Guide to Processing Location Data in Mobile Applications: Requirements under the KVKK and Board Decisions

An application displaying the nearest vehicle on a map and continuously tracking a user’s location in the background are not assessed in the same manner. Location data alone can reveal a detailed map of an individual’s daily movements, while poorly designed permission screens and unseen third-party software components may turn an ordinary application feature into a serious risk under the KVKK. Let us examine how mobile application providers can establish a lawful process, what rights users have and how the Personal Data Protection Board approaches this matter.

Is Location Data Special Categories of Personal Data? Scope and Risks under the KVKK

Information generated through a smartphone’s or tablet’s GPS, Wi-Fi and Bluetooth features may reveal the user’s current location, route or entry into a particular area. When associated with an identified or identifiable individual, such information constitutes personal data within the meaning of Personal Data Protection Law No. 6698 (KVKK). The temporary use of location data on a device, its transmission to a server, storage as location history, sharing with a third party or inclusion in an advertising profile each constitutes a separate personal data processing activity.

Location information is not among the special categories of personal data listed in Article 6 of the KVKK. Nevertheless, a regular record of location history may reveal an individual’s home and workplace, visits to healthcare institutions and places of worship, participation in political events or trade union activities or other details of their private life. Therefore, the risk assessment should consider not only the legal classification of the data but also the inferences that may be drawn from location records.

The Personal Data Protection Authority’s document entitled Recommendations on the Protection of Privacy in Mobile Applications (Recommendations) states that location information may reveal users’ activity patterns and habits and, together with other data, may enable detailed profiles of users to be created. This approach clearly demonstrates that obtaining location permission does not mean that every use is permissible.

Legal Grounds for Processing Location Data in Mobile Applications

For each purpose of processing location data, one of the conditions set out in Article 5 of the KVKK must be identified. The legal ground should be assessed separately for each feature, purpose and data flow, rather than collectively for the application as a whole.

Real-Time Location Tracking for the Performance of a Contract

If a service expressly requested by the user cannot be provided without location data, the processing may be considered directly related to and necessary for the establishment or performance of a contract. Examples may include generating a route in a navigation application, directing a vehicle to a user in a ride-hailing application, or delivering an item to the specified location. Even then, only the degree of precision and duration necessary for the service should be used; a need for real-time location does not automatically justify all-day background tracking.

The Personal Data Protection Board’s Decision No. 2020/65 demonstrates that the ground of performance of a contract cannot be interpreted broadly. The Board did not consider passenger ratings in a transportation service to constitute an essential element of the contract or to be directly related to its performance. Applying the same reasoning to location data, a distinction should be made between real-time location needed to complete a journey and location history subsequently used for advertising, behavioural analysis or detailed profiling.

Limits on Processing Location Data Based on Legitimate Interests

The data controller’s legitimate interests may be relevant for purposes such as preventing fraud, ensuring service security or planning capacity. However, reliance on this ground requires the processing of location data to be necessary for the legitimate interest and not to prejudice the fundamental rights and freedoms of the data subject. If the same purpose can be achieved with less intrusive data, it becomes more difficult to justify continuous or precise location tracking on the basis of legitimate interests.

In such cases, the necessity of the method for the stated purpose should be demonstrated, the data subject’s reasonable expectations should be assessed and a balance should be struck between the data controller’s interests and the user’s fundamental rights. If approximate location, aggregated statistics or processing solely on the device is sufficient, a broader method of data collection should not be preferred.

Explicit Consent Requirement for Location Data in Marketing and Profiling

Where none of the other processing conditions under the KVKK applies, valid explicit consent must be obtained to process location data. Explicit consent becomes particularly important in many cases where location data is used for targeted advertising, nearby-store promotions, marketing analytics or cross-application profiling that is not required for the application’s core functionality.

Explicit consent must be specific, informed and freely given. Users should be able to make a choice without pressure arising from the potential loss of the core service and should remain able to use features unrelated to location when they decline location access. Withdrawing consent should be as clear and accessible as giving it.

