AI outbound calling campaigns: the legal framework in Türkiye (İYS, Law 6563, KVKK)

Handing an outbound calling campaign to an AI agent is no longer technically hard; the hard part is getting the legal regime for those calls right in Türkiye. Two bodies of law operate together: Law No. 6563 and the İYS regime, which decide whether a call is a commercial "message", and the KVKK (Turkish data protection law), which governs the processing of the called person's number and voice. This article draws the lines from the texts in force in 2026 and from Board decisions.

Is it legal to run an outbound calling campaign with AI?

Short answer: yes, but a marketing call counts as a "commercial electronic message" and falls under the consent regime. Law No. 6563 on the Regulation of Electronic Commerce defines a commercial electronic message as "data, voice and image content messages sent for commercial purposes in the electronic environment using means such as telephone, call centres, fax, automatic dialling machines, smart voice recording systems, e-mail and short message service" [1]. A promotional call made by AI sits squarely inside that definition: it is both automatic dialling and a voice message. Article 6 of the Law then states that such messages may be sent to recipients "only on condition that their prior consent has been obtained" [1].

How consent is obtained and managed is set out in the Regulation on Commercial Communication and Commercial Electronic Messages (Official Gazette 15.07.2015, No. 29417) [2]. With the Message Management System (İYS) provisions added in 2020, the rule became clear: a business wishing to send messages registers with İYS, and "commercial electronic messages may not be sent to recipients who have no consent on İYS" [2]. The period allowed for transferring existing consents to İYS ended on 31 December 2020 for service providers holding more than 150,000 consents and on 31 May 2021 for the others [3]; consents not recorded on İYS are deemed invalid [2]. The Ministry of Trade states that the system covers SMS, e-mail and voice calls, so İYS covers telephone calls, not just messaging channels [3]. Whether a human or a piece of software places the call does not change this regime; what matters is the call's commercial purpose.

Can a customer be called without İYS consent?

For some calls, yes. Article 6 of the Regulation lists four cases in which no prior consent is required: the first, second and fourth are information messages based on an existing relationship; the third is a separate exemption that rests on the recipient's status as a merchant or tradesperson and also allows promotional messages [2]:

• Messages about changes, use and maintenance of goods or services already supplied, where the recipient gave their contact details for that purpose [2]
• Collection, debt reminder, information update, purchase and delivery notifications in an ongoing subscription, membership or partnership relationship; no goods or services may be promoted in them [2]
• Messages sent to recipients who are merchants or tradespeople; the Law allows sending to this group without consent, but sending stops once the right to refuse has been exercised [1][2]
• Information messages that capital-market intermediary firms send to their clients [2]

A practical distinction follows: appointment confirmations, order or delivery information and reminders of a due payment need no consent as long as they contain no promotion; the moment "by the way, have you heard about our new package?" enters the same call, the consent requirement returns [2]. The Regulation states that no İYS check is made for messages in the first, second and fourth cases, whereas merchant and tradesperson addresses are registered on İYS and checked for refusals before sending [2]. An appointment reminder call and a callback that an existing customer requested, to the number they themselves provided and on the matter they asked about, also fall into this class as long as they stay within information about the service supplied and contain no promotion [2]; for details see avaritcall.com/tr/blog/randevu-hatirlatma-aramasi-no-show-arastirmalar and avaritcall.com/tr/blog/emlak-ofisi-icin-yapay-zeka-telefon-asistani.

Three details of the consent mechanics are often missed. First, consent cannot be requested by sending a message to the recipient's number [4]. Second, consents collected outside İYS must be recorded on İYS within three business days; "consents not recorded on İYS are deemed invalid" [2]. Third, a recipient may refuse "without giving any reason"; once the refusal arrives, sending must stop within three business days [2].

The KVKK side: number, voice and the duty to inform

İYS consent does not automatically satisfy KVKK obligations; the two regimes run side by side. Law No. 6698 defines personal data as "any information relating to an identified or identifiable natural person"; both the telephone number and the voice spoken on the call fall within it [5]. Under Article 5, personal data may not be processed without explicit consent; the exceptions include processing directly related to the conclusion or performance of a contract and the controller's legitimate interest [5]. An information call to an existing customer can rest on the contractual relationship; for a cold marketing call that basis is hard to establish. In Principle Decision 2018/119 the Board declared that advertising SMS, e-mails and calls made without explicit consent or another processing condition must stop, and that administrative fines would otherwise follow [6].

The duty to inform (Article 10) is independent of consent: the controller's identity, the purpose of processing, transfers, the legal basis and the data subject's rights must be communicated when the data are obtained [5]. In a cold call the data are obtained for the first time, so the notice has to be given within the call; when the purpose changes, the Communiqué requires the notice to be given again [7]; for an existing customer who has already been informed, a short reminder is good practice. The Communiqué says this may be done "through physical or electronic media such as verbal, written, voice recording or call centre"; the burden of proof lies with the controller, and informing and explicit consent must be fulfilled "separately" [7]. The Board reinforced that last point in Principle Decision 2026/347 of 18.02.2026: the privacy notice and the explicit consent text may not be nested or presented under a single declaration [8]. For an AI agent this means designing the opening line: who is calling and why; consent is then a separate question.

