Loyalty card misuse and privacy risk: Turkish Data Protection Board extends verification deadline

A loyalty card can unlock discounts—but it can also unlock someone else’s purchase history. The Personal Data Protection Board’s ("Board") latest decisions give businesses more time to fix that risk, without softening the compliance message.

On 13 August 2026, the Board published its Decision No. 2026/1491 dated 22 July 2026 in the Official Gazette, extending the compliance period under Principal Decision No. 2026/266 dated 11 February 2026 concerning loyalty card programmes. The original deadline of 28 August 2026 has been postponed by six months, giving businesses until 28 February 2027 to implement the required measures.

Principal Decision No. 2026/266, published in Official Gazette No. 33182 on 28 February 2026, was a direct response to a recurring loyalty-programme practice. It requires data controllers—notably retailers and e-commerce businesses—to ensure that transactions conducted through a loyalty card number or mobile phone number are carried out with the knowledge and consent of the relevant customer.

The Board received complaints and notifications through multiple channels that third parties were providing someone else’s phone number or loyalty card number to the cashier at checkout—without the cardholder’s knowledge or consent—to earn points, obtain discounts or promotions, or otherwise benefit from the programme.

Following its review, the Board found that the practice was widespread across food, cosmetics, technology, DIY and home-improvement, clothing and other retail sectors.

In some cases, invoices and receipts were issued in the cardholder’s name for purchases the cardholder had never made, while purchase history—including the product, date and store—was recorded against the wrong person’s account.

The Board specifically found that this practice can involve processing without a legal basis under Article 5 of Law No. 6698, breach the Article 4 principle that personal data must be accurate and up to date when necessary, and indicate a failure to meet the data security obligation under Article 12.

Importantly, even where membership terms place responsibility on cardholders not to share their cards with third parties, the Board made clear that this does not relieve data controllers of their own obligation to maintain data security under Article 12.

The Board identified a range of possible safeguards, including SMS one-time verification codes, scanning at the till of a barcode or QR code generated through the data controller’s website or mobile application, presentation of the physical loyalty card, entry of a loyalty card password and comparable methods capable of demonstrating that the loyalty transaction has been authorised by the data subject.

For online membership accounts where only a phone number is provided at checkout, the Board also identified an opt-in model: customers may be offered a choice of which specific actions—earning points, using a discount or promotion, or spending points—they authorise through the phone number alone.

Decision No. 2026/1491 does not expand the underlying measures. Instead, the six-month extension is a pragmatic concession to operational reality, giving businesses additional time to complete the technical and organisational work. The Board’s core message remains firm: verification is expected, and the new deadline is 28 February 2027.

What This Means for Businesses

Many loyalty programmes allow customers to accumulate or redeem benefits simply by providing a telephone number or membership identifier at the point of sale. The Board’s concern is not merely who receives a benefit: when a third party supplies another person’s details at checkout, the loyalty activity can attach the wrong transaction to the wrong customer.

The six-month extension is a welcome and pragmatic concession for retailers and loyalty-programme operators that have not yet completed the necessary system developments. It should be treated as implementation runway—not a pause. Businesses should use the additional time to test controls, complete integrations and prepare evidence of compliance before 28 February 2027.

Businesses operating loyalty or membership programmes should continue preparing for the verification mechanisms required by the Board. A sensible roadmap is to:

• map how loyalty transactions are initiated and authenticated across in-store and online channels, and distinguish membership verification, point/discount/promotion earning and point spending;
• implement one-time passwords, mobile approval or equivalent verification tools and calibrate them to risk, using different methods for different transaction types and, where appropriate, offering alternative mechanisms for different customer groups;
• for online membership accounts that permit checkout using only a phone number, offer a clear opt-in choice specifying which transaction types the customer authorises through that number alone;
• update privacy notices, customer-facing documentation and membership terms to explain the verification process, while recognising that contractual prohibitions on card sharing do not replace Article 12 controls;
• maintain records demonstrating that appropriate verification measures have been implemented before the revised deadline and can be evidenced to the Board.

From Deadline to Action

Although the Board has extended the compliance period, the decision signals that loyalty-programme practices remain an enforcement priority. The Board consulted sector representatives before issuing Principal Decision No. 2026/266, and both decisions were adopted unanimously. Businesses that fail to implement the required measures may face action under Article 18 of Law No. 6698, including administrative fines. Because the Principal Decision is a binding decision of general application, its issuance underscores that this is not a one-off enforcement action but a systematic regulatory expectation.

Handled proactively, compliance can become more than a regulatory burden: a clear, privacy-respecting loyalty experience can strengthen customer confidence and turn verification into a trust advantage.

For further information regarding the implementation of loyalty card verification mechanisms, data protection compliance assessments or the implications of the Board's decisions for your business, please contact your CMS partner or local CMS expert: Dr. Döne Yalçın and Erdinç Dalar