THE LEGAL ASPECTS OF INFLUENCER SCATTERS: NATIONAL LOTTERY PERMIT, ADVERTISING LAW, AND THE DATA PROTECTION LAW (KVKK)

Giveaways organized by influencers on social media platforms like Instagram, TikTok, YouTube, X, and similar platforms are widely used to increase follower count, build brand awareness, promote new products, and encourage consumer participation in campaigns.

Campaigns like "Follow us, like the post, tag two friends, and get a chance to win a prize" may seem like simple marketing activities to social media users, but legally they involve multiple areas of legislation.

Influencer giveaways;

Whether it is a lottery or draw that requires permission from the National Lottery Administration,
Whether the advertising relationship is clearly stated or not,
Whether the participation terms mislead the consumer,
The legal basis for processing participants' personal data,
How the winners were determined,
Whether the award was actually delivered,
How to share responsibility between the brand, agency, and influencer

They should be evaluated separately.

Therefore, designing only the social media post is not enough before organizing an influencer giveaway. The giveaway concept, campaign terms, consent process, advertising statement, and personal data processing method must all be prepared in accordance with the law.

What is an Influencer Giveaway Legally?

Not all applications marketed as "raffles" on social media have the same legal validity.

In legal assessment, the first thing to consider is the method used to determine the winner.

If the winner is selected randomly, by lottery, or through software, it is a chance-based draw. However, if the winner is determined based on knowledge, skill, creativity, speed, or jury evaluation, the application may be considered a competition.

This distinction is important because lotteries involving prizes based on chance and not cash are, as a rule, under the authority and supervision of the National Lottery Administration, while competitions based on knowledge or skill may be considered outside this scope.

The National Lottery Administration announced that a significant portion of the applications deemed exempt in 2024 consisted of competitions where the winner was determined by a ranking based on knowledge, skills, or talent, or by jury evaluation.

However, simply calling a campaign a "contest" does not automatically exempt it from legal considerations. If participants are asked to write comments and then a random selection is made from those comments, the campaign may be legally considered a lottery, even if it is labeled a contest.

Do I Need Permission for Free Influencer Giveaways?

The fact that no fee is charged for participation in the lottery does not automatically eliminate the requirement to obtain permission from the National Lottery Administration.

According to Article 41 of the Decree Law No. 320 on the National Lottery and the related Regulation; permission must be obtained from the National Lottery Administration for the distribution of non-cash prizes, such as goods or similar items, based on chance, either directly or through the sale of a good or service, with or without payment, by granting the right to participate.

The National Lottery Administration also explicitly states that whether participation is free or for a fee does not change the outcome, and that lotteries without cash prizes must be conducted with permission.

Therefore;

Following influencer accounts,
Liking the post,
To comment,
Tagging friends,
Sharing the post on your story,
Following the brand account,
Fill out the campaign form

Campaigns where participants are given the right to enter in exchange for a prize and the winner is determined randomly cannot be considered outside the scope of permission simply because they are free.

Even without requiring the purchase of a product, offering participants the chance to win a prize based on chance necessitates an examination of the practice under the National Lottery regulations.

Is permission always required for every social media campaign?

Not every promotional offer is a raffle.

For example, campaigns where everyone who meets a specific condition receives the same prize, and the winner is not determined by lottery or chance, may not be considered a lottery. Similarly, genuine competitions where the winner is determined based on knowledge, skills, talent, or an objective jury evaluation may also be considered outside the scope of this permission.

However, it is risky for an influencer or brand to unilaterally determine that the campaign is outside the scope of the agreement.

The National Lottery Administration also provides "favorable opinions" for competitions and similar applications that do not fall within its scope of authorization. Therefore, even if the campaign is not based on chance, obtaining a favorable opinion from the National Lottery Administration for applications outside its scope before the implementation is the safest method.

Especially in campaigns involving high-value prizes, wide participation, sales requirements, digital wheels, instant wins, surprise boxes, or algorithmic selection, legal classification should be determined from the outset.

Is it possible to hold an influencer giveaway with cash prizes?

