Is bulk WhatsApp messaging legal? The short answer for Turkey is this: bulk commercial WhatsApp messages are only legal when the recipient has given prior explicit consent (opt-in) and that consent is registered in İYS, the national Message Management System. Sending unsolicited promotional, campaign or marketing messages violates both Law No. 6563 on Commercial Electronic Communications and the KVKK (Turkish data protection law), and it triggers administrative fines. In other words, while "sending bulk messages" is technically possible, doing so without consent is clearly unlawful in Turkey.

This guide explains exactly when bulk WhatsApp messaging is legal, why İYS registration is mandatory, what the penalty for unsolicited messages looks like, and how the official WhatsApp Business API differs from grey-area blast tools.

The decisive question in Turkey is whether a message counts as a "commercial electronic communication." If the message contains advertising, promotions, campaigns, discount announcements or product marketing, it is a commercial message and consent is required. Notifications that are a natural part of delivering a service are treated differently.

There are broadly two categories:

  • Messages requiring consent: Discounts, campaigns, new product launches, cart reminders, win-back flows and newsletters. These all require the recipient's prior explicit consent.
  • Messages not requiring consent: Transactional notifications such as order confirmations, shipping tracking codes, appointment reminders, invoice notices, and replies to a support conversation the customer started.

For example, an e-commerce business may send a WhatsApp message with a shipping code for an order the customer placed, without separate consent. But to message that same customer "30% off everything this weekend," it needs a valid, İYS-registered consent on file.

Why İYS Registration Is Mandatory

İYS is Turkey's centralized national platform where consents for commercial electronic communications are recorded. Permissions for SMS, email and calls are stored there, and WhatsApp falls under the same obligation when used for commercial marketing. Keeping consents aligned with İYS is critical because, in the event of a complaint or audit, the business must be able to prove permission.

The burden of proof always sits with the sender. Saying "the customer agreed earlier" is not enough; the date, source and scope of the consent must be documented. Recipients can exercise their right to opt out at any time, and that opt-out request must be processed within three business days at the latest.

What Are the Penalties for Unsolicited WhatsApp Messages?

Two separate bodies of law apply at the same time, and the penalties can be imposed independently:

  • Under commercial communication law: Sending unsolicited commercial electronic messages under Law No. 6563 is subject to administrative fines that start in the thousands of lira and can be multiplied several-fold when the sending is done in bulk. The amounts are revalued each year.
  • Under KVKK: A phone number is personal data. Processing numbers for marketing without explicit consent or another lawful basis, or breaching data security obligations, can trigger a separate and substantial administrative fine under KVKK.

In practice, complaints often begin with the recipient asking where you obtained their number. Explanations like "we got it from a list, an event, or a supplier" offer no real defense if you cannot show a valid chain of consent.

Official WhatsApp Business API vs Grey-Area Tools

The market is full of tools promising "WhatsApp to thousands in one click" using your personal number or unauthorized automation software. These violate WhatsApp's terms of service and create real risk: permanent number bans, messages flagged as spam, and legal exposure.

The official WhatsApp Business API, by contrast, is a controlled channel approved by Meta, with template approval, quality ratings and rate limits. Its advantages include:

  1. Message templates are pre-approved by Meta, providing content oversight.
  2. The official infrastructure minimizes spam risk and the chance of your number being banned.
  3. Opt-in and opt-out management, consent records and İYS alignment can be handled systematically.
  4. A verified badge and professional presence increase customer trust.

Using the official API is not in itself a guarantee of legality; if the content is marketing, you still need valid consent and İYS registration. But the official API is the safest foundation for building a compliant process.

A practical checklist for a compliant WhatsApp process:

  1. Use a clear, separate opt-in for marketing messages; don't bundle it with order or signup confirmation.
  2. Record collected consents in İYS along with their source and date.
  3. Offer an easy opt-out in every commercial message and process opt-out requests quickly.
  4. Keep transactional notifications (shipping, appointments, orders) separate from marketing content.
  5. Use the official WhatsApp Business API instead of a personal number or unauthorized blast tools.
  6. Clearly mention WhatsApp communication in your privacy notice and policy.

This approach doesn't only protect you from fines; messages sent to a permission-based audience consistently see far higher open and conversion rates than unsolicited blasts. Compliance is also a better customer experience.

Conclusion

Bulk WhatsApp messaging is legal only when consent has been obtained in advance, recorded in İYS, and delivered through the official WhatsApp Business API. Unsolicited bulk sending carries serious penalty risk under both commercial communication law and KVKK. The right path is permission-based messaging, transparent opt-out, and official infrastructure.

Yanıtly brings consent management, customer conversations and AI-assisted replies into a single panel through its KVKK-compliant infrastructure and official WhatsApp Business API integration. Instead of mass marketing, building a model that instantly answers customer-initiated conversations in natural Turkish keeps you compliant and drives higher satisfaction. You can build compliant WhatsApp communication with Yanıtly.

Frequently asked questions

Is it legal to send unsolicited bulk WhatsApp messages in Turkey?

No. Bulk WhatsApp messages containing advertising, campaigns or promotions cannot be sent without the recipient's prior explicit consent (opt-in). Unsolicited sending violates both Law No. 6563 on commercial electronic communications and the KVKK, and leads to administrative fines. Transactional notices such as order confirmations or shipping info do not require consent.

Is İYS registration required for bulk WhatsApp messaging?

Yes. Marketing-oriented WhatsApp messages count as commercial electronic communications, so the consents you collect must be recorded in İYS, Turkey's national Message Management System. The burden of proof sits with the sender, so you must be able to show the date, source and scope of consent if a complaint arises.

What is the penalty for sending unsolicited WhatsApp messages?

Two penalties can apply at once. Under Law No. 6563, unsolicited commercial messages are subject to administrative fines that can multiply for bulk sending. Separately, because a phone number is personal data, processing it without consent can trigger a substantial KVKK fine. Amounts are revalued and updated each year.

Does using the official WhatsApp Business API make bulk messaging legal?

Not on its own. The official API reduces technical and operational risk through template approval and number safety. But if the message is marketing, you still need valid explicit consent and İYS registration. The official API is a safe foundation for a compliant process; it does not remove the consent obligation.

Do I need consent to send order and shipping updates?

No. Transactional messages such as order confirmations, shipping tracking codes, appointment reminders and invoice notices are a natural result of the service and do not require commercial message consent. However, if you add marketing elements like discounts or campaigns to these messages, they become commercial communications and consent becomes mandatory.

Content source: Yanitly guide library

Published: 2026-06-06 · Content updated: 2026-06-06