Can a single SMS code authorize multiple separate consents?
The Turkish Personal Data Protection Board's Principle Decision No. 2025/1072, dated 10 June 2025, calls for ending the practice of using one SMS verification action to complete distinct processes such as membership acceptance, explicit consent to personal-data processing and consent to commercial electronic messages. Rezervem Join supports guest registration and configured permission steps; Rezervem Connect supports eligible WhatsApp campaigns with opt-out checks. A guest profile does not itself authorize marketing.
The decision neither bans SMS verification nor requires a new code for every permission. Distinct actions must be clear, informed and voluntary; marketing must not be a service condition.
How could the problem appear in a restaurant?
Imagine a guest scanning the QR card on a table and receiving a code described as simple phone verification. If the form uses that same action to accept membership terms and sign the guest up for new-menu promotions, the recorded outcome no longer matches what the guest was told. Complaints reviewed by the Board involved codes presented as necessary for payment, account creation or updating details, followed by promotional messages.
Staff explanations, SMS content and the permissions actually stored should agree. A shorter form is no justification for hidden marketing.
Five implications for hospitality operators
First, explain why the SMS code is being sent and what entering it will do; include a route to relevant privacy information. Second, do not combine membership acceptance, consent to particular data processing and commercial-message approval into a single indistinguishable action.
Third, provide privacy notices separately from consent requests. Fourth, do not make marketing acceptance a condition of a booking or other service. Fifth, train employees to explain and periodically test the actual flow.
Privacy notices, explicit consent, IYS and WhatsApp are distinct
A privacy notice informs the individual of the data controller, purpose and legal grounds for processing. It is not a marketing agreement. Explicit consent is required where the processing relies on that legal basis, not for every lawful processing activity. Commercial electronic messaging also falls under Law No. 6563 and associated rules; IYS approval and refusal records and recipient-specific exceptions may matter.
Meta's WhatsApp platform has additional participation, template and opt-out rules. A phone number or guest profile does not grant unrestricted promotions. Decision 2026/347 of 18 February 2026 also emphasizes keeping privacy notices separate from explicit consent.
1. Separate service purposes from promotional purposes
Determine what information is needed for a reservation, an invoice, a QR guest profile and an event invitation. Identify the applicable legal basis for each use. Do not move a number originally collected for booking confirmation straight into a promotional audience without checking the necessary permissions.
2. Present the notice and any required consent independently
Show a venue-specific notice in clear language. Where processing relies on explicit consent, request a separate, informed and voluntary declaration. Do not turn the privacy notice into an all-purpose marketing checkbox. State which promotional communication channel the guest is being asked to accept.
3. Explain exactly what the verification code does
Explain whether the code verifies a number or authorizes a specified action. Include accessible information in the SMS. Never use one code as an invisible key to unrelated agreements. Separate decisions do not imply a new OTP per checkbox.
4. Test the flow when a guest declines marketing
If a guest declines marketing, can the booking or service still proceed? Do not block a necessary transaction because optional promotional permission was declined. Rezervem Join's linked and independent QR configurations behave differently; test the version deployed at each venue.
5. Verify eligibility before using Connect
Join provides the guest registration touchpoint and configured permission steps. Connect supports eligible audiences, approved WhatsApp templates, sending and campaign results. Do not assume identical consent behaviour in every setup. An old guest profile does not override a missing permission record or a later refusal.
Explore Rezervem Join and Rezervem Connect for their different roles. Review the source of each guest record and the actual local IYS and Meta requirements before communicating.
Frequently asked questions
**Is one SMS verification forbidden?** No. The issue is using one opaque verification to accept distinct legal processes.
**Does every consent need a separate OTP?** Not as a blanket requirement under this decision. Separate informed decisions are the principle.
**Can a reservation depend on receiving promotions?** Marketing permission must not be made a mandatory condition of the underlying service.
**Does a Join profile authorize a Connect campaign?** No. Permission evidence, channel preferences, IYS status and refusals must be checked.
Official sources
See the Turkish regulator's Principle Decision 2025/1072, published in the Official Gazette on 26 June 2025 (No. 32938), and its announcement concerning Decision 2026/347. This article is general information, not a legal opinion on an individual venue's setup.
