3 min read
Cookie consent under Turkish data protection law
Most cookie banners on Turkish sites do not collect valid consent. Four common mistakes and what a correct setup looks like.
Most sites in Türkiye have a cookie banner. On most of them the banner does nothing useful — because measurement has already started before consent is given. This article is not legal advice; it describes, from a developer's point of view, what is technically set up wrong.
Mistake 1: measurement starts before the banner
The most common setup is this: the Google Analytics script loads at the top of the page, while the cookie banner is rendered by React a few hundred milliseconds later. By the time the visitor clicks "accept", the measurement has already happened and the cookie has already been written. The presence of the banner does not fix that.
There are two correct approaches: either the measurement script is not loaded at all until consent arrives, or Google's Consent Mode is used to set the default state to "denied" — and that setup must run BEFORE every other script. If the order is reversed, Google's own default applies, and that default is granted.
Mistake 2: refusing is harder than accepting
"Accept all" is large and colourful, while "reject" is a small link three clicks away. That design choice is a dark pattern, and it makes the collected consent legally questionable. Valid consent must be freely given; an interface that makes refusal harder undermines that condition.
The test is simple: refusing must take the same number of clicks and carry the same visual weight as accepting.
Mistake 3: there is no way to withdraw
Once "accept" has been clicked, the banner never appears again and there is no way to change the decision. But consent has to be withdrawable — and as easy to withdraw as it was to give. In practice that means a button on the cookie policy page: it clears the record, brings the banner back and withdraws the measurement permissions immediately.
Mistake 4: the text does not match reality
Cookie policies are usually copied from the internet. The result is a text that lists cookies the site does not use and never mentions the ones it does. That is misinformation for the visitor, and one of the first things noticed in an audit.
To see what your own site stores, open the browser developer tools and look at the Application tab. The list you see there should match the list in your policy. There is also a commonly missed distinction: things like a theme preference or the cookie decision are usually not cookies at all — they live in the browser's local storage and are never sent to a server. The text should say so correctly.
What does a correct setup look like?
- At the very top of the page, before any measurement script, all permissions are set to "denied".
- If a stored decision exists it is applied immediately; if not, the banner appears.
- Accept and reject carry equal weight in the banner, and choices can be made per category.
- The analytics script loads only after consent is given.
- The decision is stored in the browser and can be withdrawn in one click from the cookie policy page.
- If the categories change, the stored consent is treated as invalid and the visitor is asked again.
The last item is the most frequently skipped. When you add a new advertising pixel to the site, the consent your earlier visitors gave now covers something different. If you do not track a version number, people are treated as having consented to processing they never agreed to.