Is collecting LinkedIn profile data lawful under Turkish data protection law?

Under Turkey’s Law 6698, personal data being publicly available does not make it freely processable: the Board’s settled reading is that data made public by the individual may only be processed in a way connected to, and limited by, the purpose for which it was made public. A company that harvested work e-mail addresses from search engines for marketing was fined on exactly that reasoning. BrandLoop builds no contact lists for that reason; it works only with the user’s own account data.

This is informational and not legal advice; a specific case needs a lawyer. The aim here is not interpretation but showing what the statute and the Board’s decisions actually say, because most of what circulates on this subject is second-hand.

Collecting is already processing

Article 3 of Law 6698 defines processing with obtaining, recording and storing at the front of the list. Copying a profile into a spreadsheet is processing before anything is done with it. That shifts the starting question from “may I use this data” to “may I collect it”.

Where the public-disclosure exception actually sits

Article 5 lists the conditions for processing without explicit consent, one of which is that the data has been made public by the data subject. Article 28(2)(b) additionally lifts the transparency duty, some data-subject rights and the data controller registry obligation for such data.

Two limits are easy to miss. Article 28(2) lifts only Articles 10, 11 and 16 — the general principles in Article 4, the requirement of a processing condition in Article 5, the erasure duty in Article 7 and the security duty in Article 12 all remain. And the exception itself is conditioned on being consistent with the law’s purpose and principles, and proportionate.

The Board’s settled reading: the purpose limit

In a 2020 public announcement the Board tied public disclosure to two elements: the individual’s intention and the purpose of disclosure. Its wording is that data simply being visible to everyone is not sufficient for it to count as made public — the act must also be supported by the individual’s will.

The same announcement uses social media directly as an example: names, phone numbers and e-mail addresses obtained from social media accounts and then processed by sending marketing SMS or e-mail cannot be assessed under the public-disclosure condition.

The decision closest to scraping

A 2022 decision concerned a software company that collected lawyers’ work e-mail addresses from internet search engines and sent B2B marketing e-mails. The Board’s reasoning is the clearest sentence available in this area: data having been made public does not mean it may be processed for any purpose, only in a manner connected to and limited by the purpose of disclosure.

The Board found the work address had been made public for professional correspondence, not for marketing, and imposed a 150,000 TRY administrative fine. It also placed the burden of proof on the controller, noting that no evidence of an intention to make the address public for marketing had been submitted.

A 2019 decision follows the same logic: an insurance company called a complainant on a number found on a public website to book an appointment. The Board held the person had not been contacted for his professional expertise but for the company’s own business, and declined to apply the exception.

A gap worth stating: no scraping-specific decision

The Board’s published principle decisions contain nothing specifically on web scraping or bulk collection from social media, and no published decision summary names LinkedIn. The applicable law is therefore assembled by analogy from the statute, the 2020 announcement and the two decisions above. That is reason enough to distrust articles offering a categorical answer.

Two separate lines of liability

A distinction that gets blurred: data-protection liability runs toward the profile owners, while liability under the LinkedIn User Agreement runs toward LinkedIn and operates independently. Section 8.2 of that agreement directly prohibits using software, scripts or browser add-ons to scrape profiles and other data.

The hiQ litigation in the United States illustrates the point. An appellate court held that scraping public profiles was unlikely to violate computer-misuse law — and the case ended with a consent judgment of 500,000 dollars against hiQ, a permanent injunction and destruction of the derived data, on contract grounds. It did not legalise scraping; it moved the risk from criminal law to contract law, and said nothing about data protection.

Why this became a product decision

BrandLoop does not build contact lists and does not send connection requests on anyone’s behalf. What it does is generate your content from your own account’s data. The technical side of the same boundary — which permissions are open and which are closed — is covered in our piece on comment automation.