In Türkiye, the right to plan, organize, and conduct lottery draws for games of chance with cash prizes belongs to the National Lottery Administration, except for exceptions stipulated in special laws.

Therefore, campaigns that rely on the random distribution of cash by private individuals or influencers carry a greater legal risk than classic promotional raffles that do not involve cash prizes.

If a brand or influencer plans to distribute cash, crypto assets, or easily convertible assets, a specific legal assessment must be conducted and the opinion of the National Lottery Administration obtained before the campaign begins.

Prizes such as products, cars, electronic devices, holidays, services, or gift cards that cannot be converted into cash may be subject to permission for non-cash raffle draws if the conditions are met.

Who should submit the permit application?

It must be clearly stated in whose name the draw is being held.

If an influencer is organizing a giveaway to promote their own product or account, the permission application may need to be submitted by the influencer or their business entity in their capacity as organizer.

If the raffle is conducted on behalf of a brand, the organizer will usually be the brand. In this case, the influencer may act as an advertising medium or campaign partner in the process of announcing and executing the campaign.

Agencies and lottery organizing companies may apply on behalf of the regulator if they have authorization. The National Lottery Administration states that the electronic application system can be used for those applying on their own behalf and those acting on behalf of third parties based on authorization.

The contract between the brand and the influencer should specify at least the following points:

Who is the official regulator?
Who will submit the permit application?
Who will pay the application and permit fees?
Who will procure the prize?
Who will conduct the draw?
Who will contact the winners?
Who is responsible for delivering the award?
Who will answer participant complaints?
Which party will process the personal data.

The fact that the contract assigns liability solely to the influencer or solely to the brand does not automatically absolve the parties of their legal responsibility before public authorities.

How to Apply for a National Lottery License?

Applications for permission and approval regarding non-cash prize draws will be made through the National Lottery Administration's electronic platform called "Çekilişevi" starting from February 2, 2026.

The regulator or authorized representative can become a member of the system, submit application documents electronically, and track the application process through the system.

In general, the application should include:

The regulator's identity and trade registry information,
The start and end dates of the campaign,
The geographical area where the campaign will be valid,
Participation requirements,
How to participate on social media,
The type, number, and market value of the awards,
Date, time and method of the draw,
How the winner and alternate winners will be determined,
How the results will be announced,
How the awards will be delivered,
Advertisement and campaign texts

It should be explained.

In commercial raffles, the period between the date participation rights begin and the date participation ends must not exceed six months.

Application and Permit Fees for 2026

The application fee for a non-cash prize lottery permit application in 2026 is 12,758 TL plus VAT.

If permitted, an additional permit fee and VAT amounting to 15% of the total market value of the pledged prizes are charged. If the prize is imported from abroad or if the prize consists of goods and services sourced from third parties outside of the organizer's own production, the permit fee may increase to up to 30% of the prize's market value.

These costs should be considered when preparing the campaign budget. In raffles featuring high-value prizes such as cars, electronic devices, or vacations, the cost of obtaining permits can become a significant expense for the campaign.

Can those under 18 participate in the raffle?

Participation in raffles and lotteries organized or authorized by the National Lottery Administration is prohibited for individuals under the age of 18.

Even if a person under the age of 18 participates in the campaign and wins, the prize may not be awarded. The National Lottery Administration's published lists of permitted and exempted activities also include warnings that those under 18 cannot participate.

Therefore, the age limit should be clearly stated in the campaign terms and conditions, and the winner's age should be verified through legally permissible methods before the prize is delivered.

With the advertising regulation that will come into effect on August 1, 2026, targeted advertising using personal data-based profiling methods targeting children is also prohibited. Influencers with a child audience should also take this regulation into account in their giveaway advertisements.

Results of the Unauthorized Influencer Giveaway

Organizing a lottery or draw without permission from the National Lottery Administration is not merely an administrative shortcoming. Depending on the nature of the act, it may also result in criminal liability.

According to Article 41 of Decree Law No. 320, unauthorized lottery activities and related announcements and advertisements may be stopped; tickets, coupons, participation numbers and similar materials may be confiscated.

