A legal initial assessment for your e-commerce operation.

A privacy policy is the showcase of GDPR Art. 13 and the KVKK information regime. A text copied from a template commits you to operations you don't carry out — which is riskier than having none.

If you sell to two markets, build the text in two languages and to two sets of legislation — a single English template does not satisfy either.

Tracking before consent is one of the most frequently complained-about breaches in the EU; in Germany it is a subject of warnings (Abmahnung) and can be detected externally by technical means.

The "Reject" option must be as visible as "Accept" and a single click — a hidden reject button is also a violation.

The duty to inform (KVKK Art. 10) is required at every point where data is collected; a single link at the bottom of the site is often not considered sufficient.

Good practice: a two-sentence short notice below the form + a link to the full text (layered notice).

VERBİS (the Data Controllers' Registry) registration is mandatory for data controllers that meet the threshold criteria; the register is public and failure to register carries an administrative fine.

Registration is not a one-off: as your inventory changes, the VERBİS notification must be updated too.

Every site using Google Analytics, Meta, Mailchimp or an overseas server transfers data. The KVKK Art. 9 regime, amended in 2024, requires a standard contract to be signed and notified to the Authority within 5 business days.

The SCC on the GDPR side and the KVKK standard contract can be set up in a single package — two separate projects are not needed for the two regimes.

For sellers not established in the EU, a GDPR Art. 27 representative is mandatory in most scenarios; its absence is apparent at a glance from your privacy policy.

The representative does not assume liability; it is a point of contact for authorities and data subjects.

Since 1 January 2026 the return shipping cost belongs to the seller as a rule; mediation information has been added to the pre-contractual disclosure, and electronic devices have returned to the scope of withdrawal. Old text displays clauses that are unenforceable on every return.

Showing your contracted carrier in the pre-contractual disclosure is the key to the return-cost arrangement.

In both Türkiye and the EU, the 14-day withdrawal right must be presented together with its sample form. In the EU, missing disclosure extends the withdrawal period to up to 12 months — every order turns into an open return risk.

Withdrawal exceptions (such as made-to-order production) only work if they are correctly defined on a per-category basis.

A commercial electronic message depends on the recipient's prior consent, and consents are managed through İYS (the Message Management System). Every send without consent is exposed to a per-message administrative fine.

Before sending to your old lists, run an İYS reconciliation; the assumption "they're our customers anyway" does not substitute for consent.

Both the EU (Omnibus) and Türkiye require the lowest price of the last 30 days to be shown in discounts. Fake discounts are subject to fines that can be scaled to turnover in the EU and to Advertising Board sanctions in Türkiye.

Keep a price-history record when planning campaigns — the burden of proof is on you.

When selling to Germany, provider identification (§5 DDG) is mandatory and its absence is the number-one warning subject — a single missing page means a costly Abmahnung.

The Impressum must be in German and reachable from every page in at most two clicks.

Since 28 June 2025, web stores selling to EU consumers are subject to an accessibility obligation (BFSG in Germany, fines of up to €100,000). Because breaches can be detected even with automated tools, they are the subject of a new wave of warnings.

The micro-enterprise exemption (fewer than 10 employees AND ≤€2M turnover) is narrow and falls away by itself as you grow.

Since December 2024, for products sold from outside the EU the name, address and email of an EU-established responsible person are mandatory both on the product and in the online listing; marketplaces are removing non-compliant listings.

The GPSR responsible person, the PPWR authorised representative and the GDPR representative can be combined into a single structure.

For anyone shipping packaged goods to Germany, LUCID registration + a license is mandatory (fines of up to €200,000); registration is non-transferable and the register is public — marketplaces are obliged to verify it.

In August 2026, PPWR adds an authorised-representative layer for non-EU sellers — when you close this gap, also make the 2026 plan.

The EU ODR platform was shut down on 20 July 2025 and the regulation was repealed. Sites still linking to it carry a risk of misleading disclosure — and announce that their texts are unmaintained.

When you remove the link, update your ADR/consumer arbitration committee disclosure at the same time.

Without IOSS, on shipments up to €150 the customer pays VAT + a courier collection fee at the door — the number-one cause of returns and bad reviews. For sales from a warehouse within the EU, the €10,000 threshold and OSS apply.

Sellers from Türkiye register for IOSS through an EU-established intermediary; in marketplace sales the platform often assumes the VAT.

Service providers selling through their own website must register with ETBİS (the E-Commerce Information System); the registration can be verified publicly and is among the first items asked about in an audit.

Selling on a marketplace as well does not remove the ETBİS obligation for your own site.

Between 2024 and 2026, GPSR, accessibility, the ODR shutdown, the KVKK transfer regime and the distance selling amendments came one after another. A set of texts that was compliant last year may be deficient today.

An annual text-maintenance round is the cheapest insurance against warning and penalty risk.