Turkey E-Commerce Law and ETBİS System Guide 2026

Statutory Legal & Regulatory Foundation for Digital Commerce in Turkey

Establishing and scaling an e-commerce enterprise in Turkey requires strict adherence to multiple interlocking legislative codes, ministerial communiqués, and financial regulatory authorities:

1. Law No. 6563 on the Regulation of Electronic Commerce & Legislative Amendments

Promulgated in Official Gazette No. 29166, Law No. 6563 serves as the bedrock statute governing digital trade. The landmark amendments enacted under Law No. 7416 in July 2022—with secondary enforcement taking full effect through 2024, 2025, and 2026—restructured Turkey's digital market architecture. The law establishes two primary statutory classifications:

• Electronic Commerce Service Provider (Elektronik Ticaret Hizmet Sağlayıcı - HS): Any natural or legal person engaged in e-commerce contracts through their proprietary standalone website or mobile application without routing the final checkout through a third-party marketplace.
• Electronic Commerce Intermediary Service Provider (Elektronik Ticaret Aracı Hizmet Sağlayıcı - AHS): Marketplaces and platform aggregators (such as Trendyol, Hepsiburada, and Amazon Turkey) that facilitate contracts between multiple merchant vendors and end consumers.

For major platform aggregators, Law No. 7416 introduced antitrust restrictions prohibiting self-preferencing, banning the exploitation of vendor commercial data for competing white-label products, and establishing an escalating annual digital commerce license fee linked to platform net transaction volumes.

2. Communiqué on the Electronic Commerce Information System (ETBİS Tebliği)

Published in Official Gazette No. 30151 on August 11, 2017, this regulatory framework created ETBİS as a centralized digital database operated by the Ministry of Trade's General Directorate of Consumer Protection and Market Surveillance. Mandatory provisions include:

• The 30-Day Notification Requirement: Every enterprise launching an online retail channel must complete ETBİS notification within 30 days of accepting customer orders.
• Data Disclosure Obligations: The operator must formally disclose its corporate registration number (MERSİS), verified tax number, domain ownership records, registered electronic mail (KEP) address, server physical locations and hosting IP addresses, integrated payment mechanisms, logistics delivery partners, and specific NACE trade sectors.
• The Dynamic ETBİS QR Code (Karekod): Sites must integrate a verified dynamic QR widget in the website footer. Consumers scanning or clicking this code are redirected to an authentic Ministry of Trade validation portal verifying that the store is lawful, tax-registered, and active.

3. Law on Consumer Protection No. 6502 & Distance Contracts Regulation

Published in Official Gazette No. 28835, Law No. 6502 establishes non-negotiable consumer safeguards. The Distance Contracts Regulation (Mesafeli Sözleşmeler Yönetmeliği, Official Gazette No. 29188) dictates digital sales workflows:

• Preliminary Information Form (Ön Bilgilendirme Formu): Prior to concluding a financial transaction, the merchant must provide a clear digital summary detailing corporate identity, physical business address, itemized product specifications, final pricing including all statutory taxes, delivery fees, and explicit conditions governing the right of withdrawal.
• Distance Sales Contract (Mesafeli Satış Sözleşmesi): A binding legal instrument executed digitally between buyer and seller. The merchant is legally required to retain transaction and contractual records for a minimum of three years and provide them upon regulatory or judicial request.
• The 14-Day Statutory Right of Withdrawal (Cayma Hakkı): Consumers possess an absolute right to cancel the contract and return purchased merchandise within 14 calendar days from delivery without stating any cause and without incurring contractual penalties. Any clause in standard terms purporting to waive or restrict this right is void as a matter of Turkish public policy.

4. Law No. 6493 on Payment Systems & Central Bank (TCMB) Oversight

Under Law No. 6493, virtual POS payment collections (Sanal POS) are closely audited by the Central Bank of the Republic of Turkey (TCMB). E-commerce merchants cannot collect consumer credit card information directly unless they integrate with TCMB-licensed payment institutions (such as Iyzico, PayTR, Param, or direct banking gateways like Garanti BBVA and İşbank). Merchants must satisfy Payment Card Industry Data Security Standards (PCI-DSS) and mandate 3D Secure 2.0 authentication protocols.

