Principle Decision on SMS Verification Codes and Commercial Electronic Messages

The Personal Data Protection Board’s (“Board”) Principle Decision dated 10 June 2025 and numbered 2025/1072 (“Decision”) regarding the practice of processing personal data through the transmission of verification codes via SMS during the provision of products and services, was published in the Official Gazette dated 26 June 2025 and numbered 32938. The Decision highlights detailed obligations for data controllers, particularly in relation to the information obligation, explicit consent, and the separation of processing activities.

You may access our brief information note on the Decision here.