The Simultaneous Application of GDPR and Consumer Law in Targeted Advertising: The Two-Way Legal Limits of Data-Driven Marketing

The digital marketing world has evolved from traditional advertising targeting the general public to targeted advertising (microtargeting) that tracks and analyzes individuals' digital footprints and offers personalized offers directly to those individuals . Social media platforms, search engines, mobile applications, and e-commerce sites process users' search history, location information, purchasing habits, cookie data, and even social interactions, creating an extremely sensitive consumer profile.

However, tracking a consumer's every move in the digital environment and delivering personalized advertisements is not a one-way marketing activity. This process, at its core, lies at the intersection of two fundamental areas of law :

The Personal Data Protection Law No. 6698 (KVKK) regulates the collection, analysis, and profiling of user data .
The Consumer Protection Law No. 6502 (TKHK) and the related Commercial Advertising Regulation oversee the content, accuracy, honesty, and whether the advertisement presented harms the consumer's will .

In our legal system, these two laws are not alternatives to each other, but rather that complement each other and must be applied simultaneously (together) . A targeted advertising campaign may be fully compliant with the Personal Data Protection Law (KVKK) but may violate Consumer Law; or a marketing strategy that appears flawless from a Consumer Law perspective may lead to severe KVKK penalties due to the unlawful processing of personal data.

In this detailed guide, we examine how the Turkish Personal Data Protection Law (KVKK) and Consumer Law are applied together in targeted advertising processes, the points of intersection between the two legislations, unfair trade practices, profiling dynamics, and the legal standards that businesses must comply with, all in a clear and understandable language that avoids any factual errors.

1. The Legal Anatomy of Targeted Advertising: The Process from Data to Content

Targeted advertising consists of two main stages. The first stage is the collection and processing of data (Data Aspect), and the second stage is the presentation of content based on this data to the consumer (Content and Advertising Aspect).

                      THE TWO-WAY LEGAL STRUCTURE OF TARGETED ADVERTISING │ ┌───────────────────────────────────────── ┴───────────────────────────────────────┐ ▼ ▼ STAGE 1: DATA COLLECTION AND PROFILING STAGE 2: CONTENT AND ADVERTISEMENT DELIVERY • Cookies, device ID (IDFA/GAID), location • Personalized offers, dynamic pricing • Search and purchase history analysis • Ad text, visuals, and marketing language │ │ ▼ ▼ APPLICABLE LEGISLATION: Personal Data Protection Law (Law No. 6698) APPLICABLE LEGISLATION: Consumer Protection Law (Law No. 6502) (Explicit Consent, Information, Profiling Limits) (Prohibition of Covert Advertising, Unfair Commercial Practices)

Because of this two-stage structure, a business's or advertiser's responsibility does not end with simply collecting data or simply providing honest advertising. The business must simultaneously comply with the principles of the Personal Data Protection Law (KVKK) when collecting data and with the principles of Consumer Law when using that data to deliver advertisements

2. First Dimension: Targeted Advertising and Data Processing Conditions from the Perspective of the Turkish Personal Data Protection Law (KVKK)

Targeted advertising is based on personal data. IP addresses, cookie identifiers, device identifiers, location data, and click habits personal data ). This is because, when combined, this data points to a specific or identifiable natural person (consumer).

                             BALANCE OF KVKK PROCESSING CONDITIONS │ ┌───────────────────────────────┴───────────────────────────────┐ ▼ ▼ EXPLICIT CONSENT (KVKK Article...) 5/1) LEGITIMATE INTEREST (KVKK Article 5/2-f) • Internet cookies (Tracking Cookies) • Must not harm fundamental rights and freedoms • Profiling and micro-targeting • Only general and anonymous statistics • Processing sensitive data (Health/Political) • Must be within the consumer's reasonable expectations

A. Cookies and the Requirement of Explicit Consent

Cookies used in targeted advertising are basically divided into two categories:

Mandatory/Technical Cookies: These cookies are necessary for the website to function. Explicit consent is not required for these.
Marketing and Tracking Cookies: These cookies track a consumer's activity on the site, match it with their behavior on other sites, and enable targeted advertising.

The Personal Data Protection Authority (KVKK) has established a clear rule in its Guide on Cookie Practices : The use of tracking cookies for targeted advertising, profiling, and personalized advertising requires the prior, EXPLICIT CONSENT of the consumer, based on their free will.

