What are cookies?
Cookies are small text files a website places on a visitor’s device to recognise the browser on later requests. They keep shopping baskets alive, remember logins and language choices — and they also track people across sites for advertising. Whenever a cookie can be tied to an individual, it involves personal data, which is why a banner sits on nearly every European and Turkish website.
The four categories
- Strictly necessary. Required for the service the user asked for — session security, load balancing, basket contents. No consent needed.
- Functional. Convenience features such as language or region preferences. Usually consent-based unless genuinely necessary for a requested feature.
- Analytics. Measurement of traffic and behaviour. Consent is required in Turkish and most EU practice, even where the operator considers the data aggregated.
- Marketing. Advertising, retargeting and cross-site tracking. Always consent-based, and the category regulators examine first.
The legal dimension
In the EU, two regimes overlap: the ePrivacy Directive 2002/58 requires informed consent for any storage or reading of information on a device that is not strictly necessary, while the GDPR governs whatever processing of personal data follows. Consent must be a genuine choice: pre-ticked boxes and banners where refusing takes three clicks but accepting takes one do not qualify. Türkiye has no separate ePrivacy statute, so cookie compliance is analysed directly under the KVKK’s rules on lawful bases.
Turkish context
The KVKK Authority has published cookie guidance that mirrors the EU approach: strictly necessary cookies may run without consent, while analytics and marketing cookies require explicit consent obtained before they fire, with layered information about each purpose. The Board has also addressed cookies in its decisions through the lens of proportionality — our review of those proportionality and cookie decisions shows the Board asking the same question each time: could the operator achieve its purpose with less data?
Do: classify every cookie before the banner is designed, block non-essential cookies until consent is given, and record consents. Don’t: load analytics scripts on page one and ask for consent afterwards — the sequence is the compliance failure regulators cite most.
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call