An online shop selling in Turkey has five core legal obligations: registering with ETBİS and showing company details on the site, presenting a pre-information form and distance sales contract, honouring the 14-day right of withdrawal, meeting KVKK rules on privacy notices and cookie consent, and issuing e-archive invoices while collecting consent for marketing messages. All of them belong in place before launch.
Key takeaways
- Every business trading online registers with the Ministry of Trade's Electronic Commerce Information System (ETBİS) and displays its trade name, address and contact details on the site.
- Before a consumer places an order, the shop shows a pre-information form and has them accept a distance sales contract; consumers can withdraw within 14 days of delivery.
- KVKK, Turkey's Personal Data Protection Law, requires an online shop to provide a privacy notice, obtain explicit consent where it applies, and get visitor opt-in for non-essential cookies.
- An online shop obtains the recipient's prior consent before sending marketing emails or SMS, and records that consent in the Message Management System (İYS).
- This is a practical overview rather than legal advice; check your own situation with a lawyer and your accountant.
What does a legally incomplete online shop cost you?
According to the Ministry of Trade's E-Commerce in Turkey 2025 report, the number of businesses selling online rose from 600,800 in 2024 to 634,611 in 2025. Every one of them is subject to the same consumer, data protection and marketing message rules.
The data protection side is busy too. The Turkish Data Protection Authority's 2025 annual report shows it received 12,512 complaints and notices in 2025, 6,506 of them about unlawful processing of personal data. Any shop that stores customers' addresses, phone numbers and order histories could be on the receiving end of one.
Fines are only part of the bill. Refund disputes can go to consumer arbitration committees or consumer courts, payment providers usually review your policy pages before approving a virtual POS, and marketing sent without consent turns into complaints. Fixing these gaps after launch usually costs more than building them in from the start.
Which laws apply to an online shop in Turkey?
There is no single "e-commerce act"; several sets of rules overlap. The table maps each area to its legal basis and what it means on the site.
| Area | Main legal basis | What it means on your site |
|---|---|---|
| E-commerce and company details | Law No. 6563 on the Regulation of Electronic Commerce and its regulation on service providers | ETBİS registration; trade name, address, MERSİS number, email and phone shown |
| Selling to consumers | Consumer Protection Law No. 6502 and the Distance Contracts Regulation | Pre-information form, distance sales contract, right of withdrawal and a returns process |
| Personal data | Personal Data Protection Law No. 6698 (KVKK) | Privacy notice, explicit consent, cookie opt-in, security measures |
| Marketing messages | Law No. 6563 and the regulation on commercial electronic messages | Prior consent, İYS records, an easy opt-out in every message |
| Invoicing | Tax Procedure Law and e-document rules | E-archive or e-invoice issuance |
| Prices and discounts | Rules on price labelling and on advertising and unfair commercial practices | VAT-inclusive total price, honest discount claims |
If you have not yet chosen a platform, treat this table as a requirements list. Much of the ready-made versus custom e-commerce decision comes down to who builds and maintains these flows.
How do you complete ETBİS registration and company details?
Businesses that start trading online register with ETBİS through the e-Government gateway and declare their domain names. Marketplace sellers register too, not just businesses with their own website. If you plan to add channels, keep the registered details consistent everywhere when you set up marketplace integration.
The site must also make clear who is selling: trade name, MERSİS number, full address, email, phone and, where relevant, professional chamber details. These usually sit in the footer and on the Contact page, using exactly the trade name in your contracts.
What must a customer see before placing an order?
An online sale to a consumer is a distance contract under Turkish law. Before the order is confirmed, the customer is shown a pre-information form and accepts it; once the contract is formed, its text is sent on a durable medium such as email. We cover how to design the checkout itself in our e-commerce payment methods guide.
The pre-information form should cover at least the seller's identity and contact details, the main features of the product, the total price including taxes, delivery charges, payment and delivery terms, how to exercise the right of withdrawal and where to complain. Goods must be delivered within the promised time and in any case no later than 30 days after the order. Keep the contract text exactly as it stood at the time of each order.
How should withdrawal and returns work?
Consumers may withdraw from the purchase without giving a reason within 14 days of receiving the goods. Once the seller receives the withdrawal notice, the price must be refunded within 14 days at the latest. Keep those periods consistent across the site, contract and customer service replies.
