Any commercial message sent in Turkey falls under Law No. 6563 on the Regulation of Electronic Commerce. That covers a newsletter, a cart-abandonment SMS, and a flash-sale email alike. The rule is simple: get consent before you send, and keep proof of it. The İleti Yönetim Sistemi (IYS) holds that proof in one national database, with a timestamp on each record.
Volume is what raises the stakes for online sellers. A small store might send a few hundred messages a month. A growing e-commerce brand sends thousands of messages. It often uses several tools at once: email, SMS, and marketplace messaging.
Every one of those channels needs to check the same consent record, or the business ends up guessing who it can legally contact.
This guide covers what IYS requires from e-commerce businesses. It shows how to register, connect your systems, and avoid the mistakes online sellers make most often.
What IYS Means for E-commerce Businesses, and Why the Stakes Are Higher
The system's scope
IYS A.Ş. runs the İleti Yönetim Sistemi, Turkey's consent database set up by the Ministry of Trade. under the Union of Chambers and Commodity Exchanges of Turkey (TOBB). Any business sending commercial electronic messages in Turkey manages its permissions there, not in a private tool.
IYS tracks three channels on their own: SMS, email, and voice calls. A customer can log in, see each brand they approved, and pull consent for one channel without touching the others. Each record carries a date and time, so a dispute has one clear answer instead of two conflicting databases.
Why e-commerce carries more exposure
Fines for messaging without valid consent are charged per recipient, not per campaign. A small business risks a fine sized to a few hundred contacts. An online store with a 50,000-name mailing list risks a fine sized to 50,000. The math changes the moment your list grows past what a spreadsheet can safely track.
There is an upside behind the risk. People who opted in open and click your messages far more often than a purchased list ever will. A clean, IYS-verified list is not just the safe choice. It is usually the more profitable one too.
The Legal Backbone: Law No. 6563 and IYS Obligations
Law No. 6563 took effect in 2015. It set one rule: get consent first, then send a commercial electronic message. A 2017 update moved that approval process into one central system, which became IYS. The full law is available at mevzuat.gov.tr, and the platform itself sits at Visit iys.org.tr for official IYS information..
Three duties matter most for an online store:
- Consent comes first. You need approval before any promotional message goes out, including welcome emails, discount codes, and restock alerts. You can collect it at checkout, through a signup form, or with an SMS code, but you carry the burden of proving it.
- Opt-out must be easy. Every commercial message needs a simple way to say no. You must handle a refusal within three business days, and IYS spreads filed refusals to every registered sender automatically.
- Fines scale with your list. Sending without registering, or sending to unverified contacts, brings a fine set per recipient. Repeat violations raise the amount. Check current figures against the Ministry of Trade's published notices, since they change over time.
For an e-commerce business, one bulk send to an unverified list is not a single violation. It is one violation multiplied by each name on that list. A 20,000-contact campaign sent without valid consent turns a routine newsletter into a serious financial risk. Check consent before the send, not after a complaint arrives.
Registering for IYS: Panel, API, or Both?
Every service provider registers through e-Devlet. Before you start, confirm that your MERSİS record is current and that your authorized signer holds a valid e-signature.
- Apply through e-Devlet. Search for "İleti Yönetim Sistemi Başvuru" to reach the Ministry of Trade's dedicated service.
- Submit your company and brand details. Give your registered company title, MERSİS number, and each brand name you send commercial messages under. You will also estimate how many approved contacts you hold per channel.
- Sign the usage agreement. Download and e-sign the Basic Services Usage Agreement.
- Upload your papers. Submit your trademark papers along with the signed agreement.
After approval, you manage consent from your company account at iys.org.tr. Or you can work with an authorized IYS integrator that handles the setup for you.
The core IYS service is free for up to 5,000 approved contact addresses. Most growing e-commerce stores cross that line within a year or two. Once you do, paid packages or integrator support take over, so plan for that cost before your list outgrows the free tier.
Past that threshold, a second issue shows up fast: nobody can update thousands of consent records by hand each day. This is where API integration stops being optional. Connecting your storefront and CRM to IYS through an API keeps each opt-in and opt-out in sync without manual work.
Panel vs. API: Which Fits Your Store
| Approach | Best suited to | Effort | Sync behavior |
|---|---|---|---|
| Web panel | Small catalogs, occasional campaigns, under 5,000 contacts | Low setup, manual upkeep | Checked and updated by hand |
| CSV bulk upload | Migrating an existing list once | Medium setup, repeated for each batch | Uploaded in batches |
| API integration | Active storefronts with daily signups, cart events, or high-volume sends | Higher setup, near-zero upkeep | Automatic, close to real time |
Most e-commerce stores outgrow the panel within their first year of real marketing volume. Plan for an API link to your storefront and CRM early, rather than adding it after a compliance scare.
