Glossary · Sales and customers
What is İYS, and which business messages need consent?
İYS (the Message Management System) is an official Turkish registry where businesses record the consent they obtain for promotional electronic messages, and where recipients give or withdraw that consent. Whether consent is needed depends on the type of message, whatever the channel: a campaign announcement needs it, a delivery or payment notice does not.
Last updated: · Author: Şevket Erer, Co-founder, AI Specialist
Why does the İYS record matter?
Under the Regulation on Commercial Communication and Commercial Electronic Messages, anyone who wants to send commercial electronic messages registers with İYS, and promotional messages may not go to recipients without consent recorded there (Regulation Article 5(2) and 5(3)). Consent can also be collected outside İYS, for example with a form, but it becomes invalid unless it is entered into İYS within three working days (Regulation Article 7(11) and 7(12)).
The record also protects the sender. For consent collected outside İYS, the burden of proving it lies with the business, and consent records are kept for three years after the consent ends (Regulation Article 7(10) and 13(2)). When a complaint arrives, the same record shows when and through which channel consent was given.
How do you tell whether a message needs consent?
The decision comes down to four questions: the type of message, whether the recipient is a merchant, whether consent is recorded in İYS, and whether the message offers a way to opt out. A message that promotes needs consent; a pure notice does not. The steps follow that order, with the legal basis next to each.
- Look at the type
Does the message promote a product, a campaign or the business, or does it report an ongoing transaction? Promotional and greeting messages need prior consent (Regulation Article 5(1)).
- Look at the recipient
If the recipient is a merchant or tradesperson, prior consent is optional; the address is still registered with İYS and checked for an opt-out (Regulation Article 6(3) and 6(6)).
- Check İYS
For a promotional message, the recipient's consent must be on record in İYS; without it, the message is not sent.
- Add a way to opt out
Every commercial message carries a free way to opt out, and the opt-out works through the channel the message came from (Regulation Article 9(3) and 9(4)).
An example
A furniture showroom wants to announce a weekend discount by SMS to customers it has quoted. The sales lead first splits the list: customers awaiting delivery can get shipping updates without consent, while the discount goes only to recipients whose consent is recorded in İYS. Customers without consent get no discount message, and no campaign is tacked onto the end of a delivery message.
Which message types need prior consent?
The table sums up the Regulation's consent rule by message type. The Regulation defines a commercial electronic message as one sent by means such as telephone, text message and email (Article 4(1)(o)); WhatsApp is not named, and the list is illustrative. So the same consent question applies to the same type of message on every channel.
| Message type | Example | Prior consent | İYS check | Legal basis |
|---|---|---|---|---|
| Promotion, campaign, greetings | New product news, a discount, holiday greetings | Required | Consent must be in İYS | Regulation Article 5(1) and 5(3) |
| Changes, use or maintenance of goods or services already bought | Service reminder for a device the customer bought | Not required, if the recipient gave their contact details | None | Law No. 6563 Article 6(1); Regulation Article 6(1) and 6(5) |
| Order, delivery or subscription notice | An order has shipped, a membership has renewed | Not required; the notice may not promote anything | None | Regulation Article 6(2) and 6(5) |
| Payment and debt reminders | A reminder that an invoice is due | Not required; no campaign may be added | None | Regulation Article 6(2) and 6(5) |
| Promotion to merchants or tradespeople | A new price list sent to a dealer | Optional; nothing may be sent once the recipient has opted out | Address registered in İYS and checked for opt-out | Law No. 6563 Article 6(2); Regulation Article 6(3) and 6(6) |
| Quote follow-up | Asking about a quote already sent | Not listed separately; if the follow-up promotes a new product or discount, the promotion rule applies | If it promotes, consent must be in İYS | Regulation Article 5(1) and 6(2) |
Source: Law No. 6563, Article 6 (mevzuat.gov.tr), Regulation, Articles 5 and 6 (mevzuat.gov.tr)
What must a commercial message show on each channel?
The consent rule is the same on every channel, while what the message must show varies by channel. The Regulation sets out, channel by channel, how the sender identifies itself, where the label showing the nature of the message goes, and how to opt out (Articles 8 and 9). In a text message a merchant's MERSİS number is enough and the trade name is not required (Article 8(3)); in a voice call the label showing the nature of the message is stated at the start of the conversation (Article 8(6)).
| Channel | Sender identity | Label showing the nature | Opt-out |
|---|---|---|---|
| Text message (SMS) | For merchants, the MERSİS number; for tradespeople, name and identity or tax number (Article 8(3)) | At the start, if the nature is not clear from the content (Article 8(6)) | Through the same channel, easy and free (Article 9(3)) |
| For merchants, the MERSİS number and trade name; for tradespeople, name and identity or tax number (Article 8(2)) | In the subject line (Article 8(6)) | Through the same channel, easy and free (Article 9(3)) | |
| Voice call | For merchants, the trade name; for tradespeople, name and surname (Article 8(4)) | At the start of the call (Article 8(6)) | Through the same channel, easy and free (Article 9(3)) |
| WhatsApp and similar messaging | Not named in the text; the identity rule for the header or content applies to every commercial message (Article 8(2)) | No specific place is set (Article 8(6) names only text, email and voice) | Through the same channel, easy and free (Article 9(3)) |
Under the İYS rules, what does software carry and what stays with you?