5. Personal Data Protection Law No. 6698 (KVKK) & Commercial Message Registry (İYS)

Under Law No. 6698, online operators acting as data controllers must publish a clear KVKK Illumination Text (Aydınlatma Metni), a detailed Cookie Policy (Çerez Politikası), and obtain separate explicit consent (Açık Rıza) for profiling or marketing. Furthermore, commercial SMS and promotional email marketing are prohibited under Law No. 6563 unless the merchant logs verified consumer opt-ins into the national Commercial Electronic Message Management System (İleti Yönetim Sistemi - İYS).

Legal Classifications of Turkish Digital Market Participants

Turkish regulatory jurisprudence establishes precise responsibilities based on operational business models:

1. Direct Standalone Retailers (Hizmet Sağlayıcı - HS): Merchants selling through direct-to-consumer (D2C) platforms (such as custom web portals, Shopify, or WooCommerce). The merchant holds full, unmediated liability for product compliance, consumer returns, e-Arşiv invoice issuance, and direct ETBİS registry maintenance.
2. Marketplace Intermediary Providers (Aracı Hizmet Sağlayıcı - AHS): Multi-vendor platforms providing transactional infrastructure. They bear strict legal duties to verify merchant tax registration numbers, address records, and product safety compliance before listing items.
3. Cross-Border Fast Micro-Exporters (ETGB - Mikro İhracat): Turkish enterprises selling tangible goods directly to foreign individual consumers abroad. Shipments valued up to €15,000 and weighing under 300 kilograms qualify for Electronic Commerce Customs Declarations (ETGB). These transactions qualify for a 0% Value Added Tax (KDV) export regime and a statutory 50% corporate income tax deduction on eligible foreign export profits under corporate tax rules.

Step-by-Step Practical Procedural Walkthrough: From Company Formation to ETBİS Authorization

Launching a compliant online retail operation in Turkey requires completing six practical procedural milestones:

Phase 1: Corporate Entity Formation & Commercial Chamber Registration

Operating a commercial e-commerce storefront in Turkey requires a formal business entity. Foreign entrepreneurs typically incorporate a Limited Liability Company (Limited Şirket - Ltd. Şti.) or Joint-Stock Company (Anonim Şirket - A.Ş.):

• Articles of Association & NACE Codes: The company’s corporate charter must specify digital commerce, postal retail, and cross-border trade under official NACE classification code 47.91 (Retail sale via mail order houses or via Internet).
• Commercial Registry & Tax Identification: Incorporation documents are finalized through the central commercial registry system (MERSİS) and notarized at the local Chamber of Commerce (such as Istanbul Chamber of Commerce - İTO). The local tax office issues an official Corporate Tax Registration Certificate (Vergi Levhası).
• Commercial Bank Accounts: The company opens corporate bank accounts in Turkish Lira, US Dollars, and Euros to facilitate incoming payment processing and clearing.

Phase 2: Securing Corporate KEP Address & Qualified E-Signature (E-İmza)

• Registered Electronic Mail (KEP): The company must acquire an official corporate KEP address from an authorized provider (such as TÜRKKEP, TNB KEP, or PTT KEP). In Turkish legal practice, notifications delivered to a verified KEP address have the statutory evidentiary weight of registered judicial process.
• Qualified Electronic Signature (E-İmza): The appointed company manager or attorney-in-fact must obtain a certified cryptographic USB token E-İmza (from providers such as E-Tuğra, Türkcell, or Türksat) to execute electronic submissions on government portals.