Caller identification is in the rules: the Regulation requires the trade name for merchants and the full name for tradespeople to be stated in voice-call content [2]. Saying from the outset that the call is made by an AI assistant is not regulated as a separate legal obligation in Türkiye; Article 50 of the EU AI Act does require it [9]. We recommend it as good practice in every case. The EU rule asks systems that interact directly with natural persons to give this notice at the first interaction, unless it is obvious, and applies from 2 August 2026 [9].

Fine amounts and the burden of proof

The amounts in Article 12 of Law No. 6563 rise every year by the revaluation rate. With the communiqué published in Official Gazette No. 33118 of 25.12.2025, the 2026 amounts were increased by 25.49%; for breaches of the basic obligations, consent included, the range is TRY 2,859–14,309 [10]. The Law states that where a message in breach of Article 6 is sent "to more than one person at once" the fine may be increased up to tenfold [1]; the risk that campaign-style bulk calling is assessed under this provision should be factored into planning. Complaints are filed within three months of the message date via e-Government or İYS (the TİSS complaint system) or in writing to the provincial directorate [2][4]; "in matters subject to complaint, the burden of proof lies with the service provider", and consent records must be kept for three years after their validity ends [2]. KVKK fines are a separate item: in Decision 2018/119 the Board relies solely on Law No. 6698 (suspension under Article 15/7, administrative fines under Article 18) [6]; the Article 12 fine under Law No. 6563 is a separate sanction [1].

It is not who makes the call but why the call is made that determines the legal regime.

How do you verify the consent and refusal check in a campaign tool?

The law does not ask "which software"; it asks "who checked the consent, who gave the privacy notice, where was the refusal recorded, where is the record". So what has to be verified in a campaign tool is not a software feature but the process the business has set up: splitting the call list by consent status, recording a refusal and never calling that person again, keeping the evidence, and the business itself writing the privacy notice into the agent's script. General KVKK principles (data minimisation, retention, data-subject rights) have their own article: avaritcall.com/tr/blog/kvkk-uyumlu-sesli-ai. The outbound-specific checks are as follows:

• Split the list in three: natural persons with consent for the call channel on İYS; information calls that need no consent (confirmations, debt reminders, deliveries to existing customers) [2]; merchants and tradespeople registered on İYS who have not refused [1][2]. Use a separate script for each segment; a promotional line may appear only in the first and third.
• Pull the current consent and refusal status from İYS immediately before the campaign; refusals processed within three business days can make yesterday's list invalid today [2].
• Write the opening script to the rules: trade name [2], the fact that the call is made by an AI assistant, the purpose of the call and a short privacy notice (identity, purpose, legal basis, rights) [7]; if explicit consent is needed, obtain it with a separate, clear question [8].
• Build the refusal path into the call: when someone says "I don't want to be called", the agent must record it, the number must be removed from subsequent call lists, and the business must report it to İYS within three business days [2].
• Keep evidence: the source and date of consent, refusal records and the call transcript for three years [2]. If voice recordings are kept, that must be covered in the notice separately; keeping none is simpler from a data-minimisation standpoint.

On AvaritCall this flow starts before the call list is uploaded to the panel, with the business separating its own consent and refusal lists. No audio is recorded, only a text transcript is stored; the platform operates in compliance with the KVKK and GDPR. Because the business writes the identification, privacy-notice and refusal lines in the agent script, control of the legal wording stays with the business; the platform does not replace consent, it makes applying the consented list easier.

What this article does not cover

In some situations AI outbound calling is not the right tool. A "let's try once" call to a consumer list without consent is a breach of Article 6 whatever the technology, and exposed to the bulk multiplier [1]. In scenarios where special categories of data such as health may come up in conversation (for example treatment reminders), the regime tightens; Article 6 of Law No. 6698 subjects such data to stricter conditions [5]. The merchant/tradesperson exemption is not unlimited either: Law No. 6563 removes the consent requirement, but if the number belongs to a natural person (a sole trader or small tradesperson) the processing condition under Article 5 of the KVKK must still be shown [5]. The İYS query is independent of the platform: the consent and refusal check is performed in the business's own İYS account. On the product side: recognition accuracy drops in very noisy environments, hesitant conversations or ones that turn into legal questions should be handed to a human, and the AI is not designed to produce final legal or financial decisions.

In summary: AI outbound calling is legal in Türkiye, but once a call carries a marketing purpose İYS consent is indispensable, and the KVKK privacy notice is, whatever the type of call; in both regimes the burden of proof sits with the caller [2][7]. Splitting the list, writing the opening script to the rules and keeping records for three years closes most of the risk. This article is not legal advice; legislation and amounts may change, and the sources were accessed on 30.08.2026.