Does Operating System Location Permission Constitute Explicit Consent?

The operating system’s ‘Allow While Using App’ or ‘Always Allow’ prompt controls the application’s technical access to the device’s location source. This choice alone does not fulfil all obligations under the KVKK. If users have not been informed of the data controller’s identity, the processing purpose, legal ground, recipients of data transfers and their rights, it cannot be said that complete information has been provided merely on the basis of system permission.

Where processing relies on explicit consent, the technical permission and legal consent mechanisms should be designed consistently. Precise and approximate location, tracking while the application is open and in the background, and core-functionality and advertising purposes should not be combined into a single choice. It should be possible to record a user’s affirmative choice in a manner indicating the purpose, scope and version to which it relates.

The Personal Data Protection Board’s Principal Decision No. 2026/347 has introduced a current and clear standard for this design. The privacy notice and explicit consent text should be prepared separately; if presented on the same page, distinct headings and separate declarations should be used. Users should not be asked for additional consent for processing activities that do not require explicit consent, and confirmation that the privacy notice has been read should not be converted into a declaration of consent.

How Should Location Data Be Addressed in a Mobile Application Privacy Notice?

Information must be provided before personal data processing begins, regardless of the legal ground relied upon. The limited space on a mobile screen does not justify vague or incomplete information. Key information may be presented in a short first layer, provided the user can easily access the full text if desired.

A privacy notice concerning location data should clearly answer at least the following questions:

• Who is the data controller?
• Is precise or approximate location processed?
• For which feature and purpose is the data used?
• What is the legal ground for processing under the KVKK?
• Is location collected only while the application is in use or also in the background?
• By what method is the data collected, and how may users exercise their rights under Article 11 of the KVKK?
• To which recipient groups, such as map, analytics, advertising network or cloud providers, is data transferred, and for what purposes?

General statements such as ‘to improve service quality’ or ‘processing under Article 5 of the KVKK’ are not sufficient on their own. Principle Decision No. 2026/347 requires the data category, purpose and legal ground to be clearly specified and the texts to be plain and specific to the processing activity. If the purpose of processing subsequently changes, the user must be informed separately before the new purpose is pursued.

The Proportionality Principle under the KVKK: When Are Precise Location and Continuous Tracking Unlawful?

The Board’s decisions demonstrate that merely identifying a legal ground is insufficient; the data selected and the method used must also be relevant to, limited to and proportionate to the purpose. In its Decision No. 2023/1430 concerning a mobile meal card, the Board regarded the possibility of carrying out verification with less intrusive information instead of a Turkish Republic identity number as significant. This approach raises the same question in relation to location data: Can the purpose be achieved through less detailed location information or a different method?

The following design choices may strengthen proportionality:

• Keeping background access disabled by default
• Erasing, destroying or genuinely anonymising data once the retention period expires
• Using city, district or approximate location when precise coordinates are unnecessary
• Accessing location when the user activates the feature instead of tracking continuously
• Not transmitting location to the application provider’s server where processing can be completed on the device
• Storing only the departure and destination information necessary for the transaction instead of the entire route history

The Authority’s Recommendations document also states that where a contact-tracing application can achieve its purpose using Bluetooth proximity data, tracking the user’s exact location and movements may be disproportionate. Rather than collecting the most detailed data that technology permits, the minimum data sufficient for the purpose should be preferred.

Mobile SDKs, Third-Party Integrations and Cross-Border Transfers of Location Data

Location data flows within a mobile application may extend beyond the application owner and user. Map services, advertising networks, analytics tools, error-monitoring software, software development kits (SDKs), application developers and cloud providers may have access to location data or device identifiers that can be associated with location.

The actual role of each party should first be determined. A technical service provider acting solely on the application provider’s instructions may be a data processor, while a party using data for its own advertising or product development purposes may become a data controller in respect of that activity. The designation in a contract does not, by itself, change the party’s actual decision-making authority.