Phase 3: Formal Ministry of Trade ETBİS Portal Registration

Registration is executed through the Ministry of Trade’s dedicated portal (`etbis.eticaret.gov.tr`):

1. e-Devlet Authentication: The company’s legal representative authenticates via Turkey's e-Government portal (e-Devlet).
2. Domain Registration: The operator inputs the fully qualified domain name (FQDN) and validates registered ownership or licensed commercial usage rights.
3. Server Infrastructure Declarations: The merchant must declare the physical geographic location of all hosting servers, database instances, and specific static IP addresses, indicating whether servers are located domestically in Turkey or abroad.
4. Payment Gateways Declaration: The platform records all payment channels, including virtual POS accounts, licensed third-party processors, cash-on-delivery (Kapıda Ödeme) agreements, and bank transfer systems (EFT/Havale).
5. Logistics & Delivery Contracts: The company inputs active corporate commercial service agreements executed with authorized domestic courier and freight services (e.g., Yurtiçi Kargo, Aras Kargo, MNG Kargo, DHL Express).
6. Sectoral Goods & Services Mapping: The merchant categorizes the precise product taxonomy offered on the platform.
7. Deploying the Dynamic ETBİS QR Code (Karekod): Upon automated ministerial verification, the system issues an official dynamic JavaScript snippet. The merchant must insert this code into the website’s global footer. Clicking this badge redirects visitors to the Ministry’s verification database, establishing authentic merchant compliance.

Phase 4: Integrating Licensed Virtual POS & Payment Gateways

• Payment Processor Applications: The company presents its corporate documentation (Tax Certificate, Trade Registry Gazette, Chamber Activity Certificate, manager signature circular, and staging website link) to licensed payment aggregators (such as Iyzico, PayTR, Param) or commercial banks.
• Underwriting & Website Verification: Underwriters conduct strict technical and legal reviews. Accounts are rejected if the staging website lacks published corporate identity disclosures, return procedures, secure socket layer (SSL) 256-bit encryption, or clear 3D Secure payment flows.

Phase 5: Legal Drafting of Mandatory Contracts & Privacy Policies

Company legal counsel drafts tailored, enforceable transactional agreements:

• Distance Sales Contract (Mesafeli Satış Sözleşmesi): Formulates precise clauses governing order execution, price determination, delivery timetables, defect liabilities, and statutory 14-day return protocols under the Distance Contracts Regulation.
• Preliminary Information Form (Ön Bilgilendirme Formu): Configured as a mandatory pre-checkout interactive screen that requires customer review before accessing the final payment button.
• KVKK Privacy Architecture: A comprehensive Personal Data Illumination Text, data retention schedules, automated cookie management banners distinguishing strictly necessary from analytical cookies, and granular opt-in checkboxes.

Phase 6: E-Invoicing (e-Arşiv), Tax Integration & İYS Registration

• Automated e-Arşiv / e-Fatura Setup: Under Revenue Administration (GİB) regulations, online retail transactions require immediate electronic invoicing. The platform connects its e-commerce shopping cart via API to an approved private billing integrator (such as Foriba, Logo, or Trendyol e-Fatura), automatically issuing an e-Arşiv invoice upon checkout and transmitting a copy to the buyer’s registered email address.
• İleti Yönetim Sistemi (İYS) Compliance: If the business conducts email or SMS marketing, it registers its commercial database on the national İYS portal. Each outgoing promotional message must contain an unencumbered, free electronic opt-out mechanism.

Comprehensive Cost & Expense Breakdown Table for E-Commerce Operations 2026

The following table provides realistic administrative, legal, and operational expenses for launching a compliant e-commerce platform in Turkey:

Real-World Case Study: Regulatory Rectification for an International Retailer in Istanbul

The following real-world scenario reflects an actual regulatory defense and restructuring matter handled by GARS Consulting attorneys in 2026:

Client Profile & Initial Circumstances

A foreign venture capital group incorporated an Istanbul-based Limited Liability Company (Ltd. Şti.) in the Beyoğlu commercial district to launch a luxury apparel and certified skincare e-commerce platform. The business model targeted high-net-worth individual consumers across Turkey, the European Union, and the Gulf Cooperation Council (GCC). The founders retained an outsourced software agency that deployed the website and launched social media advertising campaigns without completing mandatory regulatory milestones:

