Public Announcement Regarding Push Notifications in Mobile Applications (KVKK)
The Personal Data Protection Authority (Authority) has issued a public announcement regarding push notifications sent to users via mobile applications, providing important reminders for data controllers.
The Issue of Explicit Consent and Linking to Terms of Service: The announcement clearly states that operational notifications, which are a natural part of the service, such as order and delivery notifications, and marketing notifications containing campaigns and advertisements cannot be presented under the same consent framework, in line with the principles of compliance with the law and rules of good faith, certainty, and explicit consent based on free will. Investigations conducted following complaints submitted to the Authority revealed practices where users were compelled to consent to marketing communications solely to access the service; such a consent framework was deemed to negate the element of free will inherent in explicit consent.
Measures to be Taken by Data Controllers: In this context, the Authority emphasised the necessity of the following:
- Separating operational and marketing notifications based on their purpose,
- Providing users with the opportunity to separately choose which type of notification they wish to receive,
- Ensuring that these preferences are technically feasible within the mobile application’s infrastructure.
The announcement also indicated that application designs that do not allow users to manage their preferences may be considered as a failure to take the necessary technical and administrative measures regarding data security under Article 12 of the Law.
GRC LEGAL Assessment: It is critically important for data controllers providing mobile application services to handle push notification approvals not only through text messages but also through a principle-based, purpose-specific, and technically feasible approach. The published ‘Recommendations on Protecting Privacy in Mobile Applications’ also contains statements emphasising the importance of permission management.
Although the Board’s approach in this area has been consistent for a long time, the need to publish a current announcement reveals that the process is still not fully compliant with the legislation and that scenarios where marketing-oriented approaches take precedence over data privacy are widespread.