In an outbound voice project the technical setup is usually finished in a fortnight. What actually delays go-live is a different question: are we allowed to call this number, and what are we allowed to say once we do?
Two distinct legal regimes answer that, and they are routinely conflated. In Turkey the first is Law No. 6563 on the Regulation of Electronic Commerce and its implementing regulation, which governs whether the call may be placed. The second is Law No. 6698 on the Protection of Personal Data (KVKK), which governs whether the data may be processed. Satisfying one does not satisfy the other.
Automated calling is already a defined channel
The Ministry of Trade's definition is explicit: messages sent for commercial purposes through telephone, call centres, automatic dialling machines, smart voice recording systems, email and SMS are commercial electronic messages (ticaret.gov.tr).
An outbound call placed by a voicebot is therefore not a new category. Automated calling is already in scope, and once the call is commercial in purpose, consent must be registered through the Message Management System (İYS), which is also where the recipient's right to refuse is exercised (iys.org.tr).
"It is an AI system, not a recorded marketing message" carries no legal weight here.
What decides the classification is content, not technology
Whether a call counts as a commercial electronic message depends on what is said, not on who or what says it. The regulation exempts notifications relating to an ongoing subscription, membership or partnership, as well as collections, debt reminders, information updates, purchases and deliveries, from the prior consent requirement. The condition is that these notifications must not promote or advertise any product or service. Separately, prior consent is not required for recipients who are merchants or tradespeople, though calls must stop once they exercise their right to refuse.
For voice automation the practical consequence is direct: dialogue design has legal consequences.
An appointment reminder call falls within the exemption. If the assistant closes the same call with "by the way, we have an offer this month", the call is now a commercial electronic message placed without consent. In a scripted IVR this risk was low, because the system only played what was written. In an assistant that can speak freely, the boundary has to be enforced structurally.
We implement this with three rules:
- Transactional and promotional flows are never combined in the same campaign
- The assistant is prevented from producing offer, discount or upsell language at the flow level, not merely at the prompt level
- Recordings are sampled regularly to audit whether the assistant stayed inside the script
The third matters for defensibility. You will need to demonstrate that a call fell inside the exemption; without recordings and a control trail, the claim is weak.
Opt-out has to be modelled as an intent
This is the most frequently missed requirement. The right to refuse is not just a link at the bottom of an SMS. If someone says "do not call me again" during the call, that request must be captured and reflected in the consent registry.
A voicebot only catches this if it has been trained to. People rarely phrase the request cleanly. Real recordings contain variants like "take me off your list", "do not message this number either", and "I never gave you permission". These need to collapse into a single intent that halts the flow immediately and writes the request to the system.
Without that flow, the pattern is predictable: the person refused explicitly on the call, the system treated it as off-topic, the script continued, and the same number was dialled again two weeks later. That is not defensible in a complaint.
Data protection is a separate question
Consent registered in İYS does not give you a lawful basis for processing personal data. These are different regimes.
For an outbound assistant, the questions to answer under KVKK are:
- On what legal basis is the calling list processed
- When and how is the information notice delivered
- Are calls recorded, and if so what is the retention period and deletion process
- Are transcripts and analysis outputs treated as a separate data category
- Is the model and infrastructure provider engaged as a data processor under contract
On notices, the authority's approach is flexible: the duty can be discharged verbally, including via voice recordings or call centres. But "can be" and "is" are different things. The opening disclosure must exist in the script and be provable from the recording.
A voice recording and a voiceprint are not the same thing
This distinction has real consequences. Recording a call makes the recording personal data. Extracting a voiceprint to identify the speaker moves you into biometric data, which under Article 6 of KVKK is a special category subject to considerably stricter conditions.
"Recognise the customer by voice so we can skip security questions" is operationally attractive. Deployed without costing the legal exposure, it becomes the riskiest component in the project.
Where processing happens is often decided silently
In most projects nobody consciously decides where voice data is processed. A cloud speech service is selected and the data leaves the country as a side effect.
Article 9 of Law No. 6698 was amended by Law No. 7499, with the changes taking effect on 1 June 2024. Where no adequacy decision exists, transfers rely on appropriate safeguards such as standard contractual clauses or binding corporate rules, and a signed standard contract must be notified to the Authority within five business days (kvkk.gov.tr).
Deployment model selection is therefore a compliance decision, not a performance preference. We work through the decision tree in the data residency article.
If you call people in the EU there is one more heading
Article 50 of the EU AI Act requires AI systems that interact directly with people to be designed so the person knows they are dealing with AI, with notification given no later than the first interaction. The article became applicable on 2 August 2026 (artificialintelligenceact.eu, European Commission FAQ).
Turkey has no equivalent requirement yet. Even so, in the recordings we review, flows that disclose the assistant up front do not show lower completion. They show fewer interruptions of the "who am I speaking to" variety. Treating transparency as flow design rather than as a compliance chore is the more productive framing.
What reminder calls actually change
The effect of automated reminders on attendance is among the better-studied questions in healthcare. The Cochrane systematic review of mobile phone messaging reminders found evidence that reminders improve attendance at appointments (Gurol-Urganci et al., 2013).
The important caveat is that this finding concerns text message reminders. Voice reminders work on similar logic, but effect size varies by sector, audience and timing. Committing to a number before measuring your own data would be dishonest. Our recommendation is to hold back a control group when the reminder flow goes live and measure the real effect in your own operation over the first quarter.
Pre-launch checklist
- Is the source and legal basis of the calling list documented
- Is the call commercial or transactional, and is that boundary explicit in the script
- For commercial flows, is consent checked at dial time
- Is opt-out defined as an intent that halts the flow and opens a record
- Is the information notice in the script and provable from recordings
- Are retention and deletion defined for recordings
- If voiceprints are extracted, has the special-category regime been assessed
- In which country is the data processed, and are safeguards and notifications in place
With these eight answered, an outbound project becomes a technical project. Without them, no amount of engineering quality gets it live.
To see how survey, reminder and experience measurement flows are built, look at Survey and Customer Experience Measurement.
This article is general information and is not legal advice. Review your own case with your legal team before implementation.
References
- Republic of Türkiye Ministry of Trade, Message Management System (İYS). ticaret.gov.tr
- İleti Yönetim Sistemi A.Ş. iys.org.tr
- Turkish Data Protection Authority, transfers abroad. kvkk.gov.tr
- EU AI Act, Article 50: Transparency Obligations. artificialintelligenceact.eu
- Gurol-Urganci, I. et al. (2013). Mobile phone messaging reminders for attendance at healthcare appointments. Cochrane Database of Systematic Reviews. cochranelibrary.com