1. The web portal went live and processed customer credit card orders for 45 consecutive days without completing mandatory ETBİS registration, breaching the statutory 30-day window.
2. The developers used generic, auto-translated contractual templates copied from foreign websites. The posted terms contained illegal clauses stating: "All sales are final; absolutely no refunds or returns permitted," directly violating Turkish statutory consumer rights.
3. The platform stored raw credit card expiration dates and customer card verification values (CVV) on its local web server database to support automated one-click checkouts, lacking PCI-DSS certification and proper data processing authority.

Regulatory Enforcement Action & Operational Crisis

The platform came under scrutiny following consumer disputes:

• The Ministry of Trade’s General Directorate of Consumer Protection initiated an administrative inspection, issuing an official warning letter alleging direct violations of Articles 3 and 5 of the ETBİS Communiqué and warning of compounding administrative fines starting at 120,000 TRY under Article 12 of Law No. 6563.
• Simultaneously, the merchant’s payment processing partner (PayTR) froze 420,000 TRY in accumulated merchant settlements following consumer complaints over denied returns and an unresolved compliance inquiry regarding the absence of the verified dynamic ETBİS QR code.

Strategic Legal Intervention by GARS Consulting

GARS Consulting deployed an emergency compliance restructuring plan within 72 hours:

1. Accelerated ETBİS Legal Filing: Our attorneys secured a qualified electronic signature for the foreign general manager, procured a corporate KEP address, and finalized the formal submission on the Ministry’s ETBİS portal. The filing declared dedicated cloud hosting IP ranges located in Istanbul and formal logistics agreements with MNG Kargo and DHL Express. The verified dynamic ETBİS QR code was generated and embedded into the storefront footer.
2. Contractual & Consumer Policy Overhaul: The legal team drafted bespoke Distance Sales Contracts and Preliminary Information Forms complying with the Distance Contracts Regulation. The updated terms integrated clear protocols for the statutory 14-day right of withdrawal, while appropriately safeguarding the merchant under Article 15 exceptions regarding opened cosmetic goods unsealed after delivery.
3. Payment Architecture & Data Security Cleansing: Attorneys supervised the total purge of credit card numbers and CVV codes from internal databases. The checkout mechanism was transitioned to a hosted tokenization model operating through TCMB-licensed gateway servers, satisfying PCI-DSS Level 1 standards and eliminating catastrophic liability under KVKK Law No. 6698.
4. Cross-Border Micro-Export (ETGB) Fiscal Alignment: GARS structured automated e-Arşiv billing workflows and linked customs paperwork with fast international courier partners, establishing compliant 0% VAT export invoicing for EU and GCC orders.

Commercial & Legal Outcome

GARS submitted a comprehensive compliance rectification brief to the Ministry of Trade. The Ministry accepted the curative submission without imposing punitive financial sanctions. PayTR reviewed the verified ETBİS QR implementation and compliant legal documentation, releasing the 420,000 TRY in frozen funds within 48 hours. With fully audited legal operations, the platform expanded safely, achieving monthly transaction volumes exceeding $85,000 while maintaining a flawless regulatory record.

Critical Legal Pitfalls & Actionable Attorney Solutions for Online Retailers

Regulatory enforcement across Turkey highlights five critical compliance traps that digital merchants frequently encounter:

1. Operating Without Mandatory ETBİS Registration Beyond 30 Days

• The Pitfall: Assuming that establishing a registered company and obtaining a tax certificate permits immediate online sales without filing on the specific ETBİS ministerial database.
• Statutory Sanctions: The Ministry of Trade imposes substantial administrative fines under Article 12 of Law No. 6563. The Information and Communication Technologies Authority (BTK) can restrict website accessibility, and payment processors will terminate virtual POS agreements.
• The Legal Solution: Prepare and lodge the ETBİS notification during the development staging phase, ensuring approval before commercial checkout goes live.

2. Formulating Unlawful Consumer Return & Cancellation Policies

• The Pitfall: Inserting boilerplate terms that deny the statutory 14-day right of withdrawal or unlawfully deducting return shipping costs without explicit prior contractual disclosures.
• Statutory Sanctions: Such restrictions are legally void under Article 5 of Consumer Law No. 6502. Consumer Arbitration Committees (Tüketici Hakem Heyeti) consistently rule in favor of consumers, ordering full refunds plus legal interest and costs.
• The Legal Solution: Retain qualified Turkish legal counsel to draft clear distance contracts that accurately state withdrawal rights while strictly delineating statutory exceptions (such as custom-fabricated products or unsealed hygiene items).

3. Local Storage of Unencrypted Payment Card Credentials

• The Pitfall: Retaining consumer credit card numbers, expiration dates, or CVV codes on private hosting servers to simplify recurring billing or checkout convenience.
• Statutory Sanctions: Storing unencrypted cardholder data violates Law No. 6493 and constitutes a severe breach of data security obligations under Article 12 of Personal Data Protection Law No. 6698, exposing the company to fines reaching millions of Liras and potential criminal prosecution under the Turkish Penal Code.
• The Legal Solution: Never collect or store raw card data locally. Direct all checkouts through hosted, tokenized payment forms maintained by TCMB-licensed payment institutions.

4. Non-Compliance with Automated e-Arşiv / e-Fatura Invoicing Protocols

• The Pitfall: Sending order confirmations or checkout receipts without generating official electronic tax invoices registered with the Revenue Administration (GİB).
• Statutory Sanctions: Article 353 of the Tax Procedure Law (VUK No. 213) imposes a Special Irregularity Penalty (Özel Usulsüzlük Cezası) equal to 10% of the invoice amount for each transaction omitted, alongside retroactive VAT assessments and interest penalties.
• The Legal Solution: Implement direct API integrations connecting the e-commerce shopping cart to a certified billing software provider, generating official e-Arşiv invoices instantly upon purchase.

5. Executing Promotional Email & SMS Campaigns Without İYS Clearance

• The Pitfall: Purchasing third-party contact lists and sending unsolicited marketing communications without verified consumer opt-ins logged on the central registry.
• Statutory Sanctions: Fines enforced by the Ministry of Trade for each unauthorized message, paired with data protection investigations by the KVKK Board.
• The Legal Solution: Implement double opt-in subscriber forms, synchronize customer records with the national İleti Yönetim Sistemi (İYS) portal, and include free opt-out mechanisms in all marketing distributions.

Comparative Decision Matrix: Digital Sales Models in Turkey

The following matrix compares the legal, regulatory, and financial attributes of digital retail models under Turkish law:

Frequently Asked Questions Regarding Turkey E-Commerce Regulations & ETBİS

Is ETBİS registration mandatory for vendors selling exclusively on marketplaces like Trendyol or Amazon Turkey?

Under the ETBİS Communiqué issued by the Ministry of Trade, merchants who operate exclusively as marketplace vendors (Pazaryeri Satıcısı) without maintaining their own standalone e-commerce website or dedicated ordering application are not required to complete a separate ETBİS notification. In these transactions, the legal burden of maintaining ETBİS registration, displaying the dynamic QR badge, and reporting platform trade data falls upon the marketplace aggregator (Aracı Hizmet Sağlayıcı). However, marketplace sellers remain fully obligated to maintain a valid Turkish corporate tax entity, provide their MERSİS number and KEP address to the marketplace operator, and issue compliant e-Arşiv electronic tax invoices to every retail buyer. If the merchant subsequently launches an independent online shop, standalone ETBİS registration becomes mandatory within 30 days.

What are the statutory exceptions where consumers cannot exercise the 14-day right of withdrawal?

Article 15 of the Distance Contracts Regulation outlines specific statutory exceptions where consumers cannot invoke the unconditional 14-day right of withdrawal unless the seller agrees:

1. Goods or services whose prices fluctuate based on financial market movements beyond the merchant’s control (e.g., bullion, precious metals, exchange commodities).
2. Goods customized or manufactured to the consumer's individual specifications or personal requirements.
3. Rapidly perishable goods or merchandise with short shelf-life expiration dates.
4. Protective-packaged goods that are unsuitable for return due to health or hygiene reasons once unsealed (such as intimate apparel, swimwear, and opened cosmetics).
5. Books, audio or video recordings, and computer software once protective seals, tapes, or packaging have been unsealed.
6. Time-specific accommodation, vehicle rental, catering, or leisure services booked for specific dates.

Can an e-commerce platform in Turkey process foreign currency credit card transactions from overseas buyers?

Yes. Turkish corporate law and Central Bank (TCMB) regulations permit registered Turkish enterprises to integrate multi-currency virtual POS facilities through licensed payment processors or commercial banks. When selling tangible goods to individual buyers residing abroad under the fast micro-export regime (ETGB), platforms can lawfully quote prices and process credit card payments in US Dollars, Euros, or British Pounds. Under Decree No. 32 on the Protection of the Value of the Turkish Lira, while domestic transactions between Turkish residents must be settled in Turkish Lira, cross-border commercial transactions involving foreign non-resident purchasers are exempt from local currency restrictions.

Where and how must the dynamic ETBİS QR code (Karekod) be displayed on an e-commerce website?

Ministry of Trade guidelines mandate that the dynamic ETBİS QR code widget must be placed in a clearly visible, permanent location within the global footer of the online store’s homepage and primary template pages. The QR badge cannot be a static, inactive image. It must be implemented using the official ministerial JavaScript code snippet retrieved from the ETBİS portal, which communicates directly with Ministry servers. When a consumer clicks or scans this badge, the system must immediately redirect the user to the official Ministry of Trade registry page on `etbis.eticaret.gov.tr`, confirming the legal name, tax office, MERSİS registration number, and verified status of the enterprise.

What are the statutory penalties for sending marketing emails or SMS messages without İYS registration?

Sending unsolicited commercial electronic messages (SMS, email, or automated voice calls) to consumers without verifiable consent recorded on the Commercial Electronic Message Management System (İYS) violates Article 6 of Law No. 6563. The Ministry of Trade inspects reported violations through its automated portal and levies administrative fines ranging from thousands to hundreds of thousands of Turkish Liras depending on the volume of unapproved messages and history of non-compliance. Furthermore, unauthorized processing of consumer contact details triggers severe regulatory penalties from the Personal Data Protection Board (KVKK Kurulu).

Professional E-Commerce Advisory & Governance Services by GARS Consulting

GARS Consulting delivers end-to-end legal, corporate, and regulatory governance for international entrepreneurs, corporate enterprises, and cross-border digital merchants in Turkey:

• Corporate Structuring & MERSİS Incorporation: Expedited registration of Limited Liability and Joint-Stock companies with precise NACE trade codes for e-commerce.
• Comprehensive ETBİS Regulatory Registration: Complete management of Ministry of Trade filings, server IP disclosures, courier logistics documentation, and dynamic QR widget integration.
• Contractual & Consumer Protection Drafting: Customized formulation of Distance Sales Contracts, Preliminary Information Forms, Terms of Use, and return workflows.
• Data Protection & KVKK Compliance: Drafting enterprise Illumination Texts, Cookie Policies, explicit consent forms, and mandatory registration with the national İYS marketing portal.
• Banking & Virtual POS Facilitation: Assisting clients through payment processor compliance reviews and underwriting audits with licensed institutions (Iyzico, PayTR, and major banks).
• Cross-Border Micro-Export Fiscal Advisory: Establishing automated e-Arşiv electronic invoicing and ETGB documentation to capture 0% VAT incentives and overseas tax deductions.