Security
Compliance with the Personal Data Protection Law (KVKK) is not a feature, but a requirement
Placing a checkbox does not ensure compliance. What ensures compliance is the retention of proof of that consent.
A box on the screen that says “I agree” means nothing on its own. The question posed during an audit is this:
Who, when, and which version of which text did they agree to?
If there is no answer to this question, the checkbox is merely decorative. Worse yet, its presence on a screen titled “KVKK” gives a false sense of security.
The correct setup consists of three parts
- The gateway is on the server. The `
required` attribute in the browser is not a gateway; an unapproved request can be sent directly to the endpoint. - The text is copied. The text at the moment consent is given is recorded. A setup that monitors the setting will also alter the history when the text changes—thereby destroying the evidence.
- The version is marked. When the text changes, previous consents must be distinguishable as “old versions.”
Cookie Banner
A single-button (“OK”) cookie banner does not constitute consent. The “Reject” option must be equally prominent as the “Accept” option—a faint “Reject” link yields the same result as no option at all.