controller-to-controller version of the standard contract. Our filing guide sets out the procedure.
Minors
The KVKK contains no age threshold for consent. Capacity is governed by the Civil Code, under which a minor with discernment cannot incur obligations without the legal representative’s consent, and the Board’s practice expects parental involvement where a child cannot validly consent. A game that is directed at children, or that knows from its ratings and its data that many players are children, should therefore not rely on explicit consent from the player for advertising identifiers, should minimise collection to what contract performance requires, should turn personalised advertising off by default for that audience, and should implement an age-assurance approach proportionate to the risk, which we discussed in children and age assurance. Chat features add moderation and reporting duties and, where the game reaches large audiences, the platform obligations under Law 5651 we described in the 5651 gaming platform guide.
Security, breaches and retention
Article 12 of the KVKK requires the controller to take all technical and organisational measures necessary to prevent unlawful processing and access and to ensure preservation, to carry out or commission audits, and to ensure that processors comply; where data is obtained unlawfully by others, the controller must notify the data subjects and the Board as soon as possible, which the Board’s decision of 24 January 2019 fixes at seventy-two hours from learning of the breach. For a studio this means account-security controls proportionate to the data held (payment data should never be held at all; the stores and payment providers hold it), encryption of player identifiers in analytics exports, access control over the admin panels of SDK dashboards, a breach playbook that covers credential-stuffing attacks on player accounts, and processor agreements that oblige vendors to report incidents within a period that lets the studio meet the seventy-two hours. Retention follows the Deletion Regulation: telemetry should have a stated retention period and a periodic destruction cycle, inactive accounts a deletion rule, and chat logs a short life; a studio that keeps every event since launch has a retention problem it will discover in diligence.
The documents a studio needs
Before the next fundraising or publisher diligence, a studio should be able to produce: the SDK data map and processing inventory; the VERBİS registration where the thresholds require it; the privacy notice under Article 10 in Turkish and English, reachable in-game and on the store; the consent layer design and consent logs; a legitimate-interest assessment for analytics and anti-cheat; data processing agreements with processors and standard contracts with foreign recipients, with the Authority’s filing acknowledgments; the retention and destruction policy; the breach playbook; and the store privacy declarations reconciled to the map. None of these is long, all of them are checked, and the absence of the transfer contracts is currently the finding that appears most often in our reviews.
Our analytics vendor says it only receives anonymous data. Do we still need a standard contract?
Only if the data is anonymous in the KVKK sense, meaning it cannot be linked to a person even when combined with other data. Advertising identifiers, device fingerprints and persistent player IDs are not anonymous. If the vendor receives any of them, you need the contract and the filing.
Do we need consent for crash reporting?
Generally no; keeping the game working is a legitimate interest, provided the crash payload is minimised and documented. Attaching the advertising identifier or chat content to crash reports pushes it back towards consent.
Can we run the same consent screen worldwide?
Largely yes: a screen that separates analytics from personalised ads, records choices and links to the notice satisfies the KVKK and is close to what the GDPR and the platforms require. Localise the notice and name the recipients and the transfers abroad.
Related: cookies and identifiers · cross-border data transfer · profiling · VERBİS · AI in games and player data.
Sources. Personal Data Protection Law No. 6698 (Articles 3–6, 9–12, 16, as amended by Law No. 7499); Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (Official Gazette 10 July 2024, No. 32598; Articles 6, 10, 14–16); Personal Data Protection Board, decision of 24 January 2019 on breach notification; Personal Data Protection Authority, guidance on cookie and similar technologies; Turkish Civil Code No. 4721 (Article 16). Statute links open the official Turkish texts on mevzuat.gov.tr.
This article is provided for general information only and does not constitute legal advice. Please seek legal support for an assessment of any specific matter.
Author
More from Vircon Insights
Türkiye Geographic Data Permits Regulation 2026: What Companies Working with Location Data Must Check
October 16, 2026Feeding Company Data to a Model: KVKK Basis, Transfer Abroad and the Trade Secret You Just Uploaded
October 5, 2026The Data Processing Agreement Under KVKK: How It Differs from GDPR Article 28 and What to Put in the Annexes
October 2, 2026In-App Purchases and Refunds in Türkiye: The Digital-Content Exception, Pre-Contract Information and the Child Who Bought Gems
October 21, 2026Deepfakes, Impersonation and APP Fraud in Türkiye: Who Bears the Loss?
October 20, 2026Loot Boxes, Gacha and the Gambling Line in Türkiye: Law 7258, Article 228 of the Criminal Code and the Advertising Board
October 20, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Gaming & Esports Law
Studio funding rounds, chain of title, publishing and platform agreements, esports.
View service →Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →