One legal framework from cart to customs in cross-border e-commerce.

The privacy policy is the showcase of GDPR Art. 13 and the KVKK information-notice regime. A text copied from a template commits you to processing you do not carry out — riskier than having none at all.

If you sell into two markets, build the text in two languages and according to two bodies of legislation — a single English template does not satisfy either.

Tracking before consent is among the most frequently reported violations in the EU; in Germany it is a subject of warning notices (Abmahnung), and it can be detected externally by technical means.

The "Reject" option must be as visible as "Accept" and a single click — a hidden reject button is also a violation.

The obligation to inform (KVKK Art. 10) is required at every point where data is collected; a link only at the very bottom of the site is often not considered sufficient.

Good practice: a two-sentence short notice below the form + a link to the full text (layered notice).

Registration with VERBİS (the Data Controllers' Registry) is mandatory for data controllers that meet the threshold criteria; the registry is public and non-registration is tied to an administrative fine.

Registration is not a one-time event: as the inventory changes, the VERBİS notification must also be updated.

Every site using Google Analytics, Meta, Mailchimp or a foreign server transfers data. The KVKK Art. 9 regime, amended in 2024, requires signing the standard contract and notifying the Authority within 5 business days.

The SCC on the GDPR side and the KVKK standard contract can be set up in a single package — two separate projects are not needed for the two regimes.

A GDPR Art. 27 representative is mandatory in most scenarios for sellers not established in the EU; its absence is apparent at a glance from your privacy policy.

The representative does not assume liability; it is a point of contact for authorities and data subjects.

Since 1 January 2026, the return-shipping cost lies, as a rule, with the seller; mediation information was added to the pre-contractual disclosure and electronic devices returned to the scope of withdrawal. The old text displays clauses that cannot be applied on any return.

Showing your contracted carrier in the pre-contractual disclosure is the key to the return-cost arrangement.

In both TR and the EU, the 14-day withdrawal must be provided together with its model form. In the EU, incomplete disclosure extends the withdrawal period to up to 12 months — every order turns into an open return risk.

Withdrawal exceptions (such as custom-made production) only work if they are correctly defined on a category basis.

A commercial electronic message is subject to the recipient's prior approval, and approvals are managed through İYS (the Message Management System). Every send without approval is open to an administrative fine per message.

Before sending to your old lists, run an İYS reconciliation; the assumption "they're our customer anyway" is no substitute for approval.

Both the EU (Omnibus) and Türkiye require displaying the lowest price of the last 30 days in discount baskets. A fake discount is subject to penalties that can be proportioned to turnover in the EU and to Advertising Board sanctions in Türkiye.

Keep a price-history record when planning campaigns — the burden of proof is on you.

In sales to Germany, provider identification (§5 DDG) is mandatory and its absence is the number-one warning-notice subject — a single missing page means a costly Abmahnung.

The Impressum must be in German and reachable from every page in at most two clicks.

Since 28 June 2025, web stores selling to EU consumers are under an accessibility obligation (in Germany, the BFSG, penalties of up to €100,000). Because violations can be detected even with automated tools, they are the subject of a new wave of warning notices.

The micro-enterprise exception (fewer than 10 employees AND ≤€2M turnover) is narrow and falls away on its own as you grow.

Since December 2024, the name, address, and email of an EU-established responsible person are mandatory both on the product and in the online listing for products sold from outside the EU; marketplaces remove incomplete listings.

The GPSR responsible person, PPWR authorised representative, and GDPR representative can be combined in a single structure.

LUCID registration + a licence is mandatory for anyone shipping packaged products to Germany (penalties of up to €200,000); the registration is non-transferable and the registry is public — marketplaces are obliged to verify it.

In August 2026 the PPWR adds an authorised-representative layer for non-EU sellers — when closing off the registration, make the 2026 plan too.

The EU ODR platform was shut down on 20 July 2025 and the regulation was repealed. Sites still linking to it carry a risk of misleading disclosure — and announce that their texts are unmaintained.

When removing the link, update your ADR/consumer arbitration committee disclosure along with it.

Without IOSS, on shipments up to €150 the customer pays VAT + a courier collection fee at the door — the number-one cause of returns and bad reviews. In sales from a warehouse within the EU, the €10,000 threshold and OSS apply.

Sellers from Türkiye register for IOSS through an EU-established intermediary; in marketplace sales, the platform most often assumes the VAT.

Registration with ETBİS (the E-Commerce Information System) is mandatory for service providers selling through their own site; the registration can be verified publicly and is among the first items asked about in an inspection.

Selling on a marketplace too does not remove the ETBİS obligation for your own site.

Between 2024 and 2026, the GPSR, accessibility, the ODR closure, the KVKK transfer regime, and the distance-selling amendments came one after another. A set of texts that was compliant last year may be deficient today.

An annual text-maintenance round is the cheapest insurance against warning-notice and penalty risk.