Board Decision on Loyalty Card Use by Third Parties

The Personal Data Protection Board’s (“Board”) Decision on the Use of a Loyalty Card Holder’s Mobile Phone Number or Loyalty Card Number by Third Parties During Shopping dated 11 February 2026 and numbered 2026/266 (“Decision”) was published in the Official Gazette on 28 February 2026.

Following complaints and notifications received by the Personal Data Protection Authority regarding the widespread practice of using a loyalty card holder’s mobile phone number or loyalty card number by third parties at checkout without the data subject’s knowledge, consent, or any verification mechanism the Board assessed that such practices may lead to unlawful data processing activities and personal data breaches. The Board emphasized that loyalty cards are generally provided for the personal use of the data subject within the framework of a membership agreement and that transactions carried out without proper verification may not be based on any lawful data processing condition under the Personal Data Protection Law No. 6698 (“DP Law”).

Under its Decision, the Board resolved that practices allowing loyalty card transactions to be carried out solely by verbally providing a mobile phone number or loyalty card number, without any verification, must be terminated. Accordingly, data controllers are required to implement appropriate technical and administrative measures to ensure that the use of loyalty cards during shopping such as earning or spending points or benefiting from discounts and promotions takes place with the data subject’s knowledge and consent. The Board also granted data controllers a six-month compliance period as of the publication date of the Decision. It was further indicated that failure to comply may result in administrative sanctions under Article 18 of the DP Law.

You may access the announcement here.