Cookies on E-Commerce Websites and Legal Requirements

Cookies, now familiar to most internet users, are text files placed on a user's device by websites and transmitted as part of an HTTP(S) request. They are small rich-text files that allow information about users to be stored on their terminal devices when they visit a website. Cookies used by e-commerce websites can be grouped under three headings: duration, purpose and party placing the cookie.

Cookies by Duration

Cookies are divided into session cookies and persistent cookies. Session cookies remain active during a session, help maintain continuity and are deleted when the browser is closed. Persistent cookies send processed user data to the server whenever the user visits the website. They support continuity and are not deleted when the browser closes, although they may be deleted automatically after a defined period.

Cookies by Purpose

By purpose, cookies are divided into four groups: strictly necessary, functional, performance and advertising or marketing cookies.

• Strictly necessary cookies are essential for an e-commerce website to operate, and blocking them may cause the website to malfunction. They should not be used for marketing or commercial purposes. Under the Turkish Personal Data Protection Law (KVKK), their use does not generally require explicit consent.
• Functional cookies are not essential for the e-commerce website to operate. They provide a more individual experience for members and visitors.
• Performance and analytics cookies are used to improve website features. They use technical information, such as how long a visitor remains on the website, to improve the user experience. They may also identify visitor traffic and search-engine keywords leading to the site or monitor navigation within the website.
• Advertising and marketing cookies aim to provide a more relevant experience by presenting advertising based on visitors' and users' interests. The resulting data allows more tailored recommendations. These cookies involve personalisation.

For cookies other than strictly necessary cookies, e-commerce websites should obtain the user's or visitor's preferences and, where required, consent. Whether or not a cookie requires consent, data subjects must always be informed about the processing.

For a more detailed discussion, see our publication on cookies under the KVKK.

First-Party and Third-Party Cookies

Whether a cookie is first-party or third-party depends on the website or domain that places it. First-party cookies are placed directly by the website visited by the user, which is the URL displayed in the browser's address bar, such as www.example.com. Third-party cookies are placed by a party other than the website or domain the user visits.

How Should E-Commerce Websites Use Cookies Lawfully?

Turkish law does not contain a single piece of legislation devoted exclusively to cookies. Data collected through cookies may, however, constitute personal data. Cookie practices must therefore be assessed under the KVKK and any personal data must be processed in compliance with that law.

Because the use and acceptance of cookies is closely connected with personal data processing, the KVKK applies to controllers using them. Cookies may be treated as personal data because they contain combinations of letters and numbers and can be personalised to an individual.

The Turkish Data Protection Board addressed cookies in its Amazon decision dated 27 February 2020 and numbered 2020/173.

The decision examined the statement that users who blocked or rejected cookies would be unable to add products to their basket, proceed to checkout or use Amazon services requiring sign-in. The Board found that making the service conditional on personal data processing could invalidate consent and breach the principles of lawfulness, fairness, relevance, limitation and proportionality in Article 4 of the KVKK. A first-time visitor could not be regarded as having expressed an affirmative intention to processing merely by entering the website, particularly before it was known whether the visitor would enter into a contract or consent to processing. The Board stated that information should be provided when the user first enters the website before processing begins through different technologies, and observed that no request for permission to process cookie data was provided. It concluded that the transparency duty had not been fulfilled in accordance with Article 10 of the Law and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

As the decision shows, cookies cannot simply be imposed as a precondition to a service. Users must be informed, and a mechanism must obtain an affirmative choice for cookies other than those that are strictly necessary.

How Should E-Commerce Websites Inform Users About Cookies?

The transparency obligation must be fulfilled in accordance with Article 10 of the KVKK and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

Because cookies involve the collection and use of personal data, users must be informed in advance of the purposes for which data will be collected and how it will be stored. They should also be told that cookies will be stored on their devices. The notice must clearly explain which cookies users can reject.

Website operators should identify their cookies clearly. The purpose of each cookie should be explained and, where appropriate, set out in a detailed table. The number and type of cookies vary between websites, so providing sufficient information about the cookies in use is important to fulfilling the transparency obligation properly.

How Should E-Commerce Websites Manage Cookies Requiring Explicit Consent?

When the KVKK and the General Data Protection Regulation (GDPR) are considered together:

• Where processing is based on consent, the e-commerce website acting as controller must be able to demonstrate that the data subject consented to the processing of their personal data.
• Where consent is given in a written declaration that also concerns other matters, the request for consent must be clearly distinguishable, intelligible, easily accessible, clear and written in plain language.
• The data subject has the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal. The data subject must be informed of this before giving consent, and withdrawing consent must be as easy as giving it.
• When assessing whether consent was freely given, particular care must be taken to determine whether performance of a contract, including provision of a service, is conditional on consent to processing that is not necessary for that contract.

The e-commerce website must be able to prove that it obtained valid explicit consent. The consent request should be separate from other requests, intelligible and easily accessible. Withdrawal should be available through an equally straightforward process.

Users should make a specific choice for each category of cookie. Where strictly necessary cookies are used, explaining why they are necessary helps distinguish them objectively from consent-based cookies. Users and visitors must remain free to accept or reject non-essential cookies.

In a decision dated 29 December 2022 and announced on 12 January 2023, the French data protection authority, CNIL, imposed a total fine of EUR 5 million following its review of TikTok's cookie practices because users could not reject cookies as easily as they could accept them and were not adequately informed.

In light of these points, e-commerce websites should design and operate cookie practices within their data protection compliance obligations.