According to Article 52 of the Decree Law, those who organize or facilitate any kind of lottery or similar game without the permission granted by the legislation may be sentenced to imprisonment for three to five years and a judicial fine of up to ten thousand days.

Those who promote unauthorized lotteries through advertising or other means face imprisonment for one to three years and a fine of up to three thousand days' worth of daily wages.

If an influencer both organizes a giveaway and announces it to their millions of followers, depending on the specific circumstances, they may be considered not just an advertiser, but also someone who facilitates or enables the giveaway to be played.

The National Lottery Administration states that it monitors unauthorized social media lotteries and files criminal complaints with the public prosecutor's offices regarding practices detected on platforms such as Instagram, YouTube, Facebook, and X. Official records show that 286 criminal complaints were filed regarding illegal lotteries in 2024.

Unauthorized lottery content can also be subject to access blocking procedures under Law No. 5651.

Influencer giveaways are also a form of advertising

If an influencer giveaway is organized to promote a brand, product, or service, the giveaway post also constitutes commercial advertising.

According to Article 61 of the Law No. 6502 on Consumer Protection, commercial advertisements must be accurate, honest, and not misleading to the consumer. It is prohibited for advertisements to exploit a consumer's lack of knowledge or experience, or to conceal the fact that they are advertisements.

If an influencer is paid for sharing a giveaway, given a free product, provided with a prize, or receives any other benefit, the commercial relationship between the brand and the influencer must be clearly stated.

The Ministry of Trade's Guide for Social Media Influencers stipulates that advertisers, advertising agencies, and social media influencers are each separately responsible for compliance with regulations.

Therefore, the brand cannot automatically absolve itself of responsibility by claiming "The influencer conducted the giveaway on their own account," nor can the influencer automatically absolve themselves by claiming "The brand prepared the campaign terms.".

Advertising Notice for After August 1, 2026

According to the regulation that will come into effect on August 1, 2026, posts where the influencer receives a benefit such as income, free or discounted products or services, or event participation must clearly indicate that it is an advertisement.

In this context, the most visible part of the giveaway post must include either the word "ADVERTISEMENT" or "PROMOTION".

For example, a statement like this could be used:

“ADVERTISEMENT | This giveaway is organized as part of a commercial collaboration with brand X.”

Simply tagging the brand and using phrases like "collaboration," "sponsored," "gift time," or "giveaway" may not adequately explain the advertising relationship.

While using the platform's "paid partnership" tool can be helpful, it may not be a substitute for directly using the words "advertising" or "promotion.".

How should the raffle rules be explained?

Sweepstakes advertisements should not conceal essential information that could influence a consumer's decision.

The campaign post or readily available terms and conditions should clearly state at least the following:

The natural or legal person organizing the draw,
The role of sponsoring brands and influencers,
The start and end dates of the campaign,
Participation requirements,
Whether participation is free or not,
Age and residency requirements,
The brand, model, quantity, and key features of the award,
Total number of awards,
Date and method of the draw,
How the winner and alternate winners will be determined,
Where and when the results will be announced
How long do the winners have to apply?
The method of award delivery,
Who is responsible for taxes, shipping, or registration fees?
National Lottery Administration permission or approval information,
Information text regarding the processing of personal data.

Changing the participation conditions to the detriment of the consumer, reducing the number of prizes, or making delivery terms more stringent after the draw has started may be considered deceptive advertising and unfair commercial practice.

In a campaign advertised as "a brand new phone for one lucky winner," giving away an older model, used, or product with different specifications can also lead to consumer deception.

Fraudulent Sweepstakes and Non-Delivery of Prize

An influencer's actions, such as falsely presenting a giveaway as having taken place when they haven't, pre-determining the winner, declaring fake accounts as winners, or failing to deliver the promised prize, can give rise to multiple legal liabilities.

In this situation;

Violation of National Lottery regulations,
Deceptive advertising and unfair trade practices,
Contractual liability towards participants,
If the conditions are met, tort liability,
Criminal liability exists if the act was intended from the outset to obtain fraudulent gain

It may come up on the agenda.

According to the National Lottery regulations, individuals who fail to conduct the draw, announce the results, or fulfill their commitments despite obtaining the necessary permission are subject to imprisonment for two months to two years and a judicial fine of up to three thousand days.