Silence Doesn't Count: "By continuing to use our site, you accept our cookie policy" or pre-ticked boxes are legally invalid.
Cookie Wall Ban: Blocking access to a site if a consumer does not consent to cookies ("Cookie Wall") is illegal because it invalidates consent.

B. Risks of Profiling and Automated Decision Making

According to Article 11/1-g of the Personal Data Protection Law (KVKK), everyone to object to a result that is detrimental to them arising from the analysis of processed data exclusively through automated systems .

In targeted advertising, algorithms that group consumers according to their economic status, vulnerabilities, or spending habits (profiling) must be based on explicit consent. Consumers always have the right to object to being profiled and to stop the process.

C. Targeting Special Category Personal Data (Showing a specific advertisement or content only to a selected audience)

Targeted advertising based on consumers' sensitive personal data such as health information, religious beliefs, political opinions, or sexual orientation (Article 6 of the Turkish Personal Data Protection Law) is subject to extremely strict regulations.

For example, if a user searches for a disease or medication on a search engine, and then directly sees targeted supplement or clinic advertisements for that disease on social media, this indicates that the person's health data is being processed without their explicit consent and can lead to severe penalties under the Turkish Personal Data Protection Law.

3. The Second Dimension: Targeted Advertising and Content Control from a Consumer Law Perspective

Even if data is collected through legal means, targeted advertising based on that data must comply with the regulations of the Turkish Consumer Protection Law No. 6502 and the Commercial Advertising Regulation

                        RISKS OF CONSUMER LAW VIOLATIONS │ ┌─────────────────────┬───────────┴───────────┬───────────────────────┐ ▼ ▼ ▼ ▼ DYNAMIC / DISCRIMINATORY DECEPTIVE MICRO-EXPLOITATIVE / SENSITIVE COVERT ADVERTISING AND PRICING CONTENT (Micro-copy) GROUP TARGETING LACK OF TRANSPARENCY (Dark Patterns) (Personalized deception) (Exploitation of vulnerabilities) (Absence of advertising statement)

A. Dynamic and Discriminatory Pricing

In targeted advertising, businesses can offer the same product/service at different prices to different consumers based on factors such as device type (e.g., whether they use a high-end smartphone), location, past spending habits, or urgency of the situation

Situation from the Perspective of Consumer Protection Law: According to Article 6 of the Consumer Protection Law, a seller's refusal to sell a good or service without a justifiable reason, or applying different terms to consumers in the same situation, constitutes an Unfair Commercial Practice
If a user's "urgent travel search" data is identified by a targeted advertising algorithm and the price of a flight ticket or hotel is artificially inflated, this is considered exploitation of the consumer's inexperience or difficult situation and is punishable by the Ministry of Trade's Advertising Board.

B. Dark Patterns and Corruption of the Will

Targeted advertising is often supported by psychological manipulation techniques. Dark designs are created based on vulnerabilities identified from consumers' past data;

“Fifteen people in your city are currently viewing this product, only 2 left!” (Fake stock/urgency pressure)
Personalized, aggressive pop-ups that appear the moment the user is about to give up,

This impairs the consumer's ability to make reasonable decisions . According to Article 62 of the Turkish Consumer Protection Law, such targeted advertising strategies that significantly impair the consumer's freedom of decision-making are considered Unfair Commercial Practices

C. Targeting Vulnerable Consumer Groups

According to Article 24 of the Commercial Advertising Regulation, children, the elderly, people with disabilities, and people with illnesses are vulnerable consumer groups that require special protection.

It is prohibited to expose children to targeted toy or in-digital purchase advertisements that could negatively impact their mental development by tracking their behavioral data while they are playing games or watching videos.
Similarly, identifying the psychological vulnerabilities of elderly or sick consumers through data analytics and presenting them with targeted advertisements promising miraculous cures constitutes a double violation under both the Personal Data Protection Law and Consumer Law.

