Profiling is the automated processing of personal data to evaluate certain aspects of a natural person, such as interests, behavior, preferences or location. Article 4(4) of the GDPR defines the concept in these terms. Turkey's KVKK contains no separate definition of profiling, but every operation carried out through profiling counts as personal data processing and falls under the law's general regime.
Article 4(4) of the GDPR defines profiling as any form of automated processing of personal data in which the data is used to evaluate certain personal aspects of a natural person, in particular to analyze or predict aspects such as work performance, economic situation, health, personal preferences, interests, reliability, behavior, location or movements. Article 22 goes one step further: a person has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significant effects on them. Turkey's KVKK does not define profiling as a separate concept, but this is not a gap: profiling is by definition personal data processing and is subject to all of the law's requirements, from legal basis and transparency to data security and data subject rights.
On the web, the most common form of profiling is the cookie-based advertising profile: marketing cookies combine a visitor's browsing behavior across sites into an interest profile, and ads are targeted accordingly. For this chain to start lawfully, explicit consent must be obtained before marketing cookies are set; tools that build profiles must not load until consent arrives. Privacy notices and cookie policies should state clearly that profiling takes place.
Frequently asked questions
Is explicit consent required for profiling?
For cookie-based ad profiling the practical answer is yes: the profile is built through marketing cookies, and writing those cookies to the device requires prior explicit consent; profiling tools must not run before consent arrives. Consent may not be the only legal basis for every kind of profiling, but whichever basis is relied on, transparency obligations and the data subject's rights must be honored.
Does Turkey's KVKK regulate profiling?
The KVKK contains no separate profiling definition like Article 4(4) of the GDPR and no provision like Article 22 granting a right not to be subject to automated decisions; however, Article 11 of the KVKK grants the right to object to a result that arises against the person through the analysis of their data exclusively by automated systems. That does not mean profiling is unregulated: profiling is personal data processing and is subject to the KVKK's entire regime. A legal basis must exist, individuals must be informed, data security must be ensured and data subject rights must remain exercisable.
This content is for information only and is not legal advice.