The table reads each duty in three columns: what the Law or the Regulation asks, what Corex360 offers for that task, and what the business itself has to do. The second column lists only Corex360's confirmed functions; where there is no counterpart, it says so. Consent records are kept in İYS, and that record is the business's responsibility.
| What the law asks | What Corex360 has | What stays with you |
|---|---|---|
| Consent and an İYS record before a promotional message (Law Article 6(1); Regulation Article 5(1) to (3)) | No counterpart; Corex360 is not described as a tool for bulk promotional messages or campaigns. | Obtaining consent, registering it in İYS, and checking it before sending. |
| No consent needed for use, maintenance, and order notices, and no promotion inside them (Regulation Article 6(1) to (2)) | The WhatsApp Business line connects through Meta's official cloud API; the conversation is kept on the customer card, not on a salesperson's phone. | Telling notices apart from promotions and not adding campaigns to notices. |
| Stopping messages within three working days of an opt-out (Law Article 8(3); Regulation Article 10(1)) | No counterpart; the opt-out record is kept in İYS. | Recording the opt-out in your own lists and stopping messages in time. |
| Keeping consent and message records (Regulation Article 13(2)) | Correspondence with the customer stays on the customer card. | Keeping consent and message records for the period set in the Regulation. |
Source: Law No. 6563, Articles 6 and 8 (mevzuat.gov.tr), Regulation, Articles 5, 6, 10 and 13 (mevzuat.gov.tr)
Which misconceptions about İYS come up most often?
Commercial messaging rules are often picked up from vendor articles or hearsay, so the same misconceptions keep coming back. Each item below gives the common belief first, then what the Law or the Regulation actually says, with a link to the official text. The articles were checked against the current text on mevzuat.gov.tr.
Myth: Once the privacy notice under KVKK, Turkey's data protection law, has been read, promotional messages may be sent.
Fact: A privacy notice explains why data is processed; it is not consent. A promotional message needs separate consent containing the recipient's positive statement, and that consent is recorded in İYS (Regulation Article 7(1) and 7(12)). Regulation, Article 7
Myth: If KVKK explicit consent was obtained, no İYS consent is needed.
Fact: KVKK explicit consent concerns processing personal data; consent to commercial messages is a separate rule. Consent collected outside İYS becomes invalid unless it is recorded in İYS within three working days (Regulation Article 7(11) and 7(12)). Regulation, Article 7
Myth: Any promotional message to a business is always allowed.
Fact: Prior consent is optional for promotions to merchants and tradespeople, but their address is registered with İYS and nothing may be sent once they have opted out (Regulation Article 6(3) and 6(6)). Regulation, Article 6
Myth: An opt-out takes effect from the next campaign.
Fact: Sending stops within three working days of the opt-out reaching the business (Law No. 6563 Article 8(3); Regulation Article 10(1)). Law No. 6563, Article 8
The business regulation timeline shows, with official sources, when this rule came into force and where it sits among other business rules.
What has the KVKK Board decided on promotional calls?
İYS consent is a commercial messaging rule; where a dialled number came from is a KVKK question. The two rules work separately: using a number collected for one job for another purpose is assessed under the KVKK principle that processing must be linked, limited and proportionate to its purpose (KVKK Article 4). The card retells, in our own words, the decision summary published on kvkk.gov.tr; the decision number and date come from the summary page.
A number given for a subscription, called for another company
· 2020/34
- Case
- A call centre used a phone number saved during magazine subscription work to call the person years later with a food company's advertising.
- What the Board concluded
- The Board found the data had been used for a purpose other than the one it was collected for, and that a number which should have been deleted was not properly deleted; it fined the data controller.
- What it means for the team
- A number collected for one job is not moved onto another campaign list. A record whose purpose has ended is deleted, and the deletion is checked.
This page is general information, not legal advice; the regulations were last checked on 28 September 2026. Official text: Law on the Regulation of Electronic Commerce (mevzuat.gov.tr), Regulation on Commercial Communication and Commercial Electronic Messages (mevzuat.gov.tr)
How it looks in Corex360
The Corex360 Messaging window gathers WhatsApp, Instagram and web chat in one inbox. The WhatsApp Business line connects to Corex360 as a channel through Meta's official cloud API. There is a NetGSM integration for the phone system and SMS. Bulk campaign sending is not promised; which message goes through which channel is settled in the demo.
Messaging module→Quote tracking→What WhatsApp Business API is→
Terms often confused with it
| Marketing automation | Marketing automation is software that sends messages by rules; whether a message may reach a recipient depends on the İYS record. |
|---|---|
| Privacy notice | A privacy notice tells people why their data is processed; consenting to promotional messages is the recipient's separate, positive statement. |
| KVKK | KVKK governs processing personal data; İYS records consent to promotional messages. An explicit consent form does not stand in for the İYS record. |
Related terms: Marketing automation, KVKK
FAQ
Do you need consent to send a campaign message on WhatsApp?
The consent rule follows the type of message. The Regulation defines a commercial electronic message as one sent by means such as telephone, text and email; WhatsApp is not named, and the list is illustrative. For a message with a campaign in it, checking for the recipient's consent in İYS is the safe course. This page is not legal advice.
Does a quote follow-up need İYS consent?
The Regulation does not list quote follow-ups separately. A follow-up that only asks about a quote already sent is close to a notice; if it adds a new product, discount or campaign, it counts as promotion and needs consent (Regulation Article 5(1) and 6(2)). Where the text leaves room for doubt, ask your legal adviser.
How long does İYS consent last, and how long are records kept?
Consent stays valid until the recipient opts out (Regulation Article 5(1)). Consent records are kept for three years after the consent ends and are handed to the Ministry on request (Regulation Article 13(2)).
Was this page useful?