Ecommerce Website Legal Requirements in Türkiye 2026: KVKK, ETBİS and Contracts

For most small and mid-sized businesses, ecommerce website legal requirements only come up after the site has launched. Products are uploaded, campaigns are ready, and then the virtual POS application asks "What is your ETBİS registration number?" Or a customer requests a return and you realise there is no proper returns page. In this article we go through, one by one, the legal elements a business selling online in Türkiye needs on its website in 2026. If you are a foreign company selling to Turkish consumers, or considering a Türkiye-based agency, this gives you the local picture; rules in other countries differ.

For each item we answer three questions: what is the requirement, how should it appear on the site, and what happens if it is missing? We are not trying to replace your lawyer or accountant. The goal is a practical checklist so that when you sit down with them, you know exactly what to ask.

Ecommerce website legal requirements: quick checklist table

Before going into detail, here is the full list in one table. Open your own site and check it against each row.

1. How to register with ETBİS, and why it comes first

ETBİS (the Electronic Commerce Information System) is the Ministry of Trade's register of businesses selling online in Türkiye. Under Law No. 6563 on the Regulation of Electronic Commerce and its implementing regulation, service providers selling through their own website or app are expected to register.

ETBİS registration step by step

1. Log in to ETBİS via e-Devlet (the Turkish e-government portal) or via the Ministry of Trade's ecommerce information platform. For companies, an authorised person must log in.
2. Check your company details (tax number, MERSİS number, trade name, contact information).
3. Add the domain names you sell on. If you have more than one site, define each one separately.
4. If you have marketplace stores, enter those details in the relevant section too.
5. Once registration is complete, add the QR code and verification link you receive to your website footer.

When your details change (address, domain, trade name), you also need to update your ETBİS record. A forgotten update can show up as a mismatch when a payment provider runs its checks.

What happens if it is missing? The law provides for an administrative fine for failing to register. The consequence you will feel faster in practice: payment providers such as iyzico and PayTR, and banks, usually ask for ETBİS details when you apply for a virtual POS. Without registration, your application may be put on hold or rejected.

2. Pre-information form and distance sales contract template

Türkiye's Consumer Protection Law No. 6502 and the Distance Contracts Regulation require certain information to be given to the consumer before the sale, and for that to be confirmed. These two documents are often confused, but they do different jobs.

• Pre-information form: The text the customer must read before paying. It covers the seller's identity, the main features of the product, the total price including taxes, delivery costs, payment and delivery method, the right of withdrawal and its conditions, and complaint channels.
• Distance sales contract: The actual contract between the parties. It contains the order-specific buyer details, product, price and delivery information.

What should a good distance sales contract include?

• The seller's full trade name, MERSİS number, address, phone and email
• Product name, quantity, unit price and total, filled in automatically from the order
• Delivery time (the legal maximum is generally 30 days)
• How the right of withdrawal is exercised and its duration
• Exceptions to the right of withdrawal (e.g. products made to the customer's specification)
• The consumer arbitration committee and court to apply to in a dispute

On the technical side, what matters is that each document is accepted with its own checkbox at the payment step, and that the boxes are not pre-ticked. A copy of the contract should also be emailed to the customer after the order.

What happens if it is missing? Where pre-information is not provided, outcomes may favour the consumer; for example, the business is in a weak position in disputes over the withdrawal period. Administrative fines and lost cases before the consumer arbitration committee also become a real possibility.

3. Returns and right of withdrawal page

As a general rule in Turkish distance sales, the consumer has the right to withdraw within 14 days of receiving the product, without giving a reason. Once the withdrawal notice arrives, the seller must refund the payment within a set period. Writing these rules into the contract is not enough; there should be a separate "Returns and Exchanges" page that the customer can easily find before buying.

Explain the following in plain language on that page:

• How to create a return request (form, email, customer account)
• Who pays for return shipping, and the contracted courier code
• The condition the product must be returned in
• How and when the refund will be made
• Product groups where the right of withdrawal does not apply

What happens if it is missing? If customers cannot find your return conditions, they either abandon the order or, when something goes wrong, go straight to complaint platforms. Marketplaces and payment providers also check your returns policy when reviewing applications. If you apply different policies on marketplaces and on your own site, make this clear; when you set up marketplace integration, return processes need to stay in sync as well.

4. KVKK privacy notice and cookie policy

Law No. 6698 on the Protection of Personal Data (KVKK, Türkiye's data protection law) directly affects ecommerce sites, because data such as names, addresses, phone numbers, emails and order history is processed constantly. If you also sell in the EU or UK, GDPR and local rules apply separately.

Privacy notice vs explicit consent

The privacy notice explains which data you process and why, on what legal basis, who you share it with, and the person's rights. The customer is only informed; no consent is collected. Explicit consent, on the other hand, must be obtained separately and freely for processing that cannot rely on another legal basis such as performance of a contract (e.g. profiling for marketing). A common mistake is combining the two in a single checkbox, or making an order conditional on explicit consent.

How does a KVKK cookie policy work on a website?

According to the cookie guidance published by the KVKK, user consent is required for analytics, personalisation and advertising cookies, meaning anything beyond cookies strictly necessary for the site to function. In practice this means:

• A cookie banner should appear on the first visit, and tags such as Google Analytics or the Meta Pixel should not fire before consent.
• A "Reject" option should be as easy to find as "Accept".
• Users should be able to choose by category and change their choice later.
• A separate cookie policy page should list the cookies in use.

