İYS in Turkey: Consent Rules for Marketing SMS, Email and Calls
İYS is Turkey's central register for marketing consent. Who needs to register, how to collect consent on your website, how opt-outs work and what the 2026 fines are, based on the law and the regulation.
İYS (İleti Yönetim Sistemi, the Message Management System) is Turkey's national register of consent for marketing SMS, email and calls. Businesses sending commercial messages have to register with it, and no marketing message may go to anyone whose consent is not recorded in İYS. This is general information, not legal advice.
This guide is written for foreign-owned businesses and expats running companies in Turkey.
Why this matters if you are used to GDPR
If you have run email marketing in the EU or the UK, the idea of opt-in consent will be familiar. Turkey adds one thing most foreign marketers do not expect: a central registry. A consent record in your own CRM or email tool is not enough. It has to be in İYS, and the recipient can see it there and withdraw it at any time. SMS providers in Turkey check İYS before sending and will not start a send to numbers without a recorded consent.
The legal basis
The rules come from three texts (all in Turkish):
- Law No. 6563 on the Regulation of Electronic Commerce (Official Gazette 05.11.2014, No. 29166). Consent is in Article 6, the right to opt out in Article 8, the central consent system in Article 11(5) and fines in Article 12.
- Regulation on Commercial Communication and Commercial Electronic Messages (Official Gazette 15.07.2015, No. 29417).
- The 2020 amendment (Official Gazette 04.01.2020, No. 30998), which brought İYS into the regulation and set today's rules.
According to the Ministry of Trade, the system was set up under a protocol signed with TOBB (the Union of Chambers and Commodity Exchanges of Turkey) on 18 May 2018. It is operated through iys.org.tr.
What counts as a commercial electronic message
Article 2 of the law covers messages sent for commercial purposes by phone, call centre, fax, automated dialler, email or SMS. In practice that means promotional SMS, newsletters, sales emails, sales calls and campaign messages on messaging apps.
Messages about changes to, use of, or maintenance of goods or services the customer has already obtained do not need separate consent (Article 6). Order confirmations, delivery updates and appointment reminders fall here, as long as you keep promotions out of them.
Who has to register
Under Article 5 of the regulation, every individual or legal entity that wants to send commercial electronic messages registers with İYS. Business size does not matter.
| Recipient | Prior consent needed? | What happens in İYS | Basis |
|---|---|---|---|
| Consumer | Yes | Consent must be recorded in İYS before sending | Law 6(1), Regulation 5 |
| Merchant or tradesperson (B2B) | No | Address is recorded in İYS first; opt-out status is checked in İYS | Law 6(2), Regulation 6(6) |
| Existing customer, message about use, maintenance or changes to what they bought | No | No İYS check | Law 6(1), Regulation 6(5) |
A note for foreign companies. Registration is built around Turkish identifiers: a MERSİS number (Turkey's central trade registry) for companies, or a Turkish ID or tax number for sole traders. If you trade through a Turkish company or branch, that entity registers. If you have no Turkish entity but plan SMS or email campaigns to recipients in Turkey, check with İYS directly before you start; we could not find an official answer on how such companies register.
Collecting consent on your website
Article 7 of the regulation sets three rules for consent collected outside İYS, for example through your website:
- You carry the burden of proof that consent was given (7/10).
- Upload within three working days. Consents collected outside İYS must be recorded in İYS within three working days (7/11).
- Unrecorded consent is invalid (7/12).
For your forms this means:
- [ ] A separate marketing consent box, not bundled with terms or privacy consent
- [ ] The box is unticked by default
- [ ] Consent is asked per channel: SMS, email, phone
- [ ] The wording says who will send messages and about what
- [ ] Date, time, form name, consent text version and contact address are stored for every consent
- [ ] Records reach İYS within three working days
- [ ] Customers can manage their consents from their account page
Marketing consent is not the same as explicit consent for personal data under KVKK (Law No. 6698, Turkey's data protection law). We cover the privacy side in our data protection compliance article.
Opt-outs
Under Article 8 of the law, recipients can opt out at any time without giving a reason. You must offer an easy, free way to opt out in every message, stop sending within three working days of the request, and report opt-outs you receive to İYS within three working days (Regulation 9/6). Recipients can also opt out directly in İYS. The Ministry of Trade's FAQ adds that the opt-out must work through the same channel: an SMS campaign needs an SMS opt-out.
