Review of the Decisions of the Advertising Board of Türkiye in the Scope of Turkish Personal Data Protection Law

Hande Çağla Yılmaz and Mustafa İriboz co-authored this article.

The decisions of the 349th meeting of the Advertising Boardof the the Ministry of Trade of the Republic of Türkiye ("Advertising Board" or "Board"") held on September 10, 2024 have been published on the official website of the Ministry. The decisions resulting from the Board’s inspections of digital platforms ("Digital Platform" or "Platform") provide valuable insights at the intersection of personal data protection law and consumer law.

In these decisions, the subscription processes of popular platforms such as Netflix, Spotify, Amazon Prime, Disney+, and YouTube were reviewed. Please find our legal briefing on the decisions ruled as unfair and/or deceptive commercial practices below

I. Mandatory Sharing of Credit/Debit Card Information During Free Trial Periods

In decision no.2024/5156, the Board found that Amazon Turkey Perakende Hizmetleri Ltd. Şti. required consumers to enter credit or debit card information to access the “30-Day Free Trial” offer. The Board emphasized that this requirement violated the data minimization principle set out in Law No. 6698 on the Protection of Personal Data (“PDPL”).

Furthermore, the Board noted that requiring credit or debit card information, despite the term “Free Trial” creates a perception among consumers that the service might not truly be free.

In Addition, the Board emphasized that consumers should be clearly informed about how their personal data (“Personal Data” or “Data”) will be processed. For instance, if a free trial offer is provided, consumers must be explicitly informed in line with the explicit consent principle under PDPL, that any credit or debit card information collected during this process will be usedfor future automatic renewals, and consumers should be given the option to accept or decline this usage.

In decision no.2024/5158, the Board evaluated that requiring consumers to enter credit card information and pre-setting the subscription option in MUBI Dijital Hizmetler Anonim Şirketi’s “Free Trial” offer was contrary to the data minimization principle and the validity of for explicit consent under the PDPL. The Board stated that collecting consumers’ personal data (credit card information) at the initial stage of a free trial is inconsistent with the claim that the service is “free” and could be considered non-compliant with the data minimization principle.

In summary, the Board found that these practices are unfair commercial practices, as they limit consumers’ freedom of choice, result in the processing of personal data in violation of to the data minimization principle and fail to meet the conditions for valid explicit consent.

II. Complexity of Account Closure and Data Deletion Processes

In decision no.2024/5159, the Board found that the account closure and data deletion process of Spotify Dijital Yayıncılık Hizmetleri A.Ş was structured in a complex manner.

It is important to note that under Article 11 of the PDPL, individuals have the right to request the deletion of their personal data at any time. However, the Board stated in its decision that the complexity of this process, along with repeated confirmation requests, makes it difficult for consumers to exercise this right. The Board highlighted that such online designs can be described as (“dark patterns”) deceptive design techniques that intentionally steer users toward a specific outcome.

In addition, the Board emphasized the need for platforms to be transparent about how and why personal data is processed. Complexity at the account closure stage could prevent or delay users’ requests for data deletion, which the Board found to be in violation of the general principles outlined in Article 4 of the PDPL.

III. Updated Membership Agreements and Explicit Consent Processes

In decision no.2024/5325, the Board evaluated the design of the updated membership agreements of Blu Tv İletişim ve Dijital Yayın Hizmetleri A.Ş. are specifically highlighting the prominence of the "accept" option while failing to clearly present a "decline" option, from the perspective of the PDPL.

The Board noted that presenting users with one-sided options to give consent while concealing the alternatives to decline may prevent users from making an informed choice, which would constitute a violation under the PDPL.

IV. Impact of Commercial Design on Personal Data

In decisions with no. 2024/5156-5158-5159-5161, the Board highlighted another significant issue of the influence of commercial designs and presentations on consumers’ personal data. For instance, the Board emphasized that presenting certain subscription options as pre-selected and visually emphasizing certain options could impact consumers' willingness to share their data. The Board further emphasized that such practices by platforms could potentially lead to the following consequences under the PDPL:

• Pre-selected packages or auto-renewal features may result in consumers' personal data being processed without their full knowledge. In such cases, consumers may not fully understand which data is being used and for what purpose, thus violating the validity conditions for explicit consent under the PDPL. 

• Digital platforms must be transparent in the services they provide to consumers and to clearly inform them about of purposes for which their data will be used. Concealing data processing practices through the deceptive design elements or complex processes constitutes a violation of data protection law.

V. Conclusion

The Board’s decisions regarding digital platforms provide a significant roadmap not only for the protection of consumers' personal data but also for the proper methods of data processing. Practices such as requiring credit card information during free trial periods, complicating account closure processes, and promoting one-sided approvals in membership agreements violate both consumer law and personal data protection law.

When processing personal data, platforms are expected to provide consumers with a clear, transparent, and understandable roadmap that aligns with the fundamental principles of the PDPL. Data processing activities and unfair commercial practices carried out without obtaining consumers' informed and explicit consent fall under the jurisdiction of not only the both the Advertising Board but also the Turkish Personal Data Protection Board.

You may access the Board’s decisions from here.