The rapid development of internet technologies and digital infrastructure has shifted the center of global trade from physical stores to digital platforms. Today, e-commerce has transformed into a massive ecosystem involving not only large retailers but also small and medium-sized enterprises (SMEs) and even individual entrepreneurs. However, opening a sales channel in the digital environment is not simply a matter of uploading products to a website or marketplace and waiting for orders.

Commercial activities conducted in the virtual world are subject to very strict legal control due to factors such as the consumer's inability to physically see the product, the establishment of distance contracts, the processing of personal data in a digital environment, and the use of electronic payment systems. In Turkey, the e-commerce sector is regulated by a complex and dynamic network of legislation, primarily the Law No. 6502 on Consumer Protection, the Law No. 6563 on the Regulation of Electronic Commerce , and the Law No. 6698 on the Protection of Personal Data (KVKK) .

This comprehensive guide will cover all legal details, including the legal obligations to consider when establishing the legal framework of an e-commerce site, the mandatory contracts required on websites, ETBİS registration, the most up-to-date regulations regarding consumers' right of withdrawal, and the administrative fines that may be incurred in case of legal violations.

1. Legal Foundations of E-Commerce Law in Türkiye

E-commerce law is not a homogeneous structure consisting of a single law. Rather, it is a combination of traditional commercial law, consumer law, contract law, and data protection law adapted to the digital world. The main legislative elements directly regulating e-commerce activities in Türkiye are as follows:

1.1. Law No. 6563 on the Regulation of Electronic Commerce

This law serves as the constitution of e-commerce. It regulates information disclosure obligations related to electronic commerce, the conditions for sending commercial electronic messages (SMS, email marketing), and the rights and obligations of e-commerce service providers and intermediary service providers (marketplaces). In recent years, significant changes have been made to prevent the monopolization of marketplaces and to curb unfair trade practices, introducing turnover-based licensing obligations and advertising restrictions to the sector.

1.2. Law No. 6502 on Consumer Protection and the Regulation on Distance Contracts

Almost all e-commerce transactions are classified as "Distance Contracts," where the parties do not physically meet. This law and related regulations aim to protect consumers who shop in the digital environment. The seller's obligation to inform the consumer, delivery times, and the consumer's most powerful weapon, the "Right of Withdrawal," are all shaped within the scope of this legislation.

1.3. Law No. 6698 on the Protection of Personal Data (KVKK)

An e-commerce site legally acquires the title of "Data Controller" from the moment it records a customer's name, surname, address, telephone number, email address, and shopping habits . All processes related to the collection, processing, storage, and, if necessary, destruction of customer data must comply with the provisions of the Personal Data Protection Law (KVKK) .

2. Required Legal Texts on an E-Commerce Website

For an e-commerce site to operate, there are legally mandated texts that must be present on its homepage and payment screens (checkout) and presented for consumer approval. The absence or illegal arrangement of these texts will result in direct penalties imposed by the Ministry of Trade and the Personal Data Protection Board.

2.1. Preliminary Information Form (PIF)

Before clicking the payment button, the consumer must be informed about the essential characteristics of the goods or services to be purchased, the total amount to be paid (including taxes and shipping), the seller's full name and contact information, and the terms and conditions for exercising the right of withdrawal. The Pre-Information Form is an integral part of the Distance Selling Agreement, and the consumer's reading and approval of this form must be digitally recorded.

2.2. Distance Selling Agreement (DSA)

This is the legal document containing the terms of a distance contract established digitally between a seller and a buyer. The contract must clearly state the delivery conditions, the rights and obligations of the parties, the conditions of default (delayed payment), and which Consumer Arbitration Board or Consumer Court has jurisdiction in case of disputes.

2.3. Personal Data Protection Law (KVKK) Information Text and Explicit Consent Forms

The Privacy Notice must explain the purpose for which personal data collected from users when creating an account, placing an order, or subscribing to the newsletter will be processed, to whom it may be transferred, and what the user's rights are . If the data is to be transferred to third-party companies for marketing purposes or for profiling (cookie-based advertising), obtaining separate explicit consent from users is a legal requirement.