What each message must contain
According to the same Ministry FAQ:
- Identification: for companies, the MERSİS number and trade name; in short formats such as SMS, the MERSİS number is enough
- Contact details: at least one of phone, SMS number or email
- A label such as "campaign" or "promotion" if the nature of the message is not obvious: at the start of an SMS, in the email subject line, or at the start of a call
- Promotion terms, reachable through a link or a number
- Opt-out information in every message
Fines in 2026
Fines are set by Article 12 of Law No. 6563 and rise each year with the revaluation rate. The 2026 amounts were set by a Ministry of Trade communiqué (Official Gazette 25.12.2025, No. 33118) and appear in a table at the end of the law's text on mevzuat.gov.tr:
| Breach | Article | 2026 amount |
|---|---|---|
| Sending commercial messages without consent | 12(1)(a) | TRY 2,859 - 14,309 |
| Sending to several recipients at once without consent | 12(2) | The above, multiplied up to ten times |
| Missing identification, contact or subject information | 12(1)(b) | TRY 2,859 - 28,620 |
| No opt-out route, or not applying an opt-out within three working days | 12(1)(c) | TRY 5,723 - 42,930 |
Complaints are filed through the Ministry's online complaint system, which is connected to e-Devlet (Turkey's government services portal).
Common mistakes we see with foreign-run businesses
- Importing a mailing list collected abroad and sending to Turkish numbers without İYS records
- Relying on the email platform's double opt-in log as the only proof
- Handling unsubscribes only inside the email tool and never reporting them to İYS
- Adding discount codes to order and delivery messages
- Sending SMS without the MERSİS number or an opt-out route
What your website needs
Registration with İYS, and the İYS integration itself, are done by you or your messaging provider. The website's job is to collect consent properly and keep the record: separate, unticked, per-channel boxes, stored consent records with the text version, a preferences page, and an export that can be uploaded to İYS. We build these forms and records as part of our e-commerce website service; the legal wording and the İYS registration remain your responsibility.
For the other registrations you need to sell online in Turkey, see our guide to starting an e-commerce business in Turkey.
Checklist
- [ ] Your Turkish entity is registered with İYS
- [ ] Website forms have separate, unticked, per-channel consent boxes
- [ ] Consent records are stored with the text version
- [ ] Consents collected outside İYS are uploaded within three working days
- [ ] Your SMS and call providers check İYS before sending
- [ ] Email lists are matched against İYS opt-outs regularly
- [ ] Every message carries identification, contact details and an opt-out route
- [ ] Opt-outs are applied and reported to İYS within three working days
Summary
İYS comes down to one rule: if the consent is not in İYS, do not send. The work is in collecting consent properly on your website, keeping a record and moving it to İYS on time. To plan your consent forms and records, use our quote wizard or get in touch.
Frequently asked questions
What is İYS?
İYS (İleti Yönetim Sistemi, the Message Management System) is Turkey's national register of consent for commercial electronic messages. Recipients can see and withdraw the consents recorded there. It is based on Article 11 of Law No. 6563 and the Regulation on Commercial Communication and Commercial Electronic Messages.
Does İYS apply to email as well as SMS?
Yes. Commercial electronic messages include SMS, email, phone calls, call centre calls, fax and automated calls sent for commercial purposes. The consent rules apply to all of them.
Is a consent tick box on my website enough?
Only if you upload that consent to İYS within three working days. Under the regulation, consents not recorded in İYS are invalid, and you carry the burden of proving that consent was given.
Do order and delivery messages need consent?
The law does not require separate consent for messages about changes to, use of, or maintenance of goods or services the customer has obtained. Pure order and delivery updates fall into this group; adding a promotion to them can turn them into marketing.
Can I email Turkish businesses without consent?
The law allows commercial messages to merchants and tradespeople without prior consent. Under the regulation, you still have to record their addresses in İYS first and check through İYS whether they have opted out.
Is this article legal advice?
No, it is general information. Fine amounts change every year; check the current text on mevzuat.gov.tr and have a lawyer review your consent wording.