4. The Intersection of Two Fields of Law: Scenarios for Joint Application

Let's examine how the Personal Data Protection Law (KVKK) and Consumer Law overlap and are applied together in targeted advertising, using concrete scenarios:

                         DOUBLE-SIDED VIOLATION AND SANCTION MECHANISM │ ┌────────────────────┴─────────────────────┐ ▼ ▼ PERSONAL DATA VIOLATION CONSUMER VIOLATION (Cookies / Profiling) (Misleading Advertising) │ │ ▼ ▼ KVKK AUTHORITY REVIEW ADVERTISING BOARD REVIEW (Administrative Fine / Deletion) (Administrative Fine / Suspension) │ │ └────────────────────┬─────────────────────┘ ▼ LEGAL AND MATERIAL CONSEQUENCES (Compensation & Refund in Consumer Court)

Scenario 1: Retargeting Ads Made Without Obtaining Cookie Consent

A consumer browses a pair of shoes on e-commerce site A but doesn't buy them. Site A transmits this behavioral data to advertising networks like Google/Meta without obtaining the user's explicit consent (cookie approval). The user then sees a targeted advertisement on a news site indicating that the same shoes are on sale.

GDPR Violation: The consumer's internet behavior was tracked and transmitted to an advertising network without their consent for tracking cookies. GDPR articles 5 and 8 have been violated. The GDPR will impose an administrative fine against the brand.
Consumer Law Aspect: If an advertisement on a news website "50% discount just for you!" but the same discount is applied to all users, or if the price has been artificially inflated or lowered beforehand, this constitutes deceptive advertising. The Advertising Board will also impose a cease and desist order and a fine on the brand.
Consequence of the Combined Application: The brand receives separate administrative fines from both the Personal Data Protection Authority and the Ministry of Trade's Advertising Board for a single advertising activity

Scenario 2: Using Data Analytics to Offer Consumers Personalized, False Prices

An airline company processes a user's mobile device data to identify them as a frequent traveler in a high-income group (profiling). When this user accesses the site via targeted advertising, the ticket price is displayed as 5,000 TL, while for another user without flight tracking cookies, the price is displayed as 3,000 TL.

GDPR Violation: The obligation to inform (Article 10) regarding the profiling activity used to estimate the user's income level and travel frequency has not been fulfilled, and explicit consent has not been obtained.
Consumer Law Aspect: According to Article 6 of the Consumer Protection Law, the consumer has been deceived and subjected to unfair commercial practice by applying a discriminatory price without justifiable cause. The consumer to the Consumer Arbitration Board .

5. Transparency Standards: “Why Am I Seeing This Ad?” Mechanism

The most important common principle that both the Personal Data Protection Law (KVKK) and Consumer Law agree on regarding targeted advertising is the principle of Transparency .

                           TRANSPARENCY STANDARDS SCHEME │ ┌──────────────────────────────────┴────────────────────────────────────┐ ▼ ▼ GDPR INFORMATION OBLIGATION CONSUMER ADVERTISEMENT NOTIFICATION • Which personal data is processed • Clearly stating that the content is an advertisement • For what profiling purposes the data is used • "Why are you seeing this ad?" button • Which advertising partners the data is transferred to • Option to disable personalized advertising

Clear Advertising Label: Targeted content presented on social media or websites "Sponsored, "Advertisement," or "Paid Collaboration" in a way that is immediately visible to the consumer (Turkish Consumer Protection Law, Article 61).
Disclosure of Data Source: When a consumer clicks on a targeted advertisement or accesses a related menu;
- What data did you use to determine why this advertisement was shown (for example, "Because you are between 25-35 years old and interested in technology")?
- What source did this data come from?
- Users should be able to see that they can opt out of personalized ads with a single click if they wish .

6. Two-Way Compliance and Protection Guide for Businesses

Brands, e-commerce sites, and digital agencies conducting targeted advertising activities must implement the following integrated processes to protect themselves from both GDPR and Consumer Law sanctions:

                           DOUBLE-SIDED FIT GUIDE │ ┌─────────────────────┬──────────┴───────────┬───────────────────────┐ ▼ ▼ ▼ ▼ COOKIE MANAGEMENT PLATFORM INFORMATION AND CONSENT ADVERTISEMENT CONTENT OPT-OUT (CLOSURE) (CMP) SETUP MECHANISM SEPARATION CONTROL MECHANISM (Do not confuse tracking without explicit consent (Information and consent (Do not confuse price and claims (No targeting to the user)) Proof of closing)

Use an Advanced Cookie Management Platform (CMP): Keep marketing and targeting cookies disabled by default on your website or app . Do not trigger any targeting cookies until the consumer clicks the “Accept” button.
Separate Information and Explicit Consent: When informing the user in your cookie policy (Information Notice), present the process of obtaining explicit consent as a separate action. Combined consents such as "I have read the information notice and I accept targeted advertising" are legally invalid.
Use a Legal Filter in Dynamic Pricing and Profiling: Ensure your pricing algorithms don't exploit consumer desperation, urgency, or data such as device type. Base price differences on reasonable and justifiable commercial grounds.
Prove Your Advertising Claims: Ensure that personalized promises made in targeted advertising (such as 100% flawless results, lowest price guarantee, etc.) are concretely verifiable.
Adhere to the Data Minimization Principle: Don't collect more personal data than you need to conduct targeted advertising. Anonymize or delete advertising profiling data once the purpose has been achieved.