Not every product carries a right of withdrawal. The regulation lists exceptions such as goods made to the customer's specification, goods that deteriorate quickly or may pass their expiry date, and items whose packaging cannot be returned once opened for health or hygiene reasons. If you sell exempt items, state in the pre-information form and the contract that there is no right of withdrawal; showing the same on the product page is good practice. Without that information, relying on the exception becomes difficult.
What does KVKK expect from an online shop?
Sign-up, ordering, delivery and payment all involve personal data. The site has to explain what it collects, why and on what legal basis in a privacy notice. Where the notice ends and consent begins is explained in our piece on explicit consent versus the privacy notice.
Cookies are a separate matter. Under the authority's cookie guidance, analytics and advertising cookies that the site does not strictly need should depend on the visitor's consent, so tracking scripts must not fire before it is given. Making "Reject all" as easy to find as "Accept" is also good practice.
Security is an obligation too: keep card data off your servers, grant admin rights per person and log sensitive actions. If something goes wrong, our guide to data breach notification within 72 hours sets out the response.
Couriers, payment providers and hosting companies process data on your behalf. You need a data processing agreement with each of them, and should check whether your business crosses the thresholds for VERBİS registration. If your server, email or analytics provider sits outside Turkey, also check the rules on cross-border data transfers; Article 9 of KVKK, which governs them, was amended in 2024.
What about invoices, pricing and marketing messages?
Invoices for online sales are usually issued electronically. Because the Revenue Administration's turnover and sector thresholds change, confirm with your accountant which e-document applies to you; the basics are in our guide to the e-archive invoice.
Prices should be shown as the total including VAT, and delivery charges should not appear for the first time at checkout. When advertising a discount, the "previous price" should be the lowest price charged in the 30 days before the reduction. Prices that always seem to be on sale invite both complaints and inspections.
Marketing emails and SMS require the recipient's prior consent. That consent is recorded in İYS, every message carries a free and simple way to opt out, and sending must stop within three business days of receiving an opt-out. Transactional messages such as order confirmations or tracking updates are not marketing, so keep the two lists apart.
A step-by-step checklist before you go live
- Register with ETBİS and declare your domain, covering any marketplace storefronts too.
- Publish your company details: trade name, MERSİS number, address, email and phone in the footer and on the contact page.
- Wire the pre-information form and distance sales contract into checkout, and keep the version accepted with each order.
- Write your withdrawal and returns policy, and flag exempt products in the pre-information form, the contract and on their product pages.
- Add a privacy notice and cookie consent, and make tracking scripts wait for consent.
- Check payment security: no card data on your servers, and orders confirmed only by the payment provider's server-side notification.
- Agree the invoicing set-up with your accountant.
- Separate marketing consent: newsletter and campaign opt-ins in their own unticked boxes.
Starting from scratch? Read this alongside the technical steps in how to start an online store.
Where does SmartSales take some of the load?
SmartSales is the e-commerce product in Digital Bridge's Smart360 family. Orders, payments, shipping, returns and campaigns share one panel, and some of the legal flows above come built in.
- The distance sales contract and pre-information form are generated with the shop's trade name and frozen against each order; exempt products are reflected in the contract automatically.
- Customers request returns within the 14-day withdrawal period, choosing line, quantity and reason; exempt products cannot be returned.
- Card details go into the payment provider's embedded form and never touch the shop's server; orders are confirmed only by the provider's signed server notification.
- Tracking pixels do not run without cookie consent, and customers switch marketing email consent on or off from their own account.
- When a customer deletes their account, personal fields are anonymised while order records that must be kept by law remain in masked form.
- Six ready-made roles and 22 permissions control the panel; price, stock and export changes go into an audit log that cannot be edited or deleted.
For a boutique selling personalised embroidered items, those products are marked as exempt, the contract picks this up and customers cannot open a return for them. The wording of your legal texts, your ETBİS and İYS records and your invoicing remain the business's responsibility, though; SmartSales carries these flows but does not replace legal advice.
How can Digital Bridge help?
Our data protection compliance consultancy prepares privacy notices, consent flows and a data inventory tailored to your business, following the steps outlined in our KVKK compliance guide. If you sell to dealers, need an ERP connection or have unusual business rules, our e-commerce and B2B software work builds those requirements into the design from day one.
What is the next step?
Run the eight-point checklist against your current site and note the gaps. More guides on software and infrastructure are collected on our software topic page.
If you are opening a new shop or moving an existing one, look at SmartSales on its product page and request pricing through the SmartSales quote form, giving your sector and product count. To review your KVKK and legal set-up with us, get in touch via our contact page or call 0850 346 41 09.