Updated 2 November 2026: shortened to what the source supports, and now linked to the KVKK post itself. KVKK said these apps "may" lead to biometric data being processed; it did not rule on any app. We corrected the earlier statement that uploading a photo to a foreign app is usually a transfer abroad, because KVKK's transfer guide treats direct collection from the person differently. Unverified statements about how apps work and a list of foreign cases have been removed.

Correction (19 October 2026): An earlier version said the KVKK had found that users are not told what their data is used for (its post in fact urged users to check what data apps access and for what purposes) and misdated the Facebook BIPA settlement; both are corrected, and links to two withdrawn articles have been removed.

On 10 September 2026 Türkiye's Personal Data Protection Authority (KVKK) warned users on X about AI apps behind the "#80lerchallenge" trend, which turns photos into 1980s-style images. The Authority said these apps may lead to the processing of biometric data. The warning is a short social-media post, not a decision, and it names no app.

What did KVKK say about the 80s challenge?

KVKK's post asks people to think about their digital privacy before turning photos into nostalgic images with AI apps. It says apps used in trends such as #80lerchallenge "may cause your biometric data to be processed" through your photos. It then gives two pieces of advice: check what data the apps access, and find out what purposes your data may be used for. It ends: "Let memories live on, and what is yours stay with you."

That is all the Authority said. It did not ban any app, find any breach or say how any particular app works.

Is every selfie biometric data?

No. A photo is not biometric data merely because it shows a face. Law No. 6698 lists biometric data as a special category in Article 6, but does not define it there. KVKK's own guide on biometric data (March 2025) draws on the EU's definition: distinguishing features must be extracted through processing, and they must serve to identify the person or verify their identity. The GDPR makes the same point about photos: recital 51 says photographs count only when processed through specific technical means that allow a person to be uniquely identified or authenticated.

So the answer depends on what an app does with the image, and that is why KVKK's "may" matters. KVKK has dealt with facial data in other settings, such as biometric attendance systems and a bank's mobile app. Those were not filter apps, and we are not aware of a KVKK decision on one.

Which KVKK rules would apply?

If an app does process biometric data, the stricter rules for special categories apply.

  • Legal basis. Article 6(3), as amended by Law No. 7499 from 1 June 2024, prohibits processing unless a listed condition applies, such as explicit consent. In our view consent is the realistic condition for an entertainment app.
  • Quality of consent. Article 3 defines explicit consent as specific, informed and freely given. In our view, a general "by using this app you accept the terms" clause is hard to square with that.
  • Notice. Article 10 requires the controller to state its identity, the purpose, the recipients and the method and legal basis of collection. KVKK's second piece of advice points the user towards the same information.
  • Security. Article 12 requires appropriate technical and organisational measures.

Is uploading a photo to a foreign app a transfer abroad?

Not usually, when you upload it yourself. KVKK's guide on transfers abroad says, using an online-shop example, that a person in Türkiye who gives data directly to a foreign company targeting the Turkish market is not making a transfer, because no controller or processor is exporting the data. The Law still applies to that company's processing. If the company then passes the data to a processor abroad, that step is a transfer under the transfer rules.

A brand in Türkiye is in a different position. If it runs a campaign and sends customers' photos to a provider abroad, Article 9 is engaged. It should settle each party's role, the retention period and any use for model training in the contract. Our guide to KVKK cross-border transfers explains the routes.

What can a user do?

Start with KVKK's two checks. Beyond them, general steps are sensible: give access to one chosen photo rather than the whole gallery, read how long images are kept and whether they train models, and think twice before uploading photos of children or other people.

Article 11 gives a person the right to learn whether data is processed and why, to know who received it, and to ask for deletion. Under Article 13 the controller must answer within 30 days. Under Article 14 a person may then complain to the Board within 30 days of the answer, and at most 60 days from the application.

Does EU AI law say anything about this?

Only in part. The EU AI Act bans untargeted scraping of facial images to build recognition databases (Article 5(1)(e)) and certain biometric categorisation (Article 5(1)(g)). Article 50(4) requires deepfakes to be disclosed; our note on marking AI-generated content covers this. A filter app is not banned by these rules as such. Türkiye has no AI act in force.

Frequently asked questions

Has KVKK banned 80s challenge apps?

No. KVKK's post of 10 September 2026 is an awareness message. It advises users to check what data apps access and what purposes their data may be used for. It names no app and finds no breach.

Does KVKK say my photo is biometric data?

Not in those terms. KVKK says such apps may cause biometric data to be processed through photos. Whether a given app does so depends on how it handles the image. Under the GDPR's recital 51, a photo counts only if processed by specific technical means allowing unique identification.

Does the KVKK law apply to an app based abroad?

It can. KVKK's transfer guide says a foreign company targeting the Turkish market that collects data directly from people in Türkiye is subject to Law No. 6698, even though that direct collection is not a transfer abroad. Enforcing rights against a foreign company may be harder in practice.

Burhan Doğuş Ayparlar's View

This section reflects my personal assessment as the founder of this site and an attorney at law (Türkiye).

In my view, KVKK's post touches a real problem: the greatest risks can sit in the most innocent-looking interactions. I also doubt that consent which is unread and bundled with the service meets the standard Article 3 sets for explicit consent.

I welcome the warning, but awareness alone is not enough. Guidance for developers and for brands using these filters, and decisions where needed, would do more. For users, a simple image helps: you can change a password, but not your face.

Sources: KVKK's post on X (10 September 2026), read directly; Law No. 6698 as published on mevzuat.gov.tr; KVKK's Guide on Transferring Personal Data Abroad (January 2025) and Guide on Processing Biometric Data (Publication No. 55, March 2025); GDPR recital 51; Regulation (EU) 2024/1689. All read on 1 November 2026. We have not examined any particular app. General information, not legal advice.