7. Legal Violation, Liability and Sanctions Analysis Table

The table below summarizes the main types of violations encountered in targeted advertising processes, their implications under the Turkish Personal Data Protection Law (KVKK) and Consumer Law, and the applicable sanctions:

Legal Violations and Sanctions Map in Targeted Advertising

Type of Violation / Scenario	Assessment from the Perspective of the Personal Data Protection Law (Law No. 6698)	Evaluation from the Perspective of Consumer Law (Law No. 6502)	Relevant Supervisory Authority	Administrative and Legal Sanctions that it will entail
Retargeting with Tracking Cookies Without Explicit Consent	Violation of Article 5 of the KVKK (Unlawful processing and transfer of personal data).	Cookie and advertising transparency violation (Commercial Advertising Regulation).	Personal Data Protection Authority & Advertising Board	Administrative fine by the Personal Data Protection Authority (KVKK), advertising ban by the Advertising Board .
Using Profiling Data to Offer Misleadingly Discriminatory Prices to Consumers	Violation of Article 11/1-g of the Personal Data Protection Law (Causing adverse consequences for an individual through automated systems).	Turkish Consumer Protection Law Article 6 (Unfair Commercial Practice) and Deceptive Pricing Advertising.	Ministry of Trade & Personal Data Protection Authority	Refund of the difference in price to the consumer , Administrative Fine by the Advertising Board .
Targeted Ad Display Based on Health/Sensitive Data	Violation of Article 6 of the KVKK (Processing of sensitive personal data without explicit consent).	Commercial Advertising Regulation (Health claims and advertisements contrary to legislation).	Personal Data Protection Authority & Ministry of Health (TİTCK)	Maximum GDPR fines, Ministry of Health administrative procedures and cancellations.
Targeted Toy/Game Advertising Using Children's Behavioral Data	KVKK Article 4 (Violation of the principle of compliance with the law and rules of fairness).	Commercial Advertising Regulation, Article 24 (Violation of Vulnerable Consumer Group).	Advertising Board & Personal Data Protection Authority	Heavy administrative fines and content access restrictions imposed by the Advertising Board .
Creating False Urgency with Dark Designs (Dark Patterns)	The consumer's consent to data processing is impaired due to vitiation of will.	Turkish Consumer Protection Law, Article 62 (Unfair Practices Impairing the Consumer's Freedom of Decision-Making).	Ministry of Trade Advertising Board	Blocking access to advertisements , national-level administrative fines .
Hiding the fact that sponsored targeted content is "advertisement"	KVKK Article 10 (Failure to fulfill the obligation to inform).	Turkish Consumer Protection Law Article 61 (Prohibition of Covert Advertising and Violation of the Principle of Transparency).	Advertising Board	Suspension of advertisement broadcast and monetary administrative penalties.

Conclusion

Targeted advertising, leveraging the possibilities offered by data analytics, is a powerful marketing tool that creates high conversion rates for brands and provides consumers with the opportunity to encounter content tailored to their interests. However, the limits of this power are defined by the right to protection of personal data (KVKK) , a fundamental human right, and consumer rights (TKHK) , which ensure economic security within the e-commerce ecosystem .

Both Turkish legislation and global legal norms do not completely prohibit targeted advertising; however, they link it Explicit Consent, Transparency, Honesty, and Freedom of Will . The most fundamental approach that businesses and advertisers should take is to view the Personal Data Protection Law (KVKK) and Consumer Law not as two competing fields, but two inseparable pillars of harmony in the digital market .

Businesses that collect personal data lawfully, are transparent in their profiling processes, and avoid misleading and manipulative targeting techniques will not only protect themselves from heavy administrative fines and reputational damage, but will also gain "Consumer Trust," the most valuable currency of the digital age .

Law Articles

The Simultaneous Application of GDPR and Consumer Law in Targeted Advertising: The Two-Way Legal Limits of Data-Driven Marketing