2.4. Privacy and Cookie Policy

This policy provides detailed information about which cookies (analytical cookies, advertising cookies, etc.) the website places on users' devices, their purpose, and how users can disable them.

3. ETBIS (Electronic Commerce Information System) Registration Obligation

The system created by the Ministry of Trade to register the e-commerce market, prevent unregistered activity, and create a secure e-commerce environment ETBİS .

3.1. Who is Required to Register with ETBİS?

• All natural or legal persons (service providers) who sell through their own website (e-commerce site),

• Businesses that take orders through their own mobile application,

• Marketplace platforms (intermediary service providers).

Marketplace Seller Exception: Sellers who only sell through intermediary marketplaces such as Trendyol, Hepsiburada, and Amazon, and who do not have their own independent e-commerce website, are not required to register independently with ETBİS. Their information is reported to the ministry by the marketplace platform where they sell.

3.2. Registration Process and Information to be Reported

ETBİS registration is done free of charge via e-Government. During registration, the company must fully enter information such as its MERSIS number, tax number, domain name for e-commerce, sectors in which it operates, payment methods used, shipping companies it works with, and the country where its databases are stored. Furthermore, the ETBİS QR code must be placed on the website's homepage.

4. Consumer Rights: Right of Withdrawal and Exceptions in Distance Shopping

The most dynamic and consumer-protective area of ​​e-commerce law is the right of withdrawal. By law, consumers have the right to withdraw from distance contracts without giving any reason and without paying any penalty.

4.1. 14-Day Period and Conditions

The consumer may exercise their right of withdrawal within 14 days from the date of delivery of the product (or the date the contract is concluded in service contracts) . The seller is obligated to refund the product price and any delivery costs (shipping fees) to the consumer in a single cash payment within 14 days of receiving the withdrawal notification.

4.2. Who pays the return shipping fee?

Due to recent regulations and postponements, it is essential for sellers to clearly state in their Pre-Information Form and Distance Sales Agreement who is responsible for return shipping costs in e-commerce. If the agreement explicitly states that "Return shipping costs are the responsibility of the consumer" and specifies the seller's contracted shipping company, the return shipping cost may be covered by the consumer within the limits set by legislation. However, if the seller has not provided this information beforehand, they are obligated to pay the return shipping cost.

4.3. Exceptions to the Right of Withdrawal (Non-Returnable Products)

Consumers cannot return every product within 14 days. Article 15 of the Regulation on Distance Contracts clearly lists the exceptions to the right of withdrawal:

• Personalized Products: Goods specially prepared according to the consumer's wishes or personal needs (e.g., a necklace with a name engraved or a dress tailored to specific measurements).

• Perishable Goods: Goods that are likely to expire or spoil quickly (e.g., food products, fresh flowers).

• Products Unsuitable for Health and Hygiene: Goods whose protective elements such as packaging, tape, seal, or wrapping have been opened after delivery and whose return is unsuitable for health and hygiene reasons (e.g., underwear, swimwear, earrings, cosmetics, perfumes).

• Digital Content and Computer Supplies: Books, digital content, software programs, DVDs, CDs, and other opened computer supplies.

5. Comparative Summary Table: Legal Responsibilities of Actors in E-Commerce

The parties involved in the e-commerce ecosystem have different levels of legal responsibility:

Area of ​​Responsibility	Service Provider (Selling Through Its Own Site)	Intermediary Service Provider (Marketplace Platform)	Consumer (Buyer)
Product Quality and Defective Goods	Directly and primarily responsible	As a rule, not liable (with exceptions)	Irresponsible (There is a reporting obligation)
ETBIS Registration Requirement	There is	There is	None
Invoice Issuance	Compulsory	Mandatory only for its own commission	None
Personal Data Security	responsible for the data it collects	Responsible for all data across the platform	Irresponsible
Shipping and Delivery Time	They must deliver within a maximum of 30 days	Responsible for overseeing delivery processes	Responsible for receiving the product

6. Commercial Electronic Messages and IYS ​​(Message Management System) Integration

The most common marketing method used by e-commerce sites to increase sales is sending SMS and email messages to customers containing information about campaigns, discounts, or celebrations. However, this activity is subject to very strict rules under Law No. 6563.