Amendments made to the law in 2024 on cross-border data transfers (foreign servers, ad platforms) may also require you to update your texts. Follow the official KVKK website for current guidance. Whether VERBİS (the data controllers' registry) registration is mandatory for you depends on employee numbers and balance sheet thresholds; check these against the official source too.

What happens if it is missing? The KVKK provides for administrative fines for breaching the duty to inform and data security obligations. On top of that, ad tracking that collects data unlawfully is a separate risk; a single complaint can lead to your entire marketing setup being questioned.

Adding a cookie banner just for show is not much different from having none at all. What matters is that tracking codes genuinely do not run until consent is given.

5. Is İYS registration mandatory? Commercial message permissions

İYS (the Message Management System) is Türkiye's central register of permissions for commercial electronic messages. If you send campaigns, discounts or new product announcements by SMS, email or phone call, the general rule is that you must register with İYS and upload the permissions you collect. Permissions not recorded in İYS may be treated as invalid for sending messages.

Points to watch on your site:

• Newsletter and SMS consent boxes must not be pre-ticked.
• The consent text should state clearly what is being agreed to (SMS, email and calls separately).
• Permissions collected on the site should be passed to İYS through your email or SMS platform.
• Every message should include an easy way to opt out (unsubscribe).

Transactional notifications such as order confirmations, shipment tracking and invoice notices are not commercial messages. However, the moment you add something like "a discount on your next order" to these messages, their nature changes. Exemptions and thresholds for small businesses change from time to time, so check your own situation against İYS's official announcements.

What happens if it is missing? Complaints about unsolicited messages can be referred to the Ministry of Trade, and fines calculated per message can follow. With bulk sends, this risk grows quickly.

6. E-archive, e-invoicing and price display

Businesses selling online in Türkiye must switch to e-invoice and e-archive invoicing once they exceed certain turnover thresholds. These thresholds are updated by the Revenue Administration; review them annually with your accountant. E-archive invoices issued for online sales must also include fields such as the payment method, dispatch date and carrier details.

Operationally, the most efficient approach is for your ecommerce platform to issue the invoice automatically through an integrator when the order is confirmed. Manual invoicing takes time and creates tax risk through forgotten invoices. Ask about this integration from the start when choosing a platform; we cover this criterion in our ecommerce platform comparison.

Price display is regulated too: prices must be shown including taxes, and when offering a discount, the pre-discount price must be the reference price defined in the relevant regulation (the lowest price in the last 30 days rule). Writing "50% off" next to an inflated strikethrough price may be treated as an unfair commercial practice.

7. Payment security: SSL, 3D Secure and card data

Payment security is both a legal and a commercial requirement. The obligation to keep personal data secure comes from the KVKK, while card security standards are set out in payment provider contracts.

• SSL (HTTPS): The whole site should run over HTTPS, not just the payment page. Otherwise browsers show a "not secure" warning.
• 3D Secure: Verification through the cardholder's bank protects the business in fraud-related disputes (chargebacks).
• Do not store card data: Card numbers should not be kept on your server; use the payment provider's secure form or tokenisation.
• Up-to-date software: Old plugins and unpatched platforms are among the most common entry points for data leaks.

What happens if it is missing? Missing SSL drives visitors away and sends a negative signal for SEO. For charges taken without 3D Secure, the amount is usually clawed back from the business if disputed. A data leak means a notification obligation to the KVKK and serious reputational damage.

Pages every ecommerce website needs

Turning the points above into a page list, your footer should show at least the following:

1. About us and contact / imprint (trade name, MERSİS number, address, phone, email, registered chamber)
2. Pre-information form
3. Distance sales contract
4. Returns, exchanges and right of withdrawal
5. Delivery and shipping terms
6. KVKK privacy notice
7. Privacy policy
8. Cookie policy and cookie preferences panel
9. Membership agreement (if you have customer accounts)
10. ETBİS QR code and payment logos

Beyond these, accessibility for users with disabilities is an increasingly important topic; you can find the details in our article on website accessibility compliance. If you are building from scratch, our guide on how to build an ecommerce website also explains where legal pages fit into the planning order.

How to check your site's compliance

You can check this list by hand, but it takes time and some problems are invisible to the eye. For example, even if the cookie banner is visible, you need to look at the browser's developer tools to see whether analytics codes fire before consent. SSL certificate expiry, mixed content warnings (HTTP resources on an HTTPS page) or broken contract links in the footer are also easy to miss.

That is why we recommend a two-stage approach:

1. Technical scan: Run a free website audit with Site X-Ray to check SSL, legal page links, cookie behaviour and basic security headers. The first 10 issues appear on screen immediately, and the full report is sent to your inbox.
2. Legal review: Have a lawyer review the content of your contracts and KVKK texts; a technical scan checks that they exist and work, not that the wording is correct.

Once the issues are identified, your own team can make the fixes. If your platform does not allow these changes, or you want to sort out payment, invoicing and consent processes in one go, Fietto Creative's ecommerce service treats these legal layers as part of the build. Remember: legislation can change several times a year, so reviewing this list at least once a year is a good habit.

Frequently asked questions