TL;DR: Turkish data protection law (KVKK) isn't GDPR — the required disclosures, the retention-period language, and the regulator are all different — but almost every off-the-shelf cookie consent widget is written for GDPR and just translated into Turkish, which isn't the same as being compliant with KVKK. Cerezmatik is a small, self-hosted consent banner that's actually built around the Turkish requirements. Here's what's different.

What GDPR widgets get wrong for a Turkish site

The usual pattern — a banner with "Accept All / Reject All / Manage Preferences" and a cookie category list — is a GDPR pattern. KVKK has its own structure: sites need an "Aydınlatma Metni" (a specific disclosure text about the data controller, purpose of processing, and legal basis) that's a distinct legal document from a generic privacy policy, and the consent mechanism needs to reference it specifically, not a generically translated "privacy policy" link.

Most libraries I evaluated either hardcoded GDPR-style category names (translated but structurally GDPR) or expected you to write your own text in a config field with no guidance on what KVKK actually requires that text to say. Neither is wrong for a company operating under GDPR, but both leave a Turkish site with a banner that looks compliant without doing the specific thing KVKK asks for.

The core design decision

Cerezmatik treats the "Aydınlatma Metni" as a first-class, versioned document rather than a static link:

interface DisclosureVersion { id: string; content: string; publishedAt: Date; dataController: string; processingPurposes: string[]; legalBasis: string; // KVKK madde 5/6 reference }

Every time a visitor gives consent, the record stores which disclosure version they consented to, not just a boolean "consented: true". If the site updates its data processing purposes six months later, existing consents don't silently cover the new purposes — the banner re-prompts, because the version they agreed to no longer matches the current one.

That versioning is the single feature that took the tool from "a banner" to "something that could actually hold up if the Personal Data Protection Authority (KVKK Kurumu) asked how consent was collected."

What it looks like on a site 

<script src="https://cdn.cerezmatik.app/embed.js" data-site-id="xxx"></script>

One script tag, no cookie set until the visitor makes a choice, and the banner blocks non-essential scripts (analytics, ad pixels) from firing until consent is given — which is itself a KVKK requirement that a lot of "consent" banners get wrong by loading every tracker before the visitor has clicked anything.

The honest trade-off

I'm not a lawyer, and Cerezmatik doesn't make anyone KVKK-compliant by itself — that's a legal determination that depends on what a specific site actually does with data, not just how its banner looks. What it does is remove the most common structural mismatch I kept seeing: sites that copied a GDPR banner pattern and assumed "translated" meant "compliant."

If your product serves any Turkish users and collects analytics or ad-tracking cookies, it's worth checking whether your current banner references an actual Aydınlatma Metni or just a generic privacy policy — that gap is easy to miss and common enough that I built a whole tool around closing it.

Cerezmatik is free to try — link's in my profile.