Where E-commerce Consent Gets Complicated
Marketplace sellers vs. direct-to-consumer stores
If you sell only through your own website, consent capture is simple. A checkbox at checkout or a newsletter signup form feeds straight into IYS. If you also sell through a marketplace, the picture changes.
The marketplace often owns the customer relationship and runs its own messaging system. Its consent records do not carry over to your IYS account. Treat each sales channel as its own source of consent. Only message a marketplace customer directly once you have checked consent for your own brand too.
Cart-abandonment, win-back, and post-purchase campaigns
These messages feel routine because a real customer action triggers them. They are still commercial messages under Turkish law. A cart-abandonment email or a "come back, here's 10% off" SMS needs the same registered consent as a seasonal sale blast.
The one exception is a strictly transactional message: an order confirmation, a shipping update, or a delivery notice. The moment you add a discount code or a repurchase nudge, that message becomes marketing, and IYS rules apply.
Why High-Volume Sellers Can't Run on the Panel Alone
Once your store sends daily promotional emails or SMS, checking consent by hand before each send stops being realistic. High-volume sellers typically hit three walls:
- Keeping a fast-growing subscriber list synced with IYS.
- Filtering campaigns by channel before each send.
- Clearing opt-outs inside the three-business-day window when a flash sale spikes volume.
An API and webhook link solves all three at once. New signups from your checkout or popup register in IYS on their own. Opt-outs filed anywhere, including through IYS itself, sync back to your marketing platform without a manual export. Your campaign tool only ever sees the customers who are actually clear to message.
Common Compliance Mistakes in E-commerce Marketing
- Assuming a platform checkbox is enough. A checkout opt-in on your website is a good first step, but the consent still needs to reach IYS. A checkbox that only feeds your own database is not a legal record.
- Mixing transactional and marketing sends. Adding a discount code to an order confirmation email makes it a commercial message that needs consent.
- Messaging the wrong channel. Each channel keeps its own consent. A customer who approved email has not approved SMS. Filter your send list by channel every time.
- Once, when you built the list, is not enough.
- Slow opt-out handling during peak sales. Black Friday and similar spikes are exactly when opt-out volume rises and staff attention drops. Automate the process so it does not rest on someone checking a form by hand.
- Ignoring marketplace consent gaps. Consent collected on a marketplace does not cover your own-brand campaigns on its own. Check it separately before you message that customer directly.
Treat each opt-out as a signal about list quality, not a lost sale. A customer who leaves through a clean, one-click process still remembers your brand fairly. One who has to ask twice remembers a brand that ignored them.
How Makdos Supports E-commerce IYS Compliance
Most e-commerce teams understand IYS in principle. The hard part is running it right each day, at the volume a real store generates. Makdos closes that gap. It is an IYS integrator authorized by the Ministry of Trade
Onboarding starts at registration. Makdos guides you through e-Devlet and business-partner steps, then links your account to ours with IYS's Business Partner Code. From there, your team works inside a dedicated IYS management panel that tracks consent by channel and by campaign.
For active stores, the real value sits in the connection itself. Your storefront and CRM sync with IYS through an API and webhook link. New checkout opt-ins register on their own, and opt-outs filed through IYS flow straight back into your marketing tools. Nobody has to remember a manual update during a sale.
The same protection reaches your outbound systems. With business mail hosting, bulk campaign sends run through systems that check consent before delivery. An unverified contact never receives a message in the first place.
Consent records are personal data too, so firewall and security services guard the systems that store them. That keeps your IYS and KVKK duties aligned, instead of running as two separate projects.
Support does not stop at setup. IYS issues sit right on the channel that drives revenue. A stalled API call or a confusing panel screen during a campaign window has a real cost.
Makdos gives ongoing technical support for integration questions, panel use, and changes on the IYS side. Your marketing calendar should not wait on a compliance fix.
Conclusion: Make Compliance Part of Your Growth Engine
IYS puts each commercial message you send in Turkey on a legal footing. For an e-commerce business, high volume makes getting it right more urgent, not less.
- IYS keeps consent for SMS, email, and voice calls in one national database. Law No. 6563 makes registration mandatory.
- Regulators set fines per recipient, so an unverified list turns a routine campaign into serious financial risk.
- Consent from a marketplace and consent from your store do not replace each other. Check each one on its own.
- Promotional, win-back, and cart-abandonment messages need registered consent even if a real customer action triggers them.
- Past a few thousand contacts, an API and webhook link replaces manual panel work and keeps your lists accurate in real time.
What should you do next? If you have not registered with IYS, start the application and move your existing checkout and newsletter opt-ins over now. Say you registered but still manage consent by hand.
Before your next big sale, ask one thing: can your team meet the three-business-day window? That is usually where the gap shows up first.
Review the Makdos IYS Integration Service if you want us to handle the integration for you. Makdos IYS Integration Service and connect your store today.
