How to fix common KVKK & GDPR privacy issues

Serious KVKK m.5 · GDPR Art. 6 · ePrivacy Art. 5(3) · Analytics

Stop Google Analytics from loading before consent (KVKK/GDPR)

Google Analytics (GA4) sets identifiers and sends the visitor’s IP and page data to Google the moment it loads. If that happens before the visitor accepts cookies, it is processing without a legal basis.

Serious KVKK m.5 · GDPR Art. 6 · ePrivacy Art. 5(3) · Tag manager

Gate Google Tag Manager behind consent

Google Tag Manager is a loader: it can inject analytics, ad and pixel tags. If GTM fires those tags on page load, every one of them runs before consent — even the ones you forgot were there.

Serious KVKK m.5 · GDPR Art. 6 · Art. 26 (joint controller) · Social pixel

Load the Meta (Facebook) Pixel only after consent

The Meta Pixel tracks visitors for advertising and builds custom audiences. Firing it on page load shares behaviour with Meta before consent — and Meta is a joint controller for that data.

Critical KVKK m.5 · GDPR Art. 6 · Art. 9 risk · Session recording

Session recording (Hotjar, Clarity, Yandex) needs explicit consent

Hotjar, Microsoft Clarity and Yandex Webvisor record the visitor’s screen, mouse and keystrokes. Loading them before consent captures potentially sensitive input without a legal basis.

Moderate KVKK m.9 · GDPR Chapter V (transfers) · CDN

Self-host Google Fonts to stop leaking visitor IPs

Loading fonts from fonts.googleapis.com sends every visitor’s IP address to Google on page load — a cross-border transfer that happens before consent and cannot be consented to for an essential asset.

Serious KVKK m.5 · m.9 · GDPR Art. 6 · Chapter V · Analytics

Yandex Metrica: consent + a cross-border transfer to Russia

Yandex Metrica is analytics (and, with Webvisor, session recording) that sends data to Russia. It raises both a pre-consent problem and a cross-border transfer problem at once.

Critical KVKK m.5 · GDPR Art. 6 · ePrivacy Art. 5(3) · Consent

No consent banner? Non-essential trackers can’t run at all

If PrivaScan finds trackers but no consent management platform, there is no mechanism to get consent — which means every non-essential tracker on the page is running without a legal basis.

Serious KVKK m.5 · GDPR Art. 6 · ePrivacy Art. 5(3) · Advertising

Google Ads / DoubleClick remarketing before consent

DoubleClick / Google Ads remarketing tags drop advertising cookies to retarget visitors across the web. On page load, that is advertising processing without consent.

Critical KVKK m.5 · m.9 · GDPR Art. 6 · Chapter V (transfers) · Session recording

Microsoft Clarity records sessions before consent (KVKK/GDPR)

Microsoft Clarity records the visitor’s screen, clicks, scrolls and keystrokes to build heatmaps and session replays, and sends that data to Microsoft. Loading it on page load captures behaviour — and possibly form input — before any legal basis exists.

Serious KVKK m.5 · m.9 · GDPR Art. 6 · Chapter V (transfers) · Social pixel

Load the TikTok Pixel only after consent (cross-border to China)

The TikTok Pixel tracks visitors for advertising, conversion measurement and audience building. Firing it on page load shares behaviour with TikTok before consent — and the data can flow cross-border, including to China.

Serious KVKK m.5 · GDPR Art. 6 · ePrivacy Art. 5(3) · Chapter V · Advertising

LinkedIn Insight Tag needs consent before it loads (KVKK/GDPR)

The LinkedIn Insight Tag drops advertising cookies to enable B2B retargeting, conversion tracking and audience insights. On page load, that is advertising processing without a legal basis.

Moderate KVKK m.5 · GDPR Art. 6 · Chapter V (transfers) · Anti-fraud

Google reCAPTCHA loads on forms and sends data to Google

reCAPTCHA (especially v3) loads on any page with a protected form, sets cookies and sends behavioural signals and the visitor’s IP to Google — often long before the visitor submits anything or accepts cookies.

Moderate KVKK m.5 · GDPR Art. 6 · ePrivacy Art. 5(3) · Chapter V · Video embed

Stop YouTube embeds tracking visitors before consent (KVKK/GDPR)

A standard YouTube <iframe> contacts Google and can set advertising cookies as soon as the page loads — before the visitor ever presses play or accepts cookies.

Moderate KVKK m.5 · m.9 · GDPR Art. 6 · Chapter V (transfers) · Map embed

Google Maps embeds leak visitor IPs to Google on load

An embedded Google Map contacts Google the moment the page loads, sending the visitor’s IP address (and referrer) to Google and potentially setting cookies — before consent.

Serious KVKK m.5 · GDPR Art. 6 · ePrivacy Art. 5(3) · Chapter V · Chat widget

Chat widgets (Intercom, Crisp, Tawk) drop cookies before consent

Live-chat widgets like Intercom, Crisp and Tawk.to load a third-party script on page load, set cookies or local-storage identifiers and can begin tracking the visitor before any consent is given.

Serious KVKK m.5 · GDPR Art. 6 · ePrivacy Art. 5(3) · Consent

How to set Google Consent Mode v2 defaults to denied (KVKK/GDPR)

Google Consent Mode v2 tells every Google tag — Analytics, Ads, DoubleClick — whether it may use storage. If you never set the defaults to "denied", Google tags behave as if consent were granted the moment the page loads.