6.1. Opt-In System

To send commercial electronic messages for marketing purposes to consumers, their prior consent is required. This consent can be obtained in writing or through any electronic means of communication (such as checking a box). Consent boxes cannot be pre-ticked. The user must check the box voluntarily.

6.2. What is IYS (Message Management System)?

IYS, implemented by the Ministry of Trade, is a national database where permissions for commercial electronic communications are managed from a single center.

• E-commerce companies are required to upload all SMS and email permissions received from their customers within 3 business days .

• No commercial messages can be sent to authorized addresses that are not registered with the IYS (Information and Communication Technologies Authority).

• Citizens can see which companies are authorized to send them messages with a single click via the e-Government or IYS system and revoke their permissions at any time. The company within a maximum of 3 business days .

7. Dynamic Legal Process Management in E-Commerce

The legal processes of an e-commerce business are a continuous cycle, from the website design phase to the moment the product reaches the customer. The chronological order of the steps in this cycle is as follows:

 

8. Criminal and Administrative Sanctions for E-Commerce Law Violations

Failure to comply with e-commerce regulations poses significant financial risks for businesses. Inspections are carried out by the Advertising Board, the General Directorate of Consumer Protection, and the Personal Data Protection Authority (KVKK) within the Ministry of Trade, either on their own initiative or upon complaint.

8.1. Administrative Fines of the Ministry of Trade

• If the Preliminary Information Form and the Distance Sales Agreement are incomplete or drafted in violation of the regulations, an administrative fine will be applied for each transaction/order.

• Companies that fail to register and report to ETBİS are subject to substantial fixed administrative fines.

• In cases of sending unauthorized SMS or emails (commercial electronic communication violations), penalties that increase exponentially will be applied for each message sent.

8.2. Administrative Fines under the Personal Data Protection Law (KVKK)

In cases of data breaches caused by the theft of user data (data breach), data processing without explicit consent, or the lack of an SSL certificate or necessary cybersecurity measures on a website, the Personal Data Protection Board imposes severe administrative fines that can amount to millions of Turkish Lira, depending on the company's turnover and the degree of fault.

9. Frequently Asked Questions (FAQ) About E-Commerce Law

1. Is it legal to sell products via DM on social media (Instagram, Facebook, etc.)?

Selling products through social media channels is not illegal in itself, but those selling through these channels are required to be registered taxpayers (company owners), issue invoices, and comply with all rules in the distance contracts regulation (information provision, right of withdrawal). Failure to include legal information such as trade name, address, and tax number on the profile may result in access restrictions or administrative fines imposed by the Ministry of Trade.

2. Can we cancel an order for a product on our e-commerce site if the price was entered incorrectly?

In law, this is called "Error in Declaration of Intent." If, due to a systemic error or an inadvertent typographical mistake, a product with a market value of 50,000 TL is listed for 50 TL and purchased by a customer, the seller can cancel the order and refund the fee, relying on the principle of good faith (Turkish Civil Code, Article 2) and the principle of excessive exploitation (Turkish Code of Obligations). However, if the price difference is reasonable, consumer arbitration boards generally rule in favor of returning the product to the consumer.

3. Can a refund be issued as a gift voucher to a customer whose order has been cancelled?

No, absolutely not. When a consumer exercises their right of withdrawal or the order is cancelled because the seller cannot supply the item, the amount paid must be refunded in cash and in a single payment, according to the payment method used by the consumer at the time of purchase (cash, credit card refund, bank transfer, etc.). Refunds in the form of gift certificates, coupons, or points without the customer's explicit written consent are illegal.

