Accessibility, security and KVKK obligations on public websites

The Public Internet Sites Guide (KAMİS) is a comprehensive guide presenting the basic principles for the usability and accessibility of public websites. The Guide has been made available to public institutions as five sub-guides: the Usability and Accessibility Guide for Websites, the Usability Principles Guide, the Accessibility Principles Guide, the Public Internet Sites Legislation Information Guide, and the Technology Guide. The sub-guides are published on the TÜBİTAK BİLGEM website.

The Accessibility Principles Guide explains the success criteria under WCAG 2.1 using positive and negative examples from public sites. According to the Guide, the Level A principles, consisting of 30 criteria under WCAG 2.1, are the standards expected to be met at a basic level; where these are not met, the great majority of users with disabilities cannot effectively benefit from the site's content. The Level AA principles, consisting of 20 criteria, are presented as standards whose fulfilment is recommended. The Guide also states that the criteria and checklists required for the ISO 9241-151 and ISO/IEC 40500 certifications issued by the Turkish Standards Institution (TSE) can be accessed.

The Web Content Accessibility Guidelines (WCAG) are published by the World Wide Web Consortium (W3C). The W3C's current recommendation is WCAG 2.2; it was first published on 5 October 2023, and its current text is dated 12 December 2024. WCAG 2.2 added nine new success criteria to WCAG 2.1 and removed the 4.1.1 Parsing criterion. The new criteria cover topics such as keyboard focus not being obscured by other content, providing alternatives to dragging movements, the minimum size of click targets, help links being located consistently, not re-requesting previously entered information, and accessible authentication.

In the European Union, Web Accessibility Directive 2016/2102 applies to public sector websites and mobile applications. According to the European Commission, the harmonised standard adopted under the Directive is EN 301 549 v3.2.1, which is largely based on WCAG 2.1. This overview shows that WCAG 2.1 Level AA is the widely accepted minimum target today, and that for a new site project it would be appropriate to take the WCAG 2.2 criteria into account from the outset as well.

The Law on Persons with Disabilities, Law No. 5378, defines accessibility as buildings, open spaces, transport and information services, and information and communication technology being safely and independently reachable and usable by persons with disabilities. Article 7 of the Law provides that information services and information and communication technology shall be made accessible for persons with disabilities. The accessibility of public websites falls directly within the scope of this general provision.

The Accessibility Monitoring and Inspection Regulation, carried out by the Ministry of Family and Social Services, defines its scope as the buildings providing public service, open spaces and public transport vehicles referred to in provisional articles 2 and 3 of Law No. 5378. Those found compliant following inspection are issued an Accessibility Certificate by the governorship. The Accessibility Logo, introduced by the Ministry in 2022 and designed by the United Nations, can also be used by those holding this certificate. Although the Ministry states that the logo also covers access to information and communication technologies, the certification process is defined for buildings, open spaces and public transport vehicles.

The Ministry also carries out work in the field of web accessibility. In the web accessibility standards training announced in 2022, WCAG 2.1 and the KAMİS Accessibility Principles were taken as the basis, and it was stated that 3,342 people from more than 850 institutions took part in this training during the 2020–2021 period.

The Information and Communication Security Guide (Version 1.1, March 2026) of the Siber Güvenlik Başkanlığı contains measures that can be applied directly to the technical security of public websites.

• 3.2.5.1: The application must consist of components that have had security updates and patches applied.
• 3.2.5.2: Secure HTTP headers such as X-Frame-Options and Content-Security-Policy must be used to secure client-side resources.
• 3.2.9.1: All connections involving critical data or functions must be made using a trusted SSL/TLS version that does not contain known vulnerabilities.
• 3.2.9.3 (Level 2): HSTS must be used to secure connections made to web pages and the resources used.
• 5.3.1.4: Default error and installation pages must be removed, and HTTP headers that reveal information about the web server technology must be hidden.
• 3.1.3.3: Vulnerability and patch management policies must be defined for the timely detection of security weaknesses, and changes must be made in a controlled manner.

These measures create an operational responsibility that must be maintained after the site goes live as well. The update schedule for the content management system, plugins and server software, who will monitor security notifications, and, if a service is being procured, the contractor's update obligation must all be clearly set out in the contract.

Article 10 of the Personal Data Protection Law (KVKK, Law No. 6698) requires that, when personal data is obtained, information be given about the identity of the data controller, the purpose of processing, the parties to whom data is transferred, the method of collection and the legal basis, and the rights of the data subject. On a public site with contact forms, e-service links and newsletter sign-ups, the privacy notice must be accessible from every point where data is collected. Article 12 requires that the technical and administrative measures necessary for data security be taken.

The Personal Data Protection Authority, in its Guide on Cookie Practices dated July 2025, proposes two criteria: that the cookie be used solely to carry out communication over the electronic communications network, and that it be strictly necessary for the service explicitly requested by the user. Explicit consent may be required for cookies falling outside these criteria. The Guide presents, as an example of good practice, giving the accept, reject and preferences options equal weight in terms of colour, size and font on the cookie management panel shown on entering the site, and notes that disclosure must also be given on this panel.

Loading services such as analytics, maps, video or fonts from third-party servers can result in the visitor's data being transferred to those parties and, in some cases, abroad. For this reason, every external service used on the site must be separately assessed in the cookie inventory and the privacy notice; where data is transferred abroad, the conditions set out in Article 9 of the KVKK must be observed.

• Trying to achieve accessibility solely through a toolbar added after the fact; the criteria must be met in the page structure and content.
• Hiding the reject option on the cookie panel, or presenting pre-ticked preferences.
• Leaving the published site's updates without a designated owner or schedule.