The Personal Data Protection Authority Published A Public Announcement Regarding Instant Notifications Sent Through Mobile Applications

The Personal Data Protection Authority (“Authority”) published a public announcement on January 14, 2026, regarding how data processing activities related to push notifications sent to users via mobile applications should be evaluated under the Personal Data Protection Law No. 6698 (“KVKK”).

In this context, upon examining similar complaints submitted to it, the Authority determined that:

• Consent was obtained for multiple purposes with a single approval,
• Notifications, which are a natural part of the service, were made mandatory along with marketing content,
• This situation negated the element of free will in explicit consent,

Along with the announcement, the Authority explained how notifications should be made in order not to deprive users of their right to control their personal data and not to violate the obligation to “take the necessary technical and administrative measures to prevent the unlawful processing of personal data” as stipulated in Article 12 of the Law, as follows:

• The technical architectures of mobile applications must also be structured to support these legal requirements.
• Users must be given the option to customize which types of notifications they wish to receive (e.g., only shipping information, but not promotional announcements) through in-app settings or the device's operating system settings.
• In this context, data controllers must review the consent acquisition processes for sending push notifications via mobile applications in light of the principles of “partial explicit consent” and “specificity.” Accordingly, the necessary changes must be made to the application architecture to ensure that notification purposes are separated and users are given the opportunity to manage their preferences.
• You can access the relevant public announcement by the Authority here.