According to the Authority’s Recommendations, transparency should be ensured regarding data processing by integrated third parties; where there is no legal ground for processing, the relevant service should not be used in the application. Accordingly, the SDK inventory should not be treated merely as a technical list but should be reviewed regularly together with the data accessed, purposes, roles, retention periods and points of transfer.

Sending location data to a server abroad or enabling a service provider abroad to access the data may give rise to a cross-border transfer under Article 9 of the KVKK. In that case, it must be determined separately whether an adequacy decision, an appropriate safeguard or an exception provided solely for occasional transfers applies. Where a standard contract is used, the correct roles of the parties must be selected and the Authority must be notified within 5 business days following signature of the contract.

Location Data Security: Technical Measures, Retention and Destruction Processes

If location records are compromised, they may reveal where an individual lives, the hours when they are away from home and the persons with whom they are regularly present at the same location. The data controller is therefore obliged to take technical and administrative measures proportionate to the risk in order to prevent unlawful processing and access and to ensure secure storage of the data.

Encryption during transmission and storage, secure key management, role-based access, logging of administrator activities, regular authorisation reviews, up-to-date software components, security testing and an incident response process are key measures. Avoiding the use of real location histories in development and testing environments and restricting support personnel’s access to production data also reduce the risk of unnecessary disclosure.

A retention period cannot be set without limit merely on the assumption that data ‘may be needed in the future’. The legal or operational necessity should be established separately for each purpose; when the grounds requiring processing cease to exist, data must be erased, destroyed or anonymised ex officio or upon the data subject’s request. Closing a user account does not automatically mean that all location records held in backups and third-party systems have been erased; the destruction process should cover all copies.

Users’ Rights and Application Procedures under the KVKK Regarding Location Data

Users may restrict location permission in device settings to ‘only while using the application’, select approximate location or revoke permission. However, changing a device setting does not itself result in the erasure of previously collected data. Users may also apply to the data controller to learn whether their location data has been processed, the purposes of such processing and the parties to whom it has been transferred domestically or abroad, and may request rectification, erasure or destruction where the applicable conditions are met.

The data controller must respond to an application as soon as possible and in any event within 30 days. If the application is rejected, the response is considered insufficient or no response is provided within the prescribed period, the data subject may lodge a complaint with the Personal Data Protection Board within 30 days of learning of the response and, in any event, within 60 days of the date of the application.

Step-by-Step KVKK Compliance Checklist for Mobile Application Developers

Having legal, product, software, information security and marketing teams work on the same data flow while the location feature is being developed reduces the cost of subsequent corrections. The compliance process may be established in the following order:

1. Map which sensor or service provides the location data, and at what frequency and level of precision;
2. Conduct a necessity test for each feature and purpose and determine the legal ground separately;
3. Design precise-location access, background access and retention periods as narrowly as possible;
4. Separate the privacy notice from the explicit consent mechanism in accordance with Principal Decision No. 2026/347;
5. Design refusal and consent-withdrawal options so that they do not prevent access to non-essential services;
6. Review the roles and data transfers of SDK, map, advertising, analytics and cloud providers;
7. Determine the cross-border transfer mechanism and manage the necessary contractual and notification timelines; and
8. Regularly test retention, erasure, user applications, data breach response and consent records.

It is as important for an application’s technical behaviour to match the text as it is for the text itself to be legally accurate.

Manage Location Data Risks at the Design Stage

Excessively broad location access, unclear purposes and unmonitored third-party components may simultaneously undermine user privacy, brand trust and compliance with the KVKK. Once an application has been released, merely changing the texts will not eliminate these risks as long as the technical data flows remain unchanged.

Esenyel Partners provides legal support in identifying location data inventories and legal grounds, preparing privacy notices and explicit consent mechanisms, reviewing SDK and service provider agreements and establishing cross-border transfer mechanisms.

You may contact Esenyel Partners to assess legal compliance alongside technical design before launching a new location feature or when reviewing permissions and data flows in your existing application.

Contact