The Ministry of Trade also warns consumers that fake prize and lottery applications can turn into fraudulent methods aimed at obtaining personal information or money.

Sanctions that the Advertising Board can impose

The Advertising Board may investigate a lottery advertisement if it is misleading, conceals the advertising relationship, presents false prize terms, or fails to award the promised prize to the consumer.

Advertising Board;

The advertisement should be stopped
Correcting the advertisement using the same method,
Administrative fines shall be imposed
Removal of content or blocking access when necessary

can decide.

In 2026, administrative fines for deceptive advertising and unfair commercial practices may range from 99,339 TL to 39,916,524 TL, taking into account the medium of the violation, its severity, the benefit obtained, the damage caused, the fault, and the economic situation.

These sanctions are independent of sanctions arising from National Lottery regulations or the Personal Data Protection Law (KVKK). Different processes may be initiated by the National Lottery Administration, the Advertising Board, and the Personal Data Protection Board regarding the same lottery draw.

THE GDPR ASPECTS OF INFLUENCER SURVEYS

In influencer giveaways, participants' personal data is often processed at different stages, from the start of the campaign to the delivery of the prize.

Data that can be processed includes:

Social media username,
First and last name,
Profile information,
Comment and tagging information,
Phone number,
Email address,
Date of birth,
Address,
Identity information,
Prize delivery and shipping information

It can be found.

The fact that a social media profile is public does not mean that personal data contained therein can be used without restriction for any purpose. Personal data processing activities must be based on the fundamental principles and processing conditions of the Law No. 6698 on the Protection of Personal Data.

Who is the Data Controller?

The data controller is the natural or legal person who determines the purposes and methods of processing personal data.

In influencer giveaways, the data controller is:

The influencer who organized the giveaway in their own name,
The brand that organized the campaign,
The agency that managed the campaign's data collection process

it could be.

A brand, influencer, and agency can each be considered a separate data controller with respect to their own defined data processing activities. However, if a party acts solely on technical instructions, it may be considered a data processor.

It is not sufficient for the parties to simply refer to each other as "data processors" in the contract. The actual role is determined by who actually defines the purposes and methods of processing personal data.

Is it always necessary to obtain explicit consent from participants?

The processing of personal data does not always require explicit consent.

Personal data required for receiving entries to the draw, verifying the conditions, determining the winner, and delivering the prize may be subject to processing conditions such as being directly related to the establishment or performance of a contract or the legitimate interest of the data controller, depending on the specific circumstances of the case.

In contrast, the participants' information;

To be used in subsequent advertising campaigns
Sending commercial communications,
Sharing with other brands,
Creating customer profiles,
Targeted advertising

It is not mandatory for the conduct of the draw.

For such secondary purposes, there must also be a suitable legal basis and, where necessary, explicit consent must be obtained.

The Information Notice and Explicit Consent Should Be Separate

According to Article 10 of the KVKK (Law on Protection of Personal Data), participants must be informed before their personal data is collected.

In the information text;

Identity of the data controller,
Personal data that is processed,
The purposes of data processing,
To whom the data can be transferred,
Data collection method,
Legal reason,
Participant's rights under the Personal Data Protection Law (KVKK)

It should be explained.

The obligation to inform must be fulfilled in all cases, whether or not data processing is based on explicit consent.

According to the Principle Decision No. 2026/347 dated February 18, 2026, of the Personal Data Protection Board, the information text and the explicit consent text should not be intertwined; they should be arranged under different headings and in a way that obtains separate declarations of intent.

A single, vaguely worded checkbox stating, "By participating in the draw, I consent to the processing of my personal data, its sharing with third parties, and the sending of advertising messages," may not be considered legally compliant.

Can marketing permission be made a condition for participation in the raffle?

Participants should not be required to accept receiving advertising messages in order to enter the draw.

Data processing required for the lottery should be separated from data processing for advertising and marketing purposes.

The Personal Data Protection Board's Principle Decision No. 2025/1072 dated June 10, 2025, states that consent to receive commercial electronic communications should not be presented as a mandatory element of product or service delivery, and that separate options should be offered for different data processing activities.

