How do you write a cookie policy? Is it mandatory, and what should it contain?
Turkey’s Personal Data Protection Law No. 6698 sets no requirement for a separate document called a “cookie policy”; but every site that processes personal data through cookies must inform visitors as they enter the site. The Personal Data Protection Authority recommends that this notice clearly state each cookie’s name, purpose and duration, and whether it is first-party or third-party; a cookie policy is where this information is kept in order.
The short answer to “Is a cookie policy mandatory?” is that the name of the document is not mandatory, but its content is. This guide explains that content, which columns the table should have, when a cookie banner is needed and the most common mistakes. The sources are the Authority’s Guide on Cookie Practices, updated in July 2025, and the enforcement decisions of the Personal Data Protection Board. The information here is not legal advice.
Is a cookie policy mandatory?
The word “cookie” does not appear in Law No. 6698. Article 10 of the Law, however, requires the data subject to be informed when personal data is obtained. According to the Authority’s cookie guide, if personal data starts being processed with the visit to the site, the notice must be given at the point of entering the site; if no information is presented on entry, a breach of the obligation to inform may arise. The Guide also recommends that the privacy notice clearly state the cookie’s name, purpose of use and duration, and whether it is first-party or third-party.
You can keep this information in a section of the privacy notice or on a separate “cookie policy” page; the Guide describes its content, not its place. A short page is useful for a site that uses no cookies, too: saying “no cookies” and listing the other records kept in the browser answers the visitor’s question up front.
What is the difference between a cookie policy and a privacy notice?
The privacy notice describes all of the site’s personal data processing: the identity of the data controller, the purpose, to whom the data is transferred, the method of collection and the legal basis, and the data subject’s rights. The cookie policy sets out in detail the part of it that concerns cookies and browser records. We have collected which text is needed in which situation in the guide what a website must have.
Two distinctions matter. According to the Guide, the privacy notice and the cookie management panel must be kept separate from each other. Explicit consent for advertising cookies cannot be embedded in documents such as the terms of use or a “privacy statement” either; consent is obtained through a separate and conscious action.
Which columns should the table have?
The four items the Guide lists (name · purpose · duration · party) are the core of the table. In practice, the following columns answer the visitor’s question in full:
- Name · the technical name of the cookie or record
- Type · cookie, local storage, session storage
- When it is written · on the first visit or after an action
- Purpose · what it does, in language the visitor understands
- Duration · deleted at the end of the session, or after how many days or months
- Party · first party, or if third party, which company’s
- Legal basis · by the name of the condition in the Law; whether explicit consent is needed
- Abroad · if the data goes to a provider abroad
Writing the legal basis “by the name of the condition in the Law” comes from Article 5 of the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform: general and vague wording is not used. The abroad column became more important with the Guide’s July 2025 update: a transfer to a cookie provider abroad is subject to the transfer rules in Article 9 of the Law.
Example: three rows from this site’s table
Our own cookie and browser storage policy lists every record with this logic. Here are three of its rows:
- mt.bilgi · local storage · on pressing “Got it” · keeps the information banner from reappearing · 12 months · first party
- kt-son · local storage · if “Mark the article I read last” is on · marks the last article read · deleted when the feature is switched off · first party
- __cf_bm · cookie (hcaptcha.com) · on touching the contact form · tells humans from bots · at most one day · third party
The first two are written at the visitor’s own request; the third comes from a third-party service that loads only when the form is touched. In the table, all three stand with the same level of detail.
When is a cookie banner needed?
The Guide divides cookies by purpose. Cookies needed to carry out the communication (Criterion A) and cookies strictly necessary for a service the user has explicitly requested (Criterion B) do not require explicit consent: session, form, basket, security, an interface preference chosen by the user and the like. According to the Guide’s annex of bad examples, asking for explicit consent when the site’s basic function falls within this scope is incompatible with the principle of “compliance with the law and good faith”. A site that uses only necessary cookies shows information on entry, not a consent banner.
Where consent is required, the Guide is clear: the first layer presents “Accept All”, “Reject All” and “Preferences” equally; separate consent is obtained for different purposes; cookies that require consent come switched off in the panel by default; a “cookie wall” that makes access to the site conditional on consent may undermine free will; and the sentence “by using the site you are deemed to have consented to cookies” is not valid consent.
Do analytics cookies require consent?
It depends. The Guide says that first-party analytics cookies can be assessed under Criterion B; the conditions are that the purpose is limited to measuring the site’s own audience and performance, that only anonymous statistics are produced, that no cross-site tracking is done and that the data is not passed on to third parties. The Guide gives masking the IP address as an example of a measure.
Analytics that goes beyond these conditions requires consent. In Decision 2024/1361, the Board sanctioned the use of an analytics cookie that was not strictly necessary without a consent mechanism on first entry (250,000 TL, plus a separate 15,000 TL for a deficient notice). In Decision 2022/1358, a fine of 300,000 TL was imposed because consent was not obtained for non-essential cookies used for advertising and statistics.
What about local storage and other records?
The Authority’s guide covers only cookies that process personal data; it gives no separate guidance on techniques such as local storage, pixels and fingerprinting. EU rules are broader: under Guidelines 2/2023 of the European Data Protection Board, every record kept on the device, local storage included, falls within the scope of the ePrivacy rule. If your site has visitors from the EU, it is safer not to limit the policy to cookies but to list every record kept in the browser.
What are the most common mistakes?
- Template copy · describing cookies the site does not have and leaving out the ones it does
- Implied consent · “by using the site you are deemed to have accepted”
- Single button · only “Accept”, with “Reject” missing or faded
- Embedded consent · putting consent inside the policy or terms text
- Forgotten third party · not listing the cookie a plugin leaves behind
- Missing duration · not stating when the cookie will be deleted
The site owner is also responsible for third-party cookies: according to the Guide, both the site owner and the third party are obliged to ensure that the user is informed and that consent is obtained.
How do you keep the policy up to date?
A cookie policy written once and left alone becomes wrong at the first plugin change. After every new plugin, tag or piece of embedded content, look at the “Application” tab in the browser’s developer tools and compare it with the table; repeat the check after filling in a form. We have tied this comparison to our test suite: if a storage key the code writes is not in the table, the test turns red. The details are in our article on designing a KVKK-compliant website.
If you would like to measure together what your site actually leaves in the browser, write to us.
If you want to see these answers on your own site, corporate web design delivers design, code and technical SEO from one hand, on a measurable budget.