4. In e-commerce, is there also a 14-day right of withdrawal for cash-on-delivery orders?

Yes, it does. The payment method used for the purchase (credit card, bank transfer, cash on delivery, or card payment on delivery) has no effect on the right of withdrawal. Since the contract is concluded digitally (remotely), even if the consumer paid in cash upon delivery, they have the right to return the product and request a refund within 14 days.

5. Which country's laws govern an e-commerce site that exports abroad?

International private law rules come into play in e-export processes. As a rule, the parties can choose the law that will apply to the contract (for example, Turkish law may be applicable to a distance selling contract). However, the mandatory consumer protection laws of the consumer's country of residence (for example, GDPR and EU Consumer Rights Directives for customers within the European Union) are always reserved and cannot be changed in a way that would be detrimental to the consumer in that country.

6. Can a customer return a product within 14 days after opening and using it, simply because they "didn't like it"?

The consumer is not liable for changes or damage that occur if the goods are used in accordance with their operation, technical specifications, and usage instructions within the withdrawal period. In other words, merely trying on a product (for example, checking how a garment looks or verifying the functionality of an electronic device) does not invalidate the right of withdrawal. However, if the product is worn, damaged, or defective beyond normal use, the seller may claim compensation for the loss of value or refuse to accept the return (excluding hygiene products).

7. If the shipping company breaks the product during transport, who is responsible?

According to Law No. 6502, all risks during the process of delivering the goods to the consumer (damage or loss during transport) belong to the seller. If the product is broken during shipping, the seller is obliged to send the consumer a new product or refund the money. The seller must resolve the damage only by seeking recourse from the shipping company they have an agreement with (by having a report drawn up and recovering compensation from the shipping company); they cannot pass this process on to the consumer.

8. Is having an SSL certificate on an e-commerce website a legal requirement?

Yes, it is an indirect and direct legal requirement. According to the Banking Regulation and Supervision Agency (BDDK) and the Central Bank's payment systems regulations, an SSL certificate (with at least 128-bit encryption) is mandatory for the secure transmission of credit card data. Furthermore, pursuant to Article 12 of the Personal Data Protection Law (KVKK), the data controller is obliged to take all necessary technical measures to prevent unlawful access to personal data. The absence of an SSL certificate is considered a direct security vulnerability and a violation of the KVKK.

9. Is it a crime to delete user reviews or add fake reviews on e-commerce websites?

Legally, this carries severe penalties. According to the regulations of the Ministry of Trade's Advertising Board, keeping only positive reviews and deleting negative/critical customer reviews, or manipulating consumers by purchasing fake (bot) positive reviews from external sources, "Deceptive Commercial Practice" and "Misleading Advertising ." If detected, the Advertising Board will impose very serious administrative fines and site closure penalties.

10. Is a store selling on marketplaces (Trendyol, etc.) required to issue its own invoice?

Yes. Intermediary service providers (marketplaces) are merely platforms that connect sellers and buyers. Since the marketplace does not own the product, the selling store (service provider) is legally obligated to issue an invoice (e-archive or e-invoice) for the product's price and send it to the customer along with the shipment or via email.

Conclusion: The Importance of Legal Advice for Secure E-Commerce

E-commerce, while possessing high growth potential, is also one of the grey areas where regulations change most frequently and audits are most intense. Using copy-pasted (cloned) contracts on your site can put your business on the brink of a major legal and financial crisis at any moment. Every e-commerce site has its own unique product range, logistics process, target audience, and data collection methods; therefore, legal texts and workflow diagrams must be tailored specifically to the company.

To prevent your business from being halted by penalties from the Ministry of Trade, from suffering reputational damage due to GDPR sanctions, and from consistently being the losing party in Consumer Arbitration Boards, ensuring full legal compliance by working with an expert IT and e-commerce law attorney will be the greatest guarantee of your long-term business success.