Therefore, the following options should be distinguished from each other on the participation form:

Personal data processing necessary for the conduct of the lottery
Sending advertising and campaign messages,
Transfer of data to group companies or business partners,
Profiling and targeted advertising activities.

Participants should be able to enter the draw even if they do not give their consent for marketing.

Participation in the draw does not automatically create consent for subsequent emails, SMS messages, or commercial communications. If commercial electronic communications are to be sent, separate consent and, if necessary, fulfillment of Message Management System obligations must be obtained in accordance with Law No. 6563 and related legislation.

Excessive data should not be collected

According to the Turkish Personal Data Protection Law (KVKK), it is essential that personal data be processed in a manner that is relevant to, limited to, and proportionate to the purpose for which they are processed.

All participants in the draw will initially be asked to;

Turkish Republic Identity Number,
Full address,
ID photo,
Bank information,
Date of birth

Requesting this may be excessive in many cases.

If a social media username or contact information is sufficient in the initial stage, no further data should be collected. Full address and identity verification information should only be obtained from the winner to the extent truly necessary for prize delivery and age verification.

Participants' identification photos or documents should not be kept unprotected in social media message boxes; secure systems accessible only to authorized personnel should be used.

Friend Tagging and Third-Party Data

Influencer giveaways often include the condition "tag two friends.".

In this case, the participant makes not only their own username visible in the campaign, but also the social media accounts of third parties who do not wish to participate in the draw.

The social media username of a tagged person may constitute personal data. Furthermore, there must be an independent legal basis for transferring this data to a database, creating a profile, or using it for marketing purposes.

Brands and influencers cannot add third parties to their potential customer lists or send them direct advertising messages simply because they have been tagged. The Personal Data Protection Authority emphasizes that the use of contact information obtained from third parties for advertising and marketing purposes must also include disclosure and valid data processing conditions.

Announcement of Winners

All of the winner's personal information should not be published when the winner is announced.

The winner;

Full name and surname,
Phone number,
Full address,
Identity number,
Email address

It should not be shared publicly.

In the results announcement, it may be preferred to partially mask the username or full name information, taking into account the campaign terms and conditions and the National Lottery's permission requirements.

If the winner's photo, video, or image while receiving the prize is planned to be shared for advertising purposes, this use must be considered separately from the conduct of the draw. Explicit, specific, and informed permission is required for the use of the image for advertising purposes.

The requirement that the winner must appear in the promotional video in order to win the prize could raise questions about whether explicit consent is given freely.

Transfer of Personal Data to Brands, Agencies and Shipping Companies

During the award ceremony, the winner's data will be used;

To the sponsoring brand,
To the agency managing the campaign,
To the raffle organizing company,
To the cargo or logistics company,
To accounting and legal service providers

transferable.

The purpose and legal basis for these data transfers should be explained in the disclosure statement. Instead of providing each service provider with the entire participant list, only the data required for the service should be transferred.

For example, while providing the shipping company with only the winner's name, contact information, and delivery address is sufficient, requiring the contact information of all participants is excessive.

If campaign data is transferred to social media, cloud storage, or analytics services abroad, a separate assessment must be made under Article 9 of the KVKK (Turkish Personal Data Protection Law) regarding data transfer abroad.

Retention Period and Data Deletion

Participant data should not be stored indefinitely.

Data;

The conduct of the draw,
Determining the winner,
Award delivery,
The deadlines for objections and complaints,
National Lottery audits,
Tax and accounting obligations

It can be stored for as long as it is needed.

Personal data must be deleted, destroyed, or anonymized when the storage purpose has ended. Regarding the contact information of participants who have given marketing consent, the withdrawal of relevant consent and the procedures for refusing commercial communications must also be considered.

Penalties for GDPR Violations in 2026

The main administrative fines that can be applied under Article 18 of the Personal Data Protection Law in 2026 are as follows:

Failure to fulfill the obligation to provide information: 85,437 TL to 1,709,200 TL,
Failure to fulfill data security obligations: Between 256,357 TL and 17,092,242 TL
Failure to comply with the decisions of the Personal Data Protection Board: 427,263 TL to 17,092,242 TL,
Violation of the obligation to register with the Data Controllers Registry: Fines ranging from 341,809 TL to 17,092,242 TL.

The amount of the penalty is determined according to the nature of the violation, fault, economic situation, and the specifics of the incident.

The unlawful recording, disclosure, or acquisition of personal data may also result in offenses under the Turkish Penal Code.

What should be included in a contract between a brand and an influencer?

If influencer giveaways are organized as part of a brand collaboration, it is not sufficient for the contract to only include the sharing date and fee.

The contract should address at least the following points:

Regulatory and permitting responsibility

The official organizer of the lottery, the party that will submit the National Lottery application, the license fees, and the requirement to obtain permission before the campaign begins must be specified.

Procurement and delivery of the award

The award's brand, model, quantity, and market value should be specified; along with who will purchase the award, where it will be stored, and the timeframe for delivering it to the winner.

Advertisement description

It must be determined how the influencer will use the terms "advertisement" or "promotion" in their post; and how they will direct users to the brand account, permission information, and campaign terms and conditions.

Conducting the draw

The document should explain how the participant list will be generated, how duplicate entries will be filtered out, which software or method will be used to select the winner, and how the process will be recorded.

Personal Data Protection Law responsibilities

The brand, influencer, and agency must determine their roles as data controllers or data processors; who will prepare the privacy policy; who will store the data; the notification process in case of a data breach; and who will respond to requests for personal data.

Consumer complaints

The breakdown of responsibilities should be stated in case the prize is not delivered, the winner cannot be reached, the product is defective, or there are objections to the participation terms.

Administrative and penal sanctions

The agreement may stipulate that the parties shall be responsible for violations occurring within their respective areas of fault; that the brand shall compensate for damages arising from misinformation, lack of permission, or failure to provide awards; and that the influencer shall compensate for damages arising from unauthorized changes or illegal postings.

However, compensation and recourse provisions agreed upon in internal relations do not limit the powers of public authorities arising from the law.

Essential Checklist for a Legally Compliant Influencer Giveaway

Before an influencer giveaway can be published, the following questions must be answered:

Is the winner determined by chance or skill?
Has National Lottery received permission or an approval for being exempt from the scope?
Was the campaign announced without permission?
Is the official regulator a brand or an influencer?
Is the market value of the prize and the receipt document available?
Are the participation terms and conditions written in a clear and unchangeable form?
Was an age limit of eighteen specified?
Is the advertisement or promotional text visible at first glance?
Can the method used to determine the winner be audited?
Have the alternate winners and application deadlines been determined?
Have the award delivery dates and costs been announced?
Has the KVKK (Personal Data Protection Law) information text been prepared?
Has marketing permission been withdrawn from the raffle entry?
Is too much personal data being collected?
Are personal data protected in the announcement of the winners?
Is the responsibility between the brand, influencer, and agency regulated in the contract?

Conclusion

Influencer giveaways are not just social media events aimed at increasing followers. When a non-cash prize is awarded through random selection, even if participation is free, permission may be required from the National Lottery Administration.

While practices where the winner is determined by knowledge, skill, or jury evaluation may be excluded from the scope, obtaining approval from the National Lottery Administration before the campaign begins provides legal security.

Organizing unauthorized raffles can result in the suspension of content, blocking of access, imprisonment, and fines. Obtaining permission does not negate the obligation to comply with advertising and personal data regulations.

If the raffle is conducted as part of a brand collaboration, the advertising relationship must be clearly stated; in particular, the words "advertisement" or "promotion" must be used visibly after August 1, 2026.

Personal data collected from participants should only be processed to the extent required for the raffle; the information notice and explicit consent should be separated, and marketing permission should not be made a condition for participation in the raffle.

A legally compliant influencer giveaway requires that permission, advertising, consumer, personal data, and contract processes be planned together before the campaign is launched. Otherwise, both the brand and the influencer may face separate liability with the National Lottery Administration, the Advertising Board, the Personal Data Protection Board, and judicial authorities due to the